[MDEV-32756] Heap-Use-After-Free at /mariadb-11.3.0/strings/strcoll.inl:137 - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 11.3.0, 10.4(EOL), 10.5, 10.6, 10.11, 11.0(EOL), 11.2(EOL), 11.8
Fix Version/s: 10.6, 10.11, 11.4, 11.8
Component/s: Server
Labels:
- ASAN
- heap-use-after-free
Environment:
Ubuntu 20.04

Description

Run these queries in debug build:

CREATE TABLE t0 ( c48 DOUBLE ( 188 , 18 ) ) ;

INSERT INTO t0 VALUES ( -19 ) , ( -33 ) ;

CREATE INDEX i0 ON t0 ( c48 ) ;

INSERT INTO t0 VALUES ( -77 ) , ( 118 ) ;

SELECT t0 . c48 AS c35 FROM ( SELECT TRIM( LEADING FROM c48 ) AS c9 FROM t0 ) AS t1 JOIN t0 ON t0 . c48 = t1 . c9 IN ( SELECT CONV ( t1 . c9 = SPACE ( c9 ) = SPACE ( SQRT ( SPACE ( FLOOR ( 59 ) ) ) ) , TRIM( LEADING FROM RAND ( ) ) , MOD ( 98 , 28 ) ) AS c56 FROM t0 ) ;

Will trigger Heap-Use-After-Free.
ASAN info:

=================================================================

==6618==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000035088 at pc 0x55555902fc59 bp 0x7fffd1638b00 sp 0x7fffd1638af0

READ of size 1 at 0x615000035088 thread T15

    #0 0x55555902fc58 in my_scan_weight_utf8mb4_general_ci /home/wx/mariadb-11.3.0/strings/strcoll.inl:137

    #1 0x55555903098d in my_strnncollsp_utf8mb4_general_ci /home/wx/mariadb-11.3.0/strings/strcoll.inl:317

    #2 0x55555745c657 in charset_info_st::strnncollsp(char const*, unsigned long, char const*, unsigned long) const /home/wx/mariadb-11.3.0/include/m_ctype.h:1021

    #3 0x555557485f2d in sortcmp(Binary_string const*, Binary_string const*, charset_info_st const*) /home/wx/mariadb-11.3.0/sql/sql_string.cc:868

    #4 0x555557be9d2f in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:777

    #5 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #6 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #7 0x555557b6efea in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343

    #8 0x555556ea8f22 in Item_int_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_func.h:1167

    #9 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293

    #10 0x555557beaf4a in Arg_comparator::compare_decimal() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865

    #11 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #12 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #13 0x555557c706e3 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760

    #14 0x555557d2465d in Item_func_conv::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3882

    #15 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773

    #16 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #17 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #18 0x5555578b4b6d in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082

    #19 0x555556e147f5 in Item::val_bool() /home/wx/mariadb-11.3.0/sql/item.h:1701

    #20 0x555557c17d31 in Item_cond_or::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542

    #21 0x5555573b05fa in Item_func_trig_cond::val_int() (/usr/local/mysql/bin/mariadbd+0x1e5c5fa)

    #22 0x555557360f51 in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23545

    #23 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444

    #24 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #25 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #26 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #27 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159

    #28 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812

    #29 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994

    #30 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991

    #31 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797

    #32 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664

    #33 0x555557ba521e in Item::save_int_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6843

    #34 0x5555578b2241 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:4341

    #35 0x555557ba540a in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853

    #36 0x5555573b87a9 in store_key_item::copy_inner() /home/wx/mariadb-11.3.0/sql/sql_select.h:2142

    #37 0x5555573b7c68 in store_key::copy(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.h:2035

    #38 0x55555737ce68 in cp_buffer_from_ref(THD*, TABLE*, st_table_ref*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:27348

    #39 0x555557365816 in join_read_always_key /home/wx/mariadb-11.3.0/sql/sql_select.cc:24224

    #40 0x555557360005 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23441

    #41 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677

    #42 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444

    #43 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #44 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #45 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #46 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249

    #47 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628

    #48 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013

    #49 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912

    #50 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734

    #51 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893

    #52 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406

    #53 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445

    #54 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347

    #55 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201

    #56 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #57 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x615000035088 is located 136 bytes inside of 492-byte region [0x615000035000,0x6150000351ec)

freed by thread T15 here:

    #0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122

    #1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297

    #2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203

    #3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217

    #4 0x555556e1020b in Binary_string::free_buffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:308

    #5 0x555556e107ab in Binary_string::free() /home/wx/mariadb-11.3.0/sql/sql_string.h:769

    #6 0x555556e10607 in Binary_string::~Binary_string() /home/wx/mariadb-11.3.0/sql/sql_string.h:352

    #7 0x555556e10a2f in String::~String() /home/wx/mariadb-11.3.0/sql/sql_string.h:881

    #8 0x555557ae81c3 in StringBuffer<22ul>::~StringBuffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:1194

    #9 0x555557d0022e in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:164

    #10 0x555557bb53bc in Item_direct_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8680

    #11 0x555557bd2b3a in Item_direct_view_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.h:6141

    #12 0x555557d20f8e in Item_func_space::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3537

    #13 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773

    #14 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #15 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #16 0x555557b6efea in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343

    #17 0x555556ea8f22 in Item_int_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_func.h:1167

    #18 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293

    #19 0x555557beaf4a in Arg_comparator::compare_decimal() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865

    #20 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #21 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #22 0x555557c706e3 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760

    #23 0x555557d2465d in Item_func_conv::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3882

    #24 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773

    #25 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #26 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #27 0x5555578b4b6d in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082

    #28 0x555556e147f5 in Item::val_bool() /home/wx/mariadb-11.3.0/sql/item.h:1701

    #29 0x555557c17d31 in Item_cond_or::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542

previously allocated by thread T15 here:

    #0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126

    #2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89

    #3 0x555557480581 in Binary_string::real_alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:45

    #4 0x555556eddc40 in Binary_string::alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.h:792

    #5 0x555557a9c458 in Field_double::val_str(String*, String*) /home/wx/mariadb-11.3.0/sql/field.cc:5103

    #6 0x555557b89713 in Item_field::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:3328

    #7 0x555557d1549d in Item_func_ltrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2352

    #8 0x555557d001ed in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:165

    #9 0x555557bb53bc in Item_direct_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8680

    #10 0x555557bd2b3a in Item_direct_view_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.h:6141

    #11 0x555557d20f8e in Item_func_space::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3537

    #12 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773

    #13 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #14 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #15 0x555557b6efea in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343

    #16 0x555556ea8f22 in Item_int_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_func.h:1167

    #17 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293

    #18 0x555557beaf4a in Arg_comparator::compare_decimal() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865

    #19 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #20 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #21 0x555557c706e3 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760

    #22 0x555557d2465d in Item_func_conv::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3882

    #23 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773

    #24 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #25 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #26 0x5555578b4b6d in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082

    #27 0x555556e147f5 in Item::val_bool() /home/wx/mariadb-11.3.0/sql/item.h:1701

    #28 0x555557c17d31 in Item_cond_or::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542

    #29 0x5555573b05fa in Item_func_trig_cond::val_int() (/usr/local/mysql/bin/mariadbd+0x1e5c5fa)

Thread T15 created by T0 here:

    #0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52

    #2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252

    #3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139

    #4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150

    #5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212

    #6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274

    #7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398

    #8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045

    #9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34

    #10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/strcoll.inl:137 in my_scan_weight_utf8mb4_general_ci

Shadow bytes around the buggy address:

  0x0c2a7fffe9c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a7fffe9d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a7fffe9e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa

  0x0c2a7fffe9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a7fffea00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c2a7fffea10: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a7fffea20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a7fffea30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa

  0x0c2a7fffea40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a7fffea50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a7fffea60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==6618==ABORTING

Attachments

Issue Links

relates to

MDEV-32758 Heap-Use-After-Free at /mariadb-11.3.0/strings/ctype-ascii.h:111

Confirmed

Activity

Alice Sherepa added a comment - 2023-11-10 11:47 - edited

Thanks! I repeated on 10.4-11.2. probably the same bug as MDEV-32758

Version: '10.4.32-MariaDB-debug-log'  62d80652be7c19f4ad2bf68d6ffbb4e1eb1d77ea

=================================================================

==676277==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000424f0 at pc 0x5602bde3554d bp 0x7f548bd43640 sp 0x7f548bd43630

READ of size 1 at 0x6150000424f0 thread T27

    #0 0x5602bde3554c in my_strnncollsp_simple /10.4/src/strings/ctype-simple.c:203

    #1 0x5602bc3df807 in sortcmp(String const*, String const*, charset_info_st const*) /10.4/src/sql/sql_string.cc:808

    #2 0x5602bca33073 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:783

    #3 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #4 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #5 0x5602bcac4147 in Item_func::val_decimal(my_decimal*) /10.4/src/sql/item_func.cc:683

    #6 0x5602bc70b45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195

    #7 0x5602bca3426a in Arg_comparator::compare_decimal() /10.4/src/sql/item_cmpfunc.cc:871

    #8 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #9 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #10 0x5602bcac5291 in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772

    #11 0x5602bcb70e40 in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516

    #12 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #13 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #14 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #15 0x5602bc72592b in Type_handler_int_result::Item_val_bool(Item*) const /10.4/src/sql/sql_type.cc:4638

    #16 0x5602bbedb489 in Item::val_bool() /10.4/src/sql/item.h:1474

    #17 0x5602bca621e3 in Item_cond_or::val_int() /10.4/src/sql/item_cmpfunc.cc:5383

    #18 0x5602bc33a8ab in Item_func_trig_cond::val_int() /10.4/src/sql/item_cmpfunc.h:648

    #19 0x5602bc2eefab in evaluate_join_record /10.4/src/sql/sql_select.cc:21017

    #20 0x5602bc2ee2e5 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922

    #21 0x5602bc2ec08b in do_select /10.4/src/sql/sql_select.cc:20443

    #22 0x5602bc279bd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625

    #23 0x5602bc277203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407

    #24 0x5602bcbbf329 in subselect_single_select_engine::exec() /10.4/src/sql/item_subselect.cc:4032

    #25 0x5602bcb9a391 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758

    #26 0x5602bcb9b995 in Item_in_subselect::exec() /10.4/src/sql/item_subselect.cc:938

    #27 0x5602bcba6f70 in Item_in_subselect::val_bool() /10.4/src/sql/item_subselect.cc:1886

    #28 0x5602bbedb951 in Item::val_bool_result() /10.4/src/sql/item.h:1562

    #29 0x5602bca3d8f7 in Item_in_optimizer::val_int() /10.4/src/sql/item_cmpfunc.cc:1673

    #30 0x5602bcac512a in Item_int_func::val_real() /10.4/src/sql/item_func.cc:765

    #31 0x5602bca35330 in Arg_comparator::compare_real_fixed() /10.4/src/sql/item_cmpfunc.cc:920

    #32 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #33 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #34 0x5602bc4971ca in SQL_SELECT::skip_record(THD*) /10.4/src/sql/opt_range.h:1665

    #35 0x5602bc662ae2 in JOIN_CACHE::check_match(unsigned char*) /10.4/src/sql/sql_join_cache.cc:2577

    #36 0x5602bc655177 in JOIN_CACHE::generate_full_extensions(unsigned char*) /10.4/src/sql/sql_join_cache.cc:2520

    #37 0x5602bc654c40 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2420

    #38 0x5602bc652f9e in JOIN_CACHE::join_records(bool) /10.4/src/sql/sql_join_cache.cc:2173

    #39 0x5602bc2ed307 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20685

    #40 0x5602bc2eda91 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867

    #41 0x5602bc2ec191 in do_select /10.4/src/sql/sql_select.cc:20445

    #42 0x5602bc279bd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625

    #43 0x5602bc277203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407

    #44 0x5602bc27b3df in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846

    #45 0x5602bc24bc55 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442

    #46 0x5602bc1b2c5b in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475

    #47 0x5602bc1a03d2 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978

    #48 0x5602bc1bc1d6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014

    #49 0x5602bc192562 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857

    #50 0x5602bc18f08d in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378

    #51 0x5602bc5a367d in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419

    #52 0x5602bc5a2f21 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323

    #53 0x5602bd240baf in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869

    #54 0x7f54a2911608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477

    #55 0x7f54a24e2132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6150000424f0 is located 112 bytes inside of 468-byte region [0x615000042480,0x615000042654)

freed by thread T27 here:

    #0 0x7f54a2f0f40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122

    #1 0x5602bddc814a in free_memory /10.4/src/mysys/safemalloc.c:279

    #2 0x5602bddc7706 in sf_free /10.4/src/mysys/safemalloc.c:197

    #3 0x5602bdd962fe in my_free /10.4/src/mysys/my_malloc.c:222

    #4 0x5602bbeada25 in Binary_string::free() /10.4/src/sql/sql_string.h:711

    #5 0x5602bbead811 in Binary_string::~Binary_string() /10.4/src/sql/sql_string.h:515

    #6 0x5602bbeadc03 in String::~String() /10.4/src/sql/sql_string.h:829

    #7 0x5602bcb8c87f in StringBuffer<22ul>::~StringBuffer() /10.4/src/sql/sql_string.h:1172

    #8 0x5602bcb4e83c in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:158

    #9 0x5602bc9fc7e4 in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543

    #10 0x5602bca1b32e in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953

    #11 0x5602bcb6cef5 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172

    #12 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #13 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #14 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #15 0x5602bcac4147 in Item_func::val_decimal(my_decimal*) /10.4/src/sql/item_func.cc:683

    #16 0x5602bc70b45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195

    #17 0x5602bca3426a in Arg_comparator::compare_decimal() /10.4/src/sql/item_cmpfunc.cc:871

    #18 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #19 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #20 0x5602bcac5291 in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772

    #21 0x5602bcb70e40 in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516

    #22 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #23 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #24 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #25 0x5602bc72592b in Type_handler_int_result::Item_val_bool(Item*) const /10.4/src/sql/sql_type.cc:4638

    #26 0x5602bbedb489 in Item::val_bool() /10.4/src/sql/item.h:1474

    #27 0x5602bca621e3 in Item_cond_or::val_int() /10.4/src/sql/item_cmpfunc.cc:5383

    #28 0x5602bc33a8ab in Item_func_trig_cond::val_int() /10.4/src/sql/item_cmpfunc.h:648

    #29 0x5602bc2eefab in evaluate_join_record /10.4/src/sql/sql_select.cc:21017

previously allocated by thread T27 here:

    #0 0x7f54a2f0f808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x5602bddc70ba in sf_malloc /10.4/src/mysys/safemalloc.c:118

    #2 0x5602bdd95807 in my_malloc /10.4/src/mysys/my_malloc.c:101

    #3 0x5602bc3dac39 in Binary_string::real_alloc(unsigned long) /10.4/src/sql/sql_string.cc:44

    #4 0x5602bbed36b3 in Binary_string::alloc(unsigned long) /10.4/src/sql/sql_string.h:720

    #5 0x5602bc8eb53e in Field_double::val_str(String*, String*) /10.4/src/sql/field.cc:4936

    #6 0x5602bc9d059f in Item_field::val_str(String*) /10.4/src/sql/item.cc:3251

    #7 0x5602bcb5fd38 in Item_func_ltrim::val_str(String*) /10.4/src/sql/item_strfunc.cc:1971

    #8 0x5602bcb4e7fb in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:159

    #9 0x5602bc9fc7e4 in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543

    #10 0x5602bca1b32e in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953

    #11 0x5602bcb6cef5 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172

    #12 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #13 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #14 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #15 0x5602bcac4147 in Item_func::val_decimal(my_decimal*) /10.4/src/sql/item_func.cc:683

    #16 0x5602bc70b45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195

    #17 0x5602bca3426a in Arg_comparator::compare_decimal() /10.4/src/sql/item_cmpfunc.cc:871

    #18 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #19 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #20 0x5602bcac5291 in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772

    #21 0x5602bcb70e40 in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516

    #22 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #23 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #24 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #25 0x5602bc72592b in Type_handler_int_result::Item_val_bool(Item*) const /10.4/src/sql/sql_type.cc:4638

    #26 0x5602bbedb489 in Item::val_bool() /10.4/src/sql/item.h:1474

    #27 0x5602bca621e3 in Item_cond_or::val_int() /10.4/src/sql/item_cmpfunc.cc:5383

    #28 0x5602bc33a8ab in Item_func_trig_cond::val_int() /10.4/src/sql/item_cmpfunc.h:648

    #29 0x5602bc2eefab in evaluate_join_record /10.4/src/sql/sql_select.cc:21017

Thread T27 created by T0 here:

    #0 0x7f54a2e3c815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x5602bd240fa0 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919

    #2 0x5602bbe87f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275

    #3 0x5602bbea0161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296

    #4 0x5602bbea08fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366

    #5 0x5602bbea0de2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464

    #6 0x5602bbea1c9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622

    #7 0x5602bbe9f866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954

    #8 0x5602bbe85f3c in main /10.4/src/sql/main.cc:25

    #9 0x7f54a23e7082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/ctype-simple.c:203 in my_strnncollsp_simple

Shadow bytes around the buggy address:

  0x0c2a80000440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a80000450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a80000460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a80000470: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa

  0x0c2a80000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c2a80000490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c2a800004a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a800004b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a800004c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa

  0x0c2a800004d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a800004e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==676277==ABORTING

----------SERVER LOG END-------------

CREATE TABLE t0 (a DOUBLE);

INSERT INTO t0 VALUES (1), (2), (3);

SELECT  CONV ( b = SPACE ( b ) , 4,4) FROM ( SELECT TRIM( LEADING FROM a ) AS b FROM t0 ) t1;

==1464764==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000604f0 at pc 0x565319987feb bp 0x7f42a30c66f0 sp 0x7f42a30c66e0

READ of size 1 at 0x6150000604f0 thread T31

    #0 0x565319987fea in my_strnncollsp_simple /10.4/src/strings/ctype-simple.c:182

    #1 0x565317f30d63 in sortcmp(String const*, String const*, charset_info_st const*) /10.4/src/sql/sql_string.cc:808

    #2 0x565318584a29 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:783

    #3 0x5653185c935b in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #4 0x565318591138 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #5 0x565318616c3d in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772

    #6 0x5653186c27ec in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516

    #7 0x565318284127 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7104

    #8 0x56531829eb21 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.h:4979

    #9 0x565317a2bd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045

    #10 0x565317a1d25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033

    #11 0x565317bd055e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130

    #12 0x565317e48b5e in end_send /10.4/src/sql/sql_select.cc:22118

    #13 0x565317e40f0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149

    #14 0x565317e3f841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922

    #15 0x565317e3d5e7 in do_select /10.4/src/sql/sql_select.cc:20443

    #16 0x565317dcb12f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625

    #17 0x565317dc875f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407

    #18 0x565317dcc93b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846

    #19 0x565317d9d1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442

    #20 0x565317d041ad in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475

    #21 0x565317cf1924 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978

    #22 0x565317d0d728 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014

    #23 0x565317ce3ab4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857

    #24 0x565317ce05df in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378

    #25 0x5653180f5031 in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419

    #26 0x5653180f48d5 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323

    #27 0x565318d92747 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869

    #28 0x7f42bd9fd608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477

    #29 0x7f42bd5ce132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6150000604f0 is located 112 bytes inside of 468-byte region [0x615000060480,0x615000060654)

freed by thread T31 here:

    #0 0x7f42bdffb40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122

    #1 0x56531991ae6d in free_memory /10.4/src/mysys/safemalloc.c:279

    #2 0x56531991a429 in sf_free /10.4/src/mysys/safemalloc.c:197

    #3 0x5653198e9021 in my_free /10.4/src/mysys/my_malloc.c:222

    #4 0x5653179fea25 in Binary_string::free() /10.4/src/sql/sql_string.h:711

    #5 0x5653179fe811 in Binary_string::~Binary_string() /10.4/src/sql/sql_string.h:515

    #6 0x5653179fec03 in String::~String() /10.4/src/sql/sql_string.h:829

    #7 0x5653186de22b in StringBuffer<22ul>::~StringBuffer() /10.4/src/sql/sql_string.h:1172

    #8 0x5653186a01e8 in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:158

    #9 0x56531854e19a in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543

    #10 0x56531856cce4 in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953

    #11 0x5653186be8a1 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172

    #12 0x56531858494e in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #13 0x5653185c935b in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #14 0x565318591138 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #15 0x565318616c3d in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772

    #16 0x5653186c27ec in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516

    #17 0x565318284127 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7104

    #18 0x56531829eb21 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.h:4979

    #19 0x565317a2bd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045

    #20 0x565317a1d25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033

    #21 0x565317bd055e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130

    #22 0x565317e48b5e in end_send /10.4/src/sql/sql_select.cc:22118

    #23 0x565317e40f0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149

    #24 0x565317e3f841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922

    #25 0x565317e3d5e7 in do_select /10.4/src/sql/sql_select.cc:20443

    #26 0x565317dcb12f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625

    #27 0x565317dc875f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407

    #28 0x565317dcc93b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846

    #29 0x565317d9d1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442

previously allocated by thread T31 here:

    #0 0x7f42bdffb808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x565319919ddd in sf_malloc /10.4/src/mysys/safemalloc.c:118

    #2 0x5653198e852a in my_malloc /10.4/src/mysys/my_malloc.c:101

    #3 0x565317f2c195 in Binary_string::real_alloc(unsigned long) /10.4/src/sql/sql_string.cc:44

    #4 0x565317a246b3 in Binary_string::alloc(unsigned long) /10.4/src/sql/sql_string.h:720

    #5 0x56531843cef4 in Field_double::val_str(String*, String*) /10.4/src/sql/field.cc:4936

    #6 0x565318521f55 in Item_field::val_str(String*) /10.4/src/sql/item.cc:3251

    #7 0x5653186b16e4 in Item_func_ltrim::val_str(String*) /10.4/src/sql/item_strfunc.cc:1971

    #8 0x5653186a01a7 in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:159

    #9 0x56531854e19a in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543

    #10 0x56531856cce4 in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953

    #11 0x5653186be8a1 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172

    #12 0x56531858494e in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779

    #13 0x5653185c935b in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104

    #14 0x565318591138 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790

    #15 0x565318616c3d in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772

    #16 0x5653186c27ec in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516

    #17 0x565318284127 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7104

    #18 0x56531829eb21 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.h:4979

    #19 0x565317a2bd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045

    #20 0x565317a1d25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033

    #21 0x565317bd055e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130

    #22 0x565317e48b5e in end_send /10.4/src/sql/sql_select.cc:22118

    #23 0x565317e40f0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149

    #24 0x565317e3f841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922

    #25 0x565317e3d5e7 in do_select /10.4/src/sql/sql_select.cc:20443

    #26 0x565317dcb12f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625

    #27 0x565317dc875f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407

    #28 0x565317dcc93b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846

    #29 0x565317d9d1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442

Thread T31 created by T0 here:

    #0 0x7f42bdf28815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x565318d92b38 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919

    #2 0x5653179d8f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275

    #3 0x5653179f1161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296

    #4 0x5653179f18fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366

    #5 0x5653179f1de2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464

    #6 0x5653179f2c9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622

    #7 0x5653179f0866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954

    #8 0x5653179d6f3c in main /10.4/src/sql/main.cc:25

    #9 0x7f42bd4d3082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/ctype-simple.c:182 in my_strnncollsp_simple

Shadow bytes around the buggy address:

  0x0c2a80004040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a80004050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a80004060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2a80004070: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa

  0x0c2a80004080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c2a80004090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c2a800040a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a800040b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a800040c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa

  0x0c2a800040d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a800040e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==1464764==ABORTING

----------SERVER LOG END-------------

Alice Sherepa added a comment - 2023-11-10 11:47 - edited Thanks! I repeated on 10.4-11.2. probably the same bug as MDEV-32758 Version: '10.4.32-MariaDB-debug-log' 62d80652be7c19f4ad2bf68d6ffbb4e1eb1d77ea ================================================================= ==676277==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000424f0 at pc 0x5602bde3554d bp 0x7f548bd43640 sp 0x7f548bd43630 READ of size 1 at 0x6150000424f0 thread T27 #0 0x5602bde3554c in my_strnncollsp_simple /10.4/src/strings/ctype-simple.c:203 #1 0x5602bc3df807 in sortcmp(String const*, String const*, charset_info_st const*) /10.4/src/sql/sql_string.cc:808 #2 0x5602bca33073 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:783 #3 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #4 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #5 0x5602bcac4147 in Item_func::val_decimal(my_decimal*) /10.4/src/sql/item_func.cc:683 #6 0x5602bc70b45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195 #7 0x5602bca3426a in Arg_comparator::compare_decimal() /10.4/src/sql/item_cmpfunc.cc:871 #8 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #9 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #10 0x5602bcac5291 in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772 #11 0x5602bcb70e40 in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516 #12 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #13 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #14 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #15 0x5602bc72592b in Type_handler_int_result::Item_val_bool(Item*) const /10.4/src/sql/sql_type.cc:4638 #16 0x5602bbedb489 in Item::val_bool() /10.4/src/sql/item.h:1474 #17 0x5602bca621e3 in Item_cond_or::val_int() /10.4/src/sql/item_cmpfunc.cc:5383 #18 0x5602bc33a8ab in Item_func_trig_cond::val_int() /10.4/src/sql/item_cmpfunc.h:648 #19 0x5602bc2eefab in evaluate_join_record /10.4/src/sql/sql_select.cc:21017 #20 0x5602bc2ee2e5 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922 #21 0x5602bc2ec08b in do_select /10.4/src/sql/sql_select.cc:20443 #22 0x5602bc279bd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625 #23 0x5602bc277203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407 #24 0x5602bcbbf329 in subselect_single_select_engine::exec() /10.4/src/sql/item_subselect.cc:4032 #25 0x5602bcb9a391 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758 #26 0x5602bcb9b995 in Item_in_subselect::exec() /10.4/src/sql/item_subselect.cc:938 #27 0x5602bcba6f70 in Item_in_subselect::val_bool() /10.4/src/sql/item_subselect.cc:1886 #28 0x5602bbedb951 in Item::val_bool_result() /10.4/src/sql/item.h:1562 #29 0x5602bca3d8f7 in Item_in_optimizer::val_int() /10.4/src/sql/item_cmpfunc.cc:1673 #30 0x5602bcac512a in Item_int_func::val_real() /10.4/src/sql/item_func.cc:765 #31 0x5602bca35330 in Arg_comparator::compare_real_fixed() /10.4/src/sql/item_cmpfunc.cc:920 #32 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #33 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #34 0x5602bc4971ca in SQL_SELECT::skip_record(THD*) /10.4/src/sql/opt_range.h:1665 #35 0x5602bc662ae2 in JOIN_CACHE::check_match(unsigned char*) /10.4/src/sql/sql_join_cache.cc:2577 #36 0x5602bc655177 in JOIN_CACHE::generate_full_extensions(unsigned char*) /10.4/src/sql/sql_join_cache.cc:2520 #37 0x5602bc654c40 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2420 #38 0x5602bc652f9e in JOIN_CACHE::join_records(bool) /10.4/src/sql/sql_join_cache.cc:2173 #39 0x5602bc2ed307 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20685 #40 0x5602bc2eda91 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867 #41 0x5602bc2ec191 in do_select /10.4/src/sql/sql_select.cc:20445 #42 0x5602bc279bd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625 #43 0x5602bc277203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407 #44 0x5602bc27b3df in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846 #45 0x5602bc24bc55 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442 #46 0x5602bc1b2c5b in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475 #47 0x5602bc1a03d2 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978 #48 0x5602bc1bc1d6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014 #49 0x5602bc192562 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857 #50 0x5602bc18f08d in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378 #51 0x5602bc5a367d in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419 #52 0x5602bc5a2f21 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323 #53 0x5602bd240baf in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869 #54 0x7f54a2911608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477 #55 0x7f54a24e2132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) 0x6150000424f0 is located 112 bytes inside of 468-byte region [0x615000042480,0x615000042654) freed by thread T27 here: #0 0x7f54a2f0f40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x5602bddc814a in free_memory /10.4/src/mysys/safemalloc.c:279 #2 0x5602bddc7706 in sf_free /10.4/src/mysys/safemalloc.c:197 #3 0x5602bdd962fe in my_free /10.4/src/mysys/my_malloc.c:222 #4 0x5602bbeada25 in Binary_string::free() /10.4/src/sql/sql_string.h:711 #5 0x5602bbead811 in Binary_string::~Binary_string() /10.4/src/sql/sql_string.h:515 #6 0x5602bbeadc03 in String::~String() /10.4/src/sql/sql_string.h:829 #7 0x5602bcb8c87f in StringBuffer<22ul>::~StringBuffer() /10.4/src/sql/sql_string.h:1172 #8 0x5602bcb4e83c in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:158 #9 0x5602bc9fc7e4 in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543 #10 0x5602bca1b32e in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953 #11 0x5602bcb6cef5 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172 #12 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #13 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #14 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #15 0x5602bcac4147 in Item_func::val_decimal(my_decimal*) /10.4/src/sql/item_func.cc:683 #16 0x5602bc70b45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195 #17 0x5602bca3426a in Arg_comparator::compare_decimal() /10.4/src/sql/item_cmpfunc.cc:871 #18 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #19 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #20 0x5602bcac5291 in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772 #21 0x5602bcb70e40 in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516 #22 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #23 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #24 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #25 0x5602bc72592b in Type_handler_int_result::Item_val_bool(Item*) const /10.4/src/sql/sql_type.cc:4638 #26 0x5602bbedb489 in Item::val_bool() /10.4/src/sql/item.h:1474 #27 0x5602bca621e3 in Item_cond_or::val_int() /10.4/src/sql/item_cmpfunc.cc:5383 #28 0x5602bc33a8ab in Item_func_trig_cond::val_int() /10.4/src/sql/item_cmpfunc.h:648 #29 0x5602bc2eefab in evaluate_join_record /10.4/src/sql/sql_select.cc:21017 previously allocated by thread T27 here: #0 0x7f54a2f0f808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x5602bddc70ba in sf_malloc /10.4/src/mysys/safemalloc.c:118 #2 0x5602bdd95807 in my_malloc /10.4/src/mysys/my_malloc.c:101 #3 0x5602bc3dac39 in Binary_string::real_alloc(unsigned long) /10.4/src/sql/sql_string.cc:44 #4 0x5602bbed36b3 in Binary_string::alloc(unsigned long) /10.4/src/sql/sql_string.h:720 #5 0x5602bc8eb53e in Field_double::val_str(String*, String*) /10.4/src/sql/field.cc:4936 #6 0x5602bc9d059f in Item_field::val_str(String*) /10.4/src/sql/item.cc:3251 #7 0x5602bcb5fd38 in Item_func_ltrim::val_str(String*) /10.4/src/sql/item_strfunc.cc:1971 #8 0x5602bcb4e7fb in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:159 #9 0x5602bc9fc7e4 in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543 #10 0x5602bca1b32e in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953 #11 0x5602bcb6cef5 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172 #12 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #13 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #14 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #15 0x5602bcac4147 in Item_func::val_decimal(my_decimal*) /10.4/src/sql/item_func.cc:683 #16 0x5602bc70b45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195 #17 0x5602bca3426a in Arg_comparator::compare_decimal() /10.4/src/sql/item_cmpfunc.cc:871 #18 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #19 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #20 0x5602bcac5291 in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772 #21 0x5602bcb70e40 in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516 #22 0x5602bca32f98 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #23 0x5602bca779a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #24 0x5602bca3f782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #25 0x5602bc72592b in Type_handler_int_result::Item_val_bool(Item*) const /10.4/src/sql/sql_type.cc:4638 #26 0x5602bbedb489 in Item::val_bool() /10.4/src/sql/item.h:1474 #27 0x5602bca621e3 in Item_cond_or::val_int() /10.4/src/sql/item_cmpfunc.cc:5383 #28 0x5602bc33a8ab in Item_func_trig_cond::val_int() /10.4/src/sql/item_cmpfunc.h:648 #29 0x5602bc2eefab in evaluate_join_record /10.4/src/sql/sql_select.cc:21017 Thread T27 created by T0 here: #0 0x7f54a2e3c815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x5602bd240fa0 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919 #2 0x5602bbe87f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275 #3 0x5602bbea0161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296 #4 0x5602bbea08fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366 #5 0x5602bbea0de2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464 #6 0x5602bbea1c9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622 #7 0x5602bbe9f866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954 #8 0x5602bbe85f3c in main /10.4/src/sql/main.cc:25 #9 0x7f54a23e7082 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/ctype-simple.c:203 in my_strnncollsp_simple Shadow bytes around the buggy address: 0x0c2a80000440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a80000450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a80000460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a80000470: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa 0x0c2a80000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2a80000490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c2a800004a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a800004b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a800004c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c2a800004d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a800004e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==676277==ABORTING ----------SERVER LOG END------------- CREATE TABLE t0 (a DOUBLE ); INSERT INTO t0 VALUES (1), (2), (3); SELECT CONV ( b = SPACE ( b ) , 4,4) FROM ( SELECT TRIM( LEADING FROM a ) AS b FROM t0 ) t1; ==1464764==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000604f0 at pc 0x565319987feb bp 0x7f42a30c66f0 sp 0x7f42a30c66e0 READ of size 1 at 0x6150000604f0 thread T31 #0 0x565319987fea in my_strnncollsp_simple /10.4/src/strings/ctype-simple.c:182 #1 0x565317f30d63 in sortcmp(String const*, String const*, charset_info_st const*) /10.4/src/sql/sql_string.cc:808 #2 0x565318584a29 in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:783 #3 0x5653185c935b in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #4 0x565318591138 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #5 0x565318616c3d in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772 #6 0x5653186c27ec in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516 #7 0x565318284127 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7104 #8 0x56531829eb21 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.h:4979 #9 0x565317a2bd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045 #10 0x565317a1d25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033 #11 0x565317bd055e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130 #12 0x565317e48b5e in end_send /10.4/src/sql/sql_select.cc:22118 #13 0x565317e40f0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149 #14 0x565317e3f841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922 #15 0x565317e3d5e7 in do_select /10.4/src/sql/sql_select.cc:20443 #16 0x565317dcb12f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625 #17 0x565317dc875f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407 #18 0x565317dcc93b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846 #19 0x565317d9d1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442 #20 0x565317d041ad in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475 #21 0x565317cf1924 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978 #22 0x565317d0d728 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014 #23 0x565317ce3ab4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857 #24 0x565317ce05df in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378 #25 0x5653180f5031 in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419 #26 0x5653180f48d5 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323 #27 0x565318d92747 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869 #28 0x7f42bd9fd608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477 #29 0x7f42bd5ce132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) 0x6150000604f0 is located 112 bytes inside of 468-byte region [0x615000060480,0x615000060654) freed by thread T31 here: #0 0x7f42bdffb40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x56531991ae6d in free_memory /10.4/src/mysys/safemalloc.c:279 #2 0x56531991a429 in sf_free /10.4/src/mysys/safemalloc.c:197 #3 0x5653198e9021 in my_free /10.4/src/mysys/my_malloc.c:222 #4 0x5653179fea25 in Binary_string::free() /10.4/src/sql/sql_string.h:711 #5 0x5653179fe811 in Binary_string::~Binary_string() /10.4/src/sql/sql_string.h:515 #6 0x5653179fec03 in String::~String() /10.4/src/sql/sql_string.h:829 #7 0x5653186de22b in StringBuffer<22ul>::~StringBuffer() /10.4/src/sql/sql_string.h:1172 #8 0x5653186a01e8 in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:158 #9 0x56531854e19a in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543 #10 0x56531856cce4 in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953 #11 0x5653186be8a1 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172 #12 0x56531858494e in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #13 0x5653185c935b in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #14 0x565318591138 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #15 0x565318616c3d in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772 #16 0x5653186c27ec in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516 #17 0x565318284127 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7104 #18 0x56531829eb21 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.h:4979 #19 0x565317a2bd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045 #20 0x565317a1d25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033 #21 0x565317bd055e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130 #22 0x565317e48b5e in end_send /10.4/src/sql/sql_select.cc:22118 #23 0x565317e40f0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149 #24 0x565317e3f841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922 #25 0x565317e3d5e7 in do_select /10.4/src/sql/sql_select.cc:20443 #26 0x565317dcb12f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625 #27 0x565317dc875f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407 #28 0x565317dcc93b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846 #29 0x565317d9d1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442 previously allocated by thread T31 here: #0 0x7f42bdffb808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x565319919ddd in sf_malloc /10.4/src/mysys/safemalloc.c:118 #2 0x5653198e852a in my_malloc /10.4/src/mysys/my_malloc.c:101 #3 0x565317f2c195 in Binary_string::real_alloc(unsigned long) /10.4/src/sql/sql_string.cc:44 #4 0x565317a246b3 in Binary_string::alloc(unsigned long) /10.4/src/sql/sql_string.h:720 #5 0x56531843cef4 in Field_double::val_str(String*, String*) /10.4/src/sql/field.cc:4936 #6 0x565318521f55 in Item_field::val_str(String*) /10.4/src/sql/item.cc:3251 #7 0x5653186b16e4 in Item_func_ltrim::val_str(String*) /10.4/src/sql/item_strfunc.cc:1971 #8 0x5653186a01a7 in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:159 #9 0x56531854e19a in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543 #10 0x56531856cce4 in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953 #11 0x5653186be8a1 in Item_func_space::val_str(String*) /10.4/src/sql/item_strfunc.cc:3172 #12 0x56531858494e in Arg_comparator::compare_string() /10.4/src/sql/item_cmpfunc.cc:779 #13 0x5653185c935b in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104 #14 0x565318591138 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790 #15 0x565318616c3d in Item_int_func::val_str(String*) /10.4/src/sql/item_func.cc:772 #16 0x5653186c27ec in Item_func_conv::val_str(String*) /10.4/src/sql/item_strfunc.cc:3516 #17 0x565318284127 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7104 #18 0x56531829eb21 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.h:4979 #19 0x565317a2bd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045 #20 0x565317a1d25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033 #21 0x565317bd055e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130 #22 0x565317e48b5e in end_send /10.4/src/sql/sql_select.cc:22118 #23 0x565317e40f0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149 #24 0x565317e3f841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922 #25 0x565317e3d5e7 in do_select /10.4/src/sql/sql_select.cc:20443 #26 0x565317dcb12f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625 #27 0x565317dc875f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407 #28 0x565317dcc93b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846 #29 0x565317d9d1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442 Thread T31 created by T0 here: #0 0x7f42bdf28815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x565318d92b38 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919 #2 0x5653179d8f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275 #3 0x5653179f1161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296 #4 0x5653179f18fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366 #5 0x5653179f1de2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464 #6 0x5653179f2c9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622 #7 0x5653179f0866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954 #8 0x5653179d6f3c in main /10.4/src/sql/main.cc:25 #9 0x7f42bd4d3082 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/ctype-simple.c:182 in my_strnncollsp_simple Shadow bytes around the buggy address: 0x0c2a80004040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a80004050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a80004060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a80004070: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa 0x0c2a80004080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2a80004090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c2a800040a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a800040b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a800040c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c2a800040d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a800040e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1464764==ABORTING ----------SERVER LOG END-------------

People

Assignee:: Sergei Petrunia

Reporter:: Xin Wen

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2023-11-10 07:45

Updated:: 2 days ago 03:41

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server