[MDEV-32758] Heap-Use-After-Free at /mariadb-11.3.0/strings/ctype-ascii.h:111 - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Server
Labels:
Environment:
Ubuntu 20.04

Description

Run these queries in debug build:

CREATE TABLE t0 ( c18 DOUBLE ( 219 , 15 ) ) ;

INSERT INTO t0 VALUES ( 8381074827123138459 ) , ( 1 ) ;

CREATE INDEX i0 ON t0 ( c18 ) ;

INSERT INTO t0 VALUES ( -13 ) , ( 116 ) ;

SELECT CASE -108 WHEN RAND ( ) = LOCATE ( t1 . c17 , 'J(W{$vSaYbyeLs)7cRzT2r<+e' , LTRIM ( t1 . c17 ) ) THEN 95 ELSE FIND_IN_SET ( -126 , '74"#;6q5o,r\\7Ty$35lq"_BY*zA:QhWoOcv.1%0+' ) END AS c20 FROM ( SELECT TRIM( TRAILING FROM t0 . c18 ) AS c17 FROM t0 ) AS t1 JOIN t0 ON t1 . c17 = t0 . c18 ;

Will trigger Heap-Use-After-Free. ASAN info:

=================================================================

==7103==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000035588 at pc 0x555559023cc7 bp 0x7fffd1629590 sp 0x7fffd1629580

READ of size 4 at 0x615000035588 thread T15

    #0 0x555559023cc6 in my_strcoll_ascii_4bytes_found /home/wx/mariadb-11.3.0/strings/ctype-ascii.h:111

    #1 0x5555590304f0 in my_strnncoll_utf8mb4_general_ci /home/wx/mariadb-11.3.0/strings/strcoll.inl:226

    #2 0x555558fb3337 in my_ci_strnncoll /home/wx/mariadb-11.3.0/include/m_ctype.h:1306

    #3 0x555558fb537e in my_instr_mb /home/wx/mariadb-11.3.0/strings/ctype-mb.c:455

    #4 0x555557ada6a0 in charset_info_st::instr(char const*, unsigned long, char const*, unsigned long, my_match_t*, unsigned int) const /home/wx/mariadb-11.3.0/include/m_ctype.h:1074

    #5 0x555557c8de20 in Item_func_locate::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3175

    #6 0x555557c705ed in Item_int_func::val_real() /home/wx/mariadb-11.3.0/sql/item_func.cc:753

    #7 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848

    #8 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #9 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #10 0x555557c32037 in cmp_item_int::cmp(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:1783

    #11 0x555557c33389 in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2083

    #12 0x555557c343a2 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2260

    #13 0x555557c033b4 in Item_func_case_simple::find_item() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3029

    #14 0x555557c03a7c in Item_func_case::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3067

    #15 0x5555578e48e5 in Item_func_hybrid_field_type::val_int_from_int_op() (/usr/local/mysql/bin/mariadbd+0x23908e5)

    #16 0x5555578b79d3 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5405

    #17 0x555557181390 in Item_func_hybrid_field_type::val_int() /home/wx/mariadb-11.3.0/sql/item_func.h:906

    #18 0x5555578c1c69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:7478

    #19 0x5555578de271 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.h:5691

    #20 0x555556e13fd7 in Item::send(Protocol*, st_value*) /home/wx/mariadb-11.3.0/sql/item.h:1235

    #21 0x555556ed630a in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332

    #22 0x55555707a9e1 in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124

    #23 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842

    #24 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710

    #25 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677

    #26 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444

    #27 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677

    #28 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481

    #29 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #30 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #31 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #32 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249

    #33 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628

    #34 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013

    #35 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912

    #36 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734

    #37 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893

    #38 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406

    #39 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445

    #40 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347

    #41 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201

    #42 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #43 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x615000035588 is located 136 bytes inside of 492-byte region [0x615000035500,0x6150000356ec)

freed by thread T15 here:

    #0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122

    #1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297

    #2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203

    #3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217

    #4 0x555556e1020b in Binary_string::free_buffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:308

    #5 0x555556e107ab in Binary_string::free() /home/wx/mariadb-11.3.0/sql/sql_string.h:769

    #6 0x555556e10607 in Binary_string::~Binary_string() /home/wx/mariadb-11.3.0/sql/sql_string.h:352

    #7 0x555556e10a2f in String::~String() /home/wx/mariadb-11.3.0/sql/sql_string.h:881

    #8 0x555557ae81c3 in StringBuffer<22ul>::~StringBuffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:1194

    #9 0x555557d0022e in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:164

    #10 0x555557c8dc45 in Item_func_locate::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3159

    #11 0x555557c705ed in Item_int_func::val_real() /home/wx/mariadb-11.3.0/sql/item_func.cc:753

    #12 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848

    #13 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #14 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #15 0x555557c32037 in cmp_item_int::cmp(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:1783

    #16 0x555557c33389 in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2083

    #17 0x555557c343a2 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2260

    #18 0x555557c033b4 in Item_func_case_simple::find_item() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3029

    #19 0x555557c03a7c in Item_func_case::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3067

    #20 0x5555578e48e5 in Item_func_hybrid_field_type::val_int_from_int_op() (/usr/local/mysql/bin/mariadbd+0x23908e5)

    #21 0x5555578b79d3 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5405

    #22 0x555557181390 in Item_func_hybrid_field_type::val_int() /home/wx/mariadb-11.3.0/sql/item_func.h:906

    #23 0x5555578c1c69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:7478

    #24 0x5555578de271 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.h:5691

    #25 0x555556e13fd7 in Item::send(Protocol*, st_value*) /home/wx/mariadb-11.3.0/sql/item.h:1235

    #26 0x555556ed630a in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332

    #27 0x55555707a9e1 in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124

    #28 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842

    #29 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710

previously allocated by thread T15 here:

    #0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126

    #2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89

    #3 0x555557480581 in Binary_string::real_alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:45

    #4 0x555556eddc40 in Binary_string::alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.h:792

    #5 0x555557a9c458 in Field_double::val_str(String*, String*) /home/wx/mariadb-11.3.0/sql/field.cc:5103

    #6 0x555557b89713 in Item_field::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:3328

    #7 0x555557d15e85 in Item_func_rtrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2397

    #8 0x555557bb55af in Item_direct_ref::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:8688

    #9 0x555557bd2b7b in Item_direct_view_ref::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.h:6148

    #10 0x555557d1549d in Item_func_ltrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2352

    #11 0x555557d001ed in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:165

    #12 0x555557c8dc45 in Item_func_locate::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3159

    #13 0x555557c705ed in Item_int_func::val_real() /home/wx/mariadb-11.3.0/sql/item_func.cc:753

    #14 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848

    #15 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #16 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #17 0x555557c32037 in cmp_item_int::cmp(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:1783

    #18 0x555557c33389 in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2083

    #19 0x555557c343a2 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2260

    #20 0x555557c033b4 in Item_func_case_simple::find_item() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3029

    #21 0x555557c03a7c in Item_func_case::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3067

    #22 0x5555578e48e5 in Item_func_hybrid_field_type::val_int_from_int_op() (/usr/local/mysql/bin/mariadbd+0x23908e5)

    #23 0x5555578b79d3 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5405

    #24 0x555557181390 in Item_func_hybrid_field_type::val_int() /home/wx/mariadb-11.3.0/sql/item_func.h:906

    #25 0x5555578c1c69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:7478

    #26 0x5555578de271 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.h:5691

    #27 0x555556e13fd7 in Item::send(Protocol*, st_value*) /home/wx/mariadb-11.3.0/sql/item.h:1235

    #28 0x555556ed630a in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332

    #29 0x55555707a9e1 in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124

Thread T15 created by T0 here:

    #0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52

    #2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252

    #3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139

    #4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150

    #5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212

    #6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274

    #7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398

    #8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045

    #9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34

    #10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/ctype-ascii.h:111 in my_strcoll_ascii_4bytes_found

Shadow bytes around the buggy address:

  0x0c2a7fffea60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a7fffea70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a7fffea80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa

  0x0c2a7fffea90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a7fffeaa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c2a7fffeab0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a7fffeac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a7fffead0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa

  0x0c2a7fffeae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a7fffeaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a7fffeb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==7103==ABORTING

Attachments

Issue Links

relates to

MDEV-32756 Heap-Use-After-Free at /mariadb-11.3.0/strings/strcoll.inl:137

Confirmed

Activity

People

Assignee:: Sergei Petrunia

Reporter:: Xin Wen

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2023-11-10 07:50

Updated:: 2025-04-03 04:21

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.