Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-31566

Fix buffer overrun in dynstr_append_json_quote

Details

    Description

      The server often crashes.
      Each time the top error frame is RtlFreeHeap(), with different stack list.
      The following are error stacks of version 10.4.30
      Yet other softwares in the same server are stable.

      1: exception 0xc0000005

      ntdll.dll!RtlFreeHeap()
      ucrtbase.DLL!_free_base()
      mysqld.exe!dict_mem_table_free()[dict0mem.cc:248]
      mysqld.exe!ibuf_rec_get_volume_func()[ibuf0ibuf.cc:1638]
      mysqld.exe!ibuf_get_merge_page_nos_func()[ibuf0ibuf.cc:2306]
      mysqld.exe!ibuf_merge_pages()[ibuf0ibuf.cc:2434]
      mysqld.exe!ibuf_merge_in_background()[ibuf0ibuf.cc:2630]
      mysqld.exe!srv_master_do_active_tasks()[srv0srv.cc:2115]
      mysqld.exe!srv_master_thread()[srv0srv.cc:2349]
      kernel32.dll!BaseThreadInitThunk()
      ntdll.dll!RtlUserThreadStart()
      

      2: exception 0xc0000005

      ntdll.dll!RtlFreeHeap()
      ucrtbase.DLL!_free_base()
      mysqld.exe!Item_func_dyncol_json::val_str()[item_strfunc.cc:4802]
      mysqld.exe!Item::save_str_in_field()[item.cc:6676]
      mysqld.exe!Item::save_in_field()[item.cc:6724]
      mysqld.exe!fill_record()[sql_base.cc:8932]
      mysqld.exe!select_unit::send_data()[sql_union.cc:130]
      mysqld.exe!end_send()[sql_select.cc:22057]
      mysqld.exe!evaluate_join_record()[sql_select.cc:21090]
      mysqld.exe!sub_select()[sql_select.cc:20901]
      mysqld.exe!do_select()[sql_select.cc:20386]
      mysqld.exe!JOIN::exec_inner()[sql_select.cc:4590]
      mysqld.exe!JOIN::exec()[sql_select.cc:4373]
      mysqld.exe!mysql_select()[sql_select.cc:4813]
      mysqld.exe!mysql_derived_fill()[sql_derived.cc:1258]
      mysqld.exe!mysql_handle_single_derived()[sql_derived.cc:200]
      mysqld.exe!st_join_table::preread_init()[sql_select.cc:13838]
      mysqld.exe!sub_select()[sql_select.cc:20826]
      mysqld.exe!do_select()[sql_select.cc:20386]
      mysqld.exe!JOIN::exec_inner()[sql_select.cc:4590]
      mysqld.exe!JOIN::exec()[sql_select.cc:4373]
      mysqld.exe!mysql_select()[sql_select.cc:4813]
      mysqld.exe!handle_select()[sql_select.cc:442]
      mysqld.exe!execute_sqlcom_select()[sql_parse.cc:6463]
      mysqld.exe!mysql_execute_command()[sql_parse.cc:3966]
      mysqld.exe!mysql_parse()[sql_parse.cc:8002]
      mysqld.exe!dispatch_command()[sql_parse.cc:1860]
      mysqld.exe!do_command()[sql_parse.cc:1378]
      mysqld.exe!threadpool_process_request()[threadpool_common.cc:373]
      mysqld.exe!tp_callback()[threadpool_common.cc:192]
      ntdll.dll!RtlDllShutdownInProgress()
      ntdll.dll!DbgUiRemoteBreakin()
      kernel32.dll!BaseThreadInitThunk()
      ntdll.dll!RtlUserThreadStart()
      

      3: exception 0xc0000005

      ntdll.dll!RtlFreeHeap()
      ucrtbase.DLL!_free_base()
      mysqld.exe!delete_dynamic()[array.c:305]
      mysqld.exe!my_hash_free()[hash.c:159]
      mysqld.exe!THD::cleanup()[sql_class.cc:1558]
      mysqld.exe!THD::change_user()[sql_class.cc:1412]
      mysqld.exe!dispatch_command()[sql_parse.cc:1709]
      mysqld.exe!do_command()[sql_parse.cc:1378]
      mysqld.exe!threadpool_process_request()[threadpool_common.cc:373]
      mysqld.exe!tp_callback()[threadpool_common.cc:192]
      ntdll.dll!RtlDllShutdownInProgress()
      ntdll.dll!DbgUiRemoteBreakin()
      kernel32.dll!BaseThreadInitThunk()
      ntdll.dll!RtlUserThreadStart()

      Attachments

        Activity

          Transition Time In Source Status Execution Times
          Sergei Golubchik made transition -
          Open Confirmed
          10d 8h 19m 1
          Daniel Black made transition -
          Confirmed In Review
          214d 16h 23m 1
          Oleksandr Byelkin made transition -
          In Review Stalled
          46d 11h 13m 1
          Sergei Golubchik made transition -
          Closed Stalled
          12h 1
          Daniel Black made transition -
          Stalled Closed
          45d 2h 33m 2

          People

            danblack Daniel Black
            hghua george he
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.