SIGSEGV in json_string_set_cs & ASAN use-after-poison in sql/sql_string.h

SET max_statement_time=0.000001;

SELECT JSON_SET ('[','$[0]',0);

Core was generated by `/test/MD180223-mariadb-11.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  json_string_set_cs (s=s@entry=0x146dd4192e40, i_cs=0xa5)

    at /test/11.0_dbg/strings/json_lib.c:43

43	  s->wc= i_cs->cset->mb_wc;

[Current thread is 1 (Thread 0x146dd4195640 (LWP 3789671))]

(gdb) bt

#0  json_string_set_cs (s=s@entry=0x146dd4192e40, i_cs=0xa5) at /test/11.0_dbg/strings/json_lib.c:43

#1  0x000055bbddcd4d31 in json_string_setup (end=0xa5a5a49b <error: Cannot access memory at address 0xa5a5a49b>, str=0x0, i_cs=<optimized out>, s=0x146dd4192e40) at /test/11.0_dbg/strings/json_lib.c:51

#2  json_scan_start (je=0x146dd4192e40, i_cs=<optimized out>, str=0x0, end=0xa5a5a49b <error: Cannot access memory at address 0xa5a5a49b>) at /test/11.0_dbg/strings/json_lib.c:812

#3  0x000055bbdd4eb247 in Item_func_json_insert::val_str (this=0x146c8c0138b0, str=0x146c8c013970) at /test/11.0_dbg/sql/item_jsonfunc.cc:3357

#4  0x000055bbdd528e3e in Type_handler::Item_send_str (this=<optimized out>, item=0x146c8c0138b0, protocol=0x146c8c001368, buf=<optimized out>) at /test/11.0_dbg/sql/sql_type.cc:7454

#5  0x000055bbdd468b79 in Type_handler_string_result::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/11.0_dbg/sql/sql_type.h:5460

#6  0x000055bbdd2075dc in Item::send (this=0x146c8c0138b0, protocol=0x146c8c001368, buffer=0x146dd4192ff0) at /test/11.0_dbg/sql/item.h:1235

#7  0x000055bbdd23d0f9 in Protocol::send_result_set_row (this=this@entry=0x146c8c001368, row_items=row_items@entry=0x146c8c013490) at /test/11.0_dbg/sql/protocol.cc:1332

#8  0x000055bbdd2bf6d1 in select_send::send_data (this=0x146c8c014310, items=@0x146c8c013490: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x146c8c0139e8, last = 0x146c8c0139e8, elements = 1}, <No data fields>}) at /test/11.0_dbg/sql/sql_class.cc:3102

#9  0x000055bbdd3aed15 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/11.0_dbg/sql/sql_class.h:5748

#10 JOIN::exec_inner (this=this@entry=0x146c8c014338) at /test/11.0_dbg/sql/sql_select.cc:4754

#11 0x000055bbdd3afbe0 in JOIN::exec (this=this@entry=0x146c8c014338) at /test/11.0_dbg/sql/sql_select.cc:4666

#12 0x000055bbdd3adb18 in mysql_select (thd=thd@entry=0x146c8c000d58, tables=0x0, fields=@0x146c8c013490: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x146c8c0139e8, last = 0x146c8c0139e8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x146c8c014310, unit=0x146c8c004fa0, select_lex=0x146c8c0131d8) at /test/11.0_dbg/sql/sql_select.cc:5146

#13 0x000055bbdd3ae28b in handle_select (thd=thd@entry=0x146c8c000d58, lex=lex@entry=0x146c8c004ec8, result=result@entry=0x146c8c014310, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.0_dbg/sql/sql_select.cc:608

#14 0x000055bbdd313e8d in execute_sqlcom_select (thd=thd@entry=0x146c8c000d58, all_tables=0x0) at /test/11.0_dbg/sql/sql_parse.cc:6267

#15 0x000055bbdd31f4af in mysql_execute_command (thd=thd@entry=0x146c8c000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.0_dbg/sql/sql_parse.cc:3949

#16 0x000055bbdd3267cf in mysql_parse (thd=thd@entry=0x146c8c000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x146dd41942c0) at /test/11.0_dbg/sql/sql_parse.cc:8002

#17 0x000055bbdd328963 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x146c8c000d58, packet=packet@entry=0x146c8c00ae19 "", packet_length=packet_length@entry=30, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_class.h:242

#18 0x000055bbdd32a7bc in do_command (thd=0x146c8c000d58, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_parse.cc:1407

#19 0x000055bbdd47b6e2 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55bbdfe80748, put_in_cache=put_in_cache@entry=true) at /test/11.0_dbg/sql/sql_connect.cc:1416

#20 0x000055bbdd47b941 in handle_one_connection (arg=0x55bbdfe80748) at /test/11.0_dbg/sql/sql_connect.cc:1318

#21 0x0000146e080d7b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#22 0x0000146e08169a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

==3991489==ERROR: AddressSanitizer: use-after-poison on address 0x62900008778a at pc 0x55ec51273387 bp 0x14d3366dee10 sp 0x14d3366de5b8

READ of size 102 at 0x62900008778a thread T22

    #0 0x55ec51273386 in __interceptor_memcpy (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x788f386)

    #1 0x55ec5275f084 in Binary_string::q_append(char const*, unsigned long) /test/11.0_opt_san/sql/sql_string.h:375

    #2 0x55ec5275f084 in append_simple /test/11.0_opt_san/sql/item_jsonfunc.cc:70

    #3 0x55ec52793c26 in Item_func_json_insert::val_str(String*) /test/11.0_opt_san/sql/item_jsonfunc.cc:3271

    #4 0x55ec5293cce6 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_opt_san/sql/sql_type.cc:7454

    #5 0x55ec514de13c in Protocol::send_result_set_row(List<Item>*) /test/11.0_opt_san/sql/protocol.cc:1332

    #6 0x55ec5185effa in select_send::send_data(List<Item>&) /test/11.0_opt_san/sql/sql_class.cc:3103

    #7 0x55ec51fa4515 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5720

    #8 0x55ec51fa4515 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5710

    #9 0x55ec51fa4515 in JOIN::exec_inner() /test/11.0_opt_san/sql/sql_select.cc:4688

    #10 0x55ec51fa8f23 in JOIN::exec() /test/11.0_opt_san/sql/sql_select.cc:4600

    #11 0x55ec51f96d8d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_opt_san/sql/sql_select.cc:5080

    #12 0x55ec51f9a8e0 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_opt_san/sql/sql_select.cc:581

    #13 0x55ec51b42f60 in execute_sqlcom_select /test/11.0_opt_san/sql/sql_parse.cc:6265

    #14 0x55ec51ba8827 in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:3949

    #15 0x55ec51bb9542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000

    #16 0x55ec51bc6fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894

    #17 0x55ec51bd0700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407

    #18 0x55ec524b103c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416

    #19 0x55ec524b363c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318

    #20 0x14d359871b42 in start_thread nptl/pthread_create.c:442

    #21 0x14d3599039ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

0x62900008778a is located 1418 bytes inside of 16400-byte region [0x629000087200,0x62900008b210)

allocated by thread T22 here:

    #0 0x55ec512ed837 in malloc (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x7909837)

    #1 0x55ec55660724 in my_malloc /test/11.0_opt_san/mysys/my_malloc.c:91

    #2 0x55ec5563b6ab in root_alloc /test/11.0_opt_san/mysys/my_alloc.c:66

    #3 0x55ec5563b6ab in reset_root_defaults /test/11.0_opt_san/mysys/my_alloc.c:243

    #4 0x55ec518255de in THD::init_for_queries() /test/11.0_opt_san/sql/sql_class.cc:1387

    #5 0x55ec524abb6e in prepare_new_connection_state(THD*) /test/11.0_opt_san/sql/sql_connect.cc:1245

    #6 0x55ec524ad457 in thd_prepare_connection(THD*) /test/11.0_opt_san/sql/sql_connect.cc:1339

    #7 0x55ec524ad457 in thd_prepare_connection(THD*) /test/11.0_opt_san/sql/sql_connect.cc:1328

    #8 0x55ec524b00d7 in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1406

    #9 0x55ec524b363c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318

    #10 0x14d359871b42 in start_thread nptl/pthread_create.c:442

Thread T22 created by T0 here:

    #0 0x55ec51291675 in pthread_create (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x78ad675)

    #1 0x55ec51345d3e in create_thread_to_handle_connection(CONNECT*) /test/11.0_opt_san/sql/mysqld.cc:6100

    #2 0x55ec5135804f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_opt_san/sql/mysqld.cc:6221

    #3 0x55ec51358fd7 in handle_connections_sockets() /test/11.0_opt_san/sql/mysqld.cc:6345

    #4 0x55ec5135c03d in mysqld_main(int, char**) /test/11.0_opt_san/sql/mysqld.cc:5995

    #5 0x14d359806d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x788f386) in __interceptor_memcpy

Shadow bytes around the buggy address:

  0x0c5280008ea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280008eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280008ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280008ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280008ee0: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 01

=>0x0c5280008ef0: f7[02]f7 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280008f00: 00 f7 04 f7 00 02 f7 00 00 00 f7 00 00 f7 05 f7

  0x0c5280008f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00

  0x0c5280008f20: 05 f7 00 00 03 f7 00 00 f7 02 f7 00 00 00 00 00

  0x0c5280008f30: 00 00 00 00 00 00 00 00 00 00 f7 04 f7 00 00 f7

  0x0c5280008f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==3991489==ABORTING

230304 15:11:41 [ERROR] mysqld got signal 6 ;