Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
-
Ubuntu 20.04
Description
Run these queries in debug build:
CREATE TABLE t0 ( c18 DOUBLE ( 219 , 15 ) ) ; |
INSERT INTO t0 VALUES ( 8381074827123138459 ) , ( 1 ) ; |
CREATE INDEX i0 ON t0 ( c18 ) ; |
INSERT INTO t0 VALUES ( -13 ) , ( 116 ) ; |
SELECT CASE -108 WHEN RAND ( ) = LOCATE ( t1 . c17 , 'J(W{$vSaYbyeLs)7cRzT2r<+e' , LTRIM ( t1 . c17 ) ) THEN 95 ELSE FIND_IN_SET ( -126 , '74"#;6q5o,r\\7Ty$35lq"_BY*zA:QhWoOcv.1%0+' ) END AS c20 FROM ( SELECT TRIM( TRAILING FROM t0 . c18 ) AS c17 FROM t0 ) AS t1 JOIN t0 ON t1 . c17 = t0 . c18 ; |
Will trigger Heap-Use-After-Free. ASAN info:
=================================================================
|
==7103==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000035588 at pc 0x555559023cc7 bp 0x7fffd1629590 sp 0x7fffd1629580
|
READ of size 4 at 0x615000035588 thread T15
|
#0 0x555559023cc6 in my_strcoll_ascii_4bytes_found /home/wx/mariadb-11.3.0/strings/ctype-ascii.h:111
|
#1 0x5555590304f0 in my_strnncoll_utf8mb4_general_ci /home/wx/mariadb-11.3.0/strings/strcoll.inl:226
|
#2 0x555558fb3337 in my_ci_strnncoll /home/wx/mariadb-11.3.0/include/m_ctype.h:1306
|
#3 0x555558fb537e in my_instr_mb /home/wx/mariadb-11.3.0/strings/ctype-mb.c:455
|
#4 0x555557ada6a0 in charset_info_st::instr(char const*, unsigned long, char const*, unsigned long, my_match_t*, unsigned int) const /home/wx/mariadb-11.3.0/include/m_ctype.h:1074
|
#5 0x555557c8de20 in Item_func_locate::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3175
|
#6 0x555557c705ed in Item_int_func::val_real() /home/wx/mariadb-11.3.0/sql/item_func.cc:753
|
#7 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
|
#8 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
|
#9 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
|
#10 0x555557c32037 in cmp_item_int::cmp(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:1783
|
#11 0x555557c33389 in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2083
|
#12 0x555557c343a2 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2260
|
#13 0x555557c033b4 in Item_func_case_simple::find_item() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3029
|
#14 0x555557c03a7c in Item_func_case::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3067
|
#15 0x5555578e48e5 in Item_func_hybrid_field_type::val_int_from_int_op() (/usr/local/mysql/bin/mariadbd+0x23908e5)
|
#16 0x5555578b79d3 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5405
|
#17 0x555557181390 in Item_func_hybrid_field_type::val_int() /home/wx/mariadb-11.3.0/sql/item_func.h:906
|
#18 0x5555578c1c69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:7478
|
#19 0x5555578de271 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.h:5691
|
#20 0x555556e13fd7 in Item::send(Protocol*, st_value*) /home/wx/mariadb-11.3.0/sql/item.h:1235
|
#21 0x555556ed630a in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332
|
#22 0x55555707a9e1 in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124
|
#23 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
|
#24 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
|
#25 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
|
#26 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
|
#27 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
|
#28 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
|
#29 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
|
#30 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
#31 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
|
#32 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
|
#33 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
|
#34 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
|
#35 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
|
#36 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
|
#37 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
|
#38 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
|
#39 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
|
#40 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
|
#41 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
|
#42 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
|
#43 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
|
|
|
0x615000035588 is located 136 bytes inside of 492-byte region [0x615000035500,0x6150000356ec)
|
freed by thread T15 here:
|
#0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
|
#1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297
|
#2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203
|
#3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217
|
#4 0x555556e1020b in Binary_string::free_buffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:308
|
#5 0x555556e107ab in Binary_string::free() /home/wx/mariadb-11.3.0/sql/sql_string.h:769
|
#6 0x555556e10607 in Binary_string::~Binary_string() /home/wx/mariadb-11.3.0/sql/sql_string.h:352
|
#7 0x555556e10a2f in String::~String() /home/wx/mariadb-11.3.0/sql/sql_string.h:881
|
#8 0x555557ae81c3 in StringBuffer<22ul>::~StringBuffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:1194
|
#9 0x555557d0022e in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:164
|
#10 0x555557c8dc45 in Item_func_locate::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3159
|
#11 0x555557c705ed in Item_int_func::val_real() /home/wx/mariadb-11.3.0/sql/item_func.cc:753
|
#12 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
|
#13 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
|
#14 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
|
#15 0x555557c32037 in cmp_item_int::cmp(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:1783
|
#16 0x555557c33389 in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2083
|
#17 0x555557c343a2 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2260
|
#18 0x555557c033b4 in Item_func_case_simple::find_item() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3029
|
#19 0x555557c03a7c in Item_func_case::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3067
|
#20 0x5555578e48e5 in Item_func_hybrid_field_type::val_int_from_int_op() (/usr/local/mysql/bin/mariadbd+0x23908e5)
|
#21 0x5555578b79d3 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5405
|
#22 0x555557181390 in Item_func_hybrid_field_type::val_int() /home/wx/mariadb-11.3.0/sql/item_func.h:906
|
#23 0x5555578c1c69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:7478
|
#24 0x5555578de271 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.h:5691
|
#25 0x555556e13fd7 in Item::send(Protocol*, st_value*) /home/wx/mariadb-11.3.0/sql/item.h:1235
|
#26 0x555556ed630a in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332
|
#27 0x55555707a9e1 in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124
|
#28 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
|
#29 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
|
|
|
previously allocated by thread T15 here:
|
#0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
|
#1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126
|
#2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89
|
#3 0x555557480581 in Binary_string::real_alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:45
|
#4 0x555556eddc40 in Binary_string::alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.h:792
|
#5 0x555557a9c458 in Field_double::val_str(String*, String*) /home/wx/mariadb-11.3.0/sql/field.cc:5103
|
#6 0x555557b89713 in Item_field::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:3328
|
#7 0x555557d15e85 in Item_func_rtrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2397
|
#8 0x555557bb55af in Item_direct_ref::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:8688
|
#9 0x555557bd2b7b in Item_direct_view_ref::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.h:6148
|
#10 0x555557d1549d in Item_func_ltrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2352
|
#11 0x555557d001ed in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:165
|
#12 0x555557c8dc45 in Item_func_locate::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3159
|
#13 0x555557c705ed in Item_int_func::val_real() /home/wx/mariadb-11.3.0/sql/item_func.cc:753
|
#14 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
|
#15 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
|
#16 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
|
#17 0x555557c32037 in cmp_item_int::cmp(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:1783
|
#18 0x555557c33389 in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2083
|
#19 0x555557c343a2 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:2260
|
#20 0x555557c033b4 in Item_func_case_simple::find_item() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3029
|
#21 0x555557c03a7c in Item_func_case::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3067
|
#22 0x5555578e48e5 in Item_func_hybrid_field_type::val_int_from_int_op() (/usr/local/mysql/bin/mariadbd+0x23908e5)
|
#23 0x5555578b79d3 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5405
|
#24 0x555557181390 in Item_func_hybrid_field_type::val_int() /home/wx/mariadb-11.3.0/sql/item_func.h:906
|
#25 0x5555578c1c69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:7478
|
#26 0x5555578de271 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const /home/wx/mariadb-11.3.0/sql/sql_type.h:5691
|
#27 0x555556e13fd7 in Item::send(Protocol*, st_value*) /home/wx/mariadb-11.3.0/sql/item.h:1235
|
#28 0x555556ed630a in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332
|
#29 0x55555707a9e1 in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124
|
|
|
Thread T15 created by T0 here:
|
#0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
|
#1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
|
#2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
|
#3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
|
#4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
|
#5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
|
#6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
|
#7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
|
#8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
|
#9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
|
#10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/ctype-ascii.h:111 in my_strcoll_ascii_4bytes_found
|
Shadow bytes around the buggy address:
|
0x0c2a7fffea60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2a7fffea70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2a7fffea80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
|
0x0c2a7fffea90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a7fffeaa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c2a7fffeab0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2a7fffeac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2a7fffead0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
|
0x0c2a7fffeae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a7fffeaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a7fffeb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==7103==ABORTING
|
Attachments
Issue Links
- relates to
-
-
- Confirmed
-
Activity
Undefined behaviour at same location, may as well be identical:
main.mysql_client_test_comp w6 [ fail ] Found warnings/errors in server log file!
|
Test ended at 2025-04-03 03:27:53
|
line
|
/source/strings/ctype-ascii.h:110:27: runtime error: applying non-zero offset 4 to null pointer
|
SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /source/strings/ctype-ascii.h:110:27
|
^ Found warnings in /build/mysql-test/var/6/log/mysqld.1.err
|
ok
|
Thread 7 "one_connection" hit Breakpoint 2, 0x000055555935b880 in __ubsan::ScopedReport::~ScopedReport() ()
|
(gdb) bt
|
#0 0x000055555935b880 in __ubsan::ScopedReport::~ScopedReport() ()
|
#1 0x00005555593604cb in handlePointerOverflowImpl(__ubsan::PointerOverflowData*, unsigned long, unsigned long, __ubsan::ReportOptions) ()
|
#2 0x0000555559360044 in __ubsan_handle_pointer_overflow ()
|
#3 0x000055555d9357ce in my_strcoll_ascii_4bytes_found (a=0x55555ddc5b80 <str> "information_schema", ae=0x55555ddc5b92 <str+18> "", b=0x0, be=0x0) at /source/strings/ctype-ascii.h:110
|
#4 0x000055555d93e38e in my_strnncoll_utf8mb3_general1400_as_ci (cs=0x555560eed720 <my_charset_utf8mb3_general1400_as_ci>, a=0x55555ddc5b80 <str> "information_schema", a_length=18, b=0x0,
|
b_length=0, b_is_prefix=0 '\000') at /source/strings/strcoll.inl:238
|
#5 0x000055555959fd1b in charset_info_st::strnncoll (this=0x555560eed720 <my_charset_utf8mb3_general1400_as_ci>, a=..., b=..., b_is_prefix=0 '\000') at /source/include/m_ctype.h:1081
|
#6 0x000055555959f9da in charset_info_st::streq (this=0x555560eed720 <my_charset_utf8mb3_general1400_as_ci>, a=..., b=...) at /source/include/m_ctype.h:1073
|
#7 0x000055555959b272 in Lex_ident<Compare_ident_ci>::streq (this=0x55555f697740 <INFORMATION_SCHEMA_NAME>, rhs=...) at /source/sql/lex_ident.h:119
|
#8 0x00005555598505a2 in is_infoschema_db (name=0x7bffe5a52fa0) at /source/sql/table.h:3586
|
#9 0x0000555559ba5d6b in st_select_lex::add_table_to_list (this=0x7ecff7e3e438, thd=0x7eaff626c288, table=0x7ecff7e3ea60, alias=0x0, table_options=0, lock_type=TL_READ_DEFAULT,
|
mdl_type=MDL_SHARED_READ, index_hints_arg=0x0, partition_names=0x0, option=0x0) at /source/sql/sql_parse.cc:8114
|
#10 0x000055555acfe855 in MYSQLparse (thd=0x7eaff626c288) at /source/sql/sql_yacc.yy:12267
|
#11 0x0000555559c073c2 in parse_sql (thd=0x7eaff626c288, parser_state=0x7bffe5d15d30, creation_ctx=0x0, do_pfs_digest=false) at /source/sql/sql_parse.cc:10327
|
#12 0x0000555559cf119a in Prepared_statement::prepare (this=0x7d8ff6361b08,
|
packet=0x7bffd8904889 "explain with T as ( select * from t1 where t1.a=? limit 2 ) select * from T as TA, T as TB;", packet_len=93) at /source/sql/sql_prepare.cc:4153
|
#13 0x0000555559cedd8c in mysqld_stmt_prepare (thd=0x7eaff626c288, packet=0x7bffd8904889 "explain with T as ( select * from t1 where t1.a=? limit 2 ) select * from T as TA, T as TB;",
|
packet_length=93) at /source/sql/sql_prepare.cc:2574
|
#14 0x0000555559b7b7d3 in dispatch_command (command=COM_STMT_PREPARE, thd=0x7eaff626c288,
|
packet=0x7bffd8904889 "explain with T as ( select * from t1 where t1.a=? limit 2 ) select * from T as TA, T as TB;", packet_length=93, blocking=true) at /source/sql/sql_parse.cc:1848
|
#15 0x0000555559b93854 in do_command (thd=0x7eaff626c288, blocking=true) at /source/sql/sql_parse.cc:1415
|
#16 0x000055555a5a4c84 in do_handle_one_connection (connect=0x7d0ff61ffd88, put_in_cache=true) at /source/sql/sql_connect.cc:1415
|
#17 0x000055555a5a3fc7 in handle_one_connection (arg=0x7d0ff61ffd88) at /source/sql/sql_connect.cc:1327
|
#18 0x000055555931b5d7 in asan_thread_start(void*) ()
|
#19 0x00007ffff742d1c4 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
|
#20 0x00007ffff74ad85c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
|
|
Error at this layer - no point checking if a null db is an information_schema.
#9 0x0000555559ba5d6b in st_select_lex::add_table_to_list (this=0x7ecff7e3e438, thd=0x7eaff626c288, table=0x7ecff7e3ea60, alias=0x0, table_options=0, lock_type=TL_READ_DEFAULT,
|
mdl_type=MDL_SHARED_READ, index_hints_arg=0x0, partition_names=0x0, option=0x0) at /source/sql/sql_parse.cc:8114
|
8114 bool info_schema= is_infoschema_db(&db);
|
(gdb) p db
|
$6 = {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x0,
|
length = 0}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}
|
--- a/sql/lex_ident.h
|
+++ b/sql/lex_ident.h
|
@@ -165,6 +165,7 @@ class Lex_ident_fs: public Lex_ident<Compare_table_names>
|
*/
|
class Lex_ident_db: public Lex_ident_fs
|
{
|
+public:
|
bool is_null() const
|
{
|
return length == 0 && str == NULL;
|
@@ -174,7 +175,6 @@ class Lex_ident_db: public Lex_ident_fs
|
{
|
return length == 0 && str != NULL;
|
}
|
-public:
|
static bool check_name(const LEX_CSTRING &str);
|
static bool check_name_with_error(const LEX_CSTRING &str);
|
public:
|
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
|
index 787873c4d72..a1fa5b28ee9 100644
|
--- a/sql/sql_parse.cc
|
+++ b/sql/sql_parse.cc
|
@@ -8111,7 +8111,8 @@ TABLE_LIST *st_select_lex::add_table_to_list(THD *thd,
|
DBUG_RETURN(0);
|
else
|
fqtn= FALSE;
|
- bool info_schema= is_infoschema_db(&db);
|
+ bool info_schema= (db.is_null() || db.is_empty())
|
+ ? false : is_infoschema_db(&db);
|
if (!table->sel && info_schema &&
|
(table_options & TL_OPTION_UPDATING) &&
|
/* Special cases which are processed by commands itself */
|
occurs on other tests like main.json_equals, main.insert_returning, main.identifier, main.derived_view
Note - patch fixes many test cases, and the original test case, but the use-after-free backtrace by Alice in first comment is still there.
Thanks! I repeated on 10.4-11.2
Version: '10.4.32-MariaDB-debug-log' 62d80652be7c19f4ad2bf68d6ffbb4e1eb1d77ea===================================================================686997==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000334f0 at pc 0x564563dce503 bp 0x7fe307900f00 sp 0x7fe307900ef0READ of size 1 at 0x6150000334f0 thread T27#0 0x564563dce502 in my_instr_simple /10.4/src/strings/ctype-simple.c:1226#1 0x564562a7a9b3 in Item_func_locate::val_int() /10.4/src/sql/item_func.cc:3087#2 0x564562a5a12a in Item_int_func::val_real() /10.4/src/sql/item_func.cc:765#3 0x5645629c8e90 in Arg_comparator::compare_real() /10.4/src/sql/item_cmpfunc.cc:854#4 0x564562a0c9a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104#5 0x5645629d4782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790#6 0x564562a10a1d in cmp_item_int::cmp(Item*) /10.4/src/sql/item_cmpfunc.h:1639#7 0x564562a11d3b in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /10.4/src/sql/item_cmpfunc.h:1939#8 0x564562a13518 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x1bcc518)#9 0x5645629e27f1 in Item_func_case_simple::find_item() /10.4/src/sql/item_cmpfunc.cc:3026#10 0x5645629e2faa in Item_func_case::int_op() /10.4/src/sql/item_cmpfunc.cc:3064#11 0x5645626e8dbd in Item_func_hybrid_field_type::val_int_from_int_op() (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x18a1dbd)#12 0x5645626bd775 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /10.4/src/sql/sql_type.cc:4961#13 0x5645620f7952 in Item_func_hybrid_field_type::val_int() /10.4/src/sql/item_func.h:843#14 0x5645626c7dbd in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7137#15 0x5645626e24cd in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x189b4cd)#16 0x564561e6fd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045#17 0x564561e6125c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033#18 0x5645620144c6 in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3137#19 0x56456228c602 in end_send /10.4/src/sql/sql_select.cc:22118#20 0x5645625ea3dd in JOIN_CACHE::generate_full_extensions(unsigned char*) /10.4/src/sql/sql_join_cache.cc:2528#21 0x5645625e9c40 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2420#22 0x5645625e7f9e in JOIN_CACHE::join_records(bool) /10.4/src/sql/sql_join_cache.cc:2173#23 0x564562282307 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20685#24 0x564562282a91 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867#25 0x564562281191 in do_select /10.4/src/sql/sql_select.cc:20445#26 0x56456220ebd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625#27 0x56456220c203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407#28 0x5645622103df in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846#29 0x5645621e0c55 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442#30 0x564562147c5b in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475#31 0x5645621353d2 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978#32 0x5645621511d6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014#33 0x564562127562 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857#34 0x56456212408d in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378#35 0x56456253867d in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419#36 0x564562537f21 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323#37 0x5645631d5baf in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869#38 0x7fe31e4cd608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477#39 0x7fe31e09e132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)0x6150000334f0 is located 112 bytes inside of 468-byte region [0x615000033480,0x615000033654)freed by thread T27 here:#0 0x7fe31eacb40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122#1 0x564563d5d14a in free_memory /10.4/src/mysys/safemalloc.c:279#2 0x564563d5c706 in sf_free /10.4/src/mysys/safemalloc.c:197#3 0x564563d2b2fe in my_free /10.4/src/mysys/my_malloc.c:222#4 0x564561e42a25 in Binary_string::free() /10.4/src/sql/sql_string.h:711#5 0x564561e42811 in Binary_string::~Binary_string() /10.4/src/sql/sql_string.h:515#6 0x564561e42c03 in String::~String() /10.4/src/sql/sql_string.h:829#7 0x564562b2187f in StringBuffer<22ul>::~StringBuffer() /10.4/src/sql/sql_string.h:1172#8 0x564562ae383c in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:158#9 0x564562a7a754 in Item_func_locate::val_int() /10.4/src/sql/item_func.cc:3071#10 0x564562a5a12a in Item_int_func::val_real() /10.4/src/sql/item_func.cc:765#11 0x5645629c8e90 in Arg_comparator::compare_real() /10.4/src/sql/item_cmpfunc.cc:854#12 0x564562a0c9a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104#13 0x5645629d4782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790#14 0x564562a10a1d in cmp_item_int::cmp(Item*) /10.4/src/sql/item_cmpfunc.h:1639#15 0x564562a11d3b in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /10.4/src/sql/item_cmpfunc.h:1939#16 0x564562a13518 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x1bcc518)#17 0x5645629e27f1 in Item_func_case_simple::find_item() /10.4/src/sql/item_cmpfunc.cc:3026#18 0x5645629e2faa in Item_func_case::int_op() /10.4/src/sql/item_cmpfunc.cc:3064#19 0x5645626e8dbd in Item_func_hybrid_field_type::val_int_from_int_op() (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x18a1dbd)#20 0x5645626bd775 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /10.4/src/sql/sql_type.cc:4961#21 0x5645620f7952 in Item_func_hybrid_field_type::val_int() /10.4/src/sql/item_func.h:843#22 0x5645626c7dbd in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7137#23 0x5645626e24cd in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x189b4cd)#24 0x564561e6fd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045#25 0x564561e6125c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033#26 0x5645620144c6 in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3137#27 0x56456228c602 in end_send /10.4/src/sql/sql_select.cc:22118#28 0x5645625ea3dd in JOIN_CACHE::generate_full_extensions(unsigned char*) /10.4/src/sql/sql_join_cache.cc:2528#29 0x5645625e9c40 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2420previously allocated by thread T27 here:#0 0x7fe31eacb808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144#1 0x564563d5c0ba in sf_malloc /10.4/src/mysys/safemalloc.c:118#2 0x564563d2a807 in my_malloc /10.4/src/mysys/my_malloc.c:101#3 0x56456236fc39 in Binary_string::real_alloc(unsigned long) /10.4/src/sql/sql_string.cc:44#4 0x564561e686b3 in Binary_string::alloc(unsigned long) /10.4/src/sql/sql_string.h:720#5 0x56456288053e in Field_double::val_str(String*, String*) /10.4/src/sql/field.cc:4936#6 0x56456296559f in Item_field::val_str(String*) /10.4/src/sql/item.cc:3251#7 0x564562af57b8 in Item_func_rtrim::val_str(String*) /10.4/src/sql/item_strfunc.cc:2016#8 0x5645629919d7 in Item_direct_ref::val_str(String*) /10.4/src/sql/item.cc:8551#9 0x5645629b036f in Item_direct_view_ref::val_str(String*) /10.4/src/sql/item.h:5960#10 0x564562af4d38 in Item_func_ltrim::val_str(String*) /10.4/src/sql/item_strfunc.cc:1971#11 0x564562ae37fb in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:159#12 0x564562a7a754 in Item_func_locate::val_int() /10.4/src/sql/item_func.cc:3071#13 0x564562a5a12a in Item_int_func::val_real() /10.4/src/sql/item_func.cc:765#14 0x5645629c8e90 in Arg_comparator::compare_real() /10.4/src/sql/item_cmpfunc.cc:854#15 0x564562a0c9a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104#16 0x5645629d4782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790#17 0x564562a10a1d in cmp_item_int::cmp(Item*) /10.4/src/sql/item_cmpfunc.h:1639#18 0x564562a11d3b in Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int) /10.4/src/sql/item_cmpfunc.h:1939#19 0x564562a13518 in Predicant_to_list_comparator::cmp(Item_args*, unsigned int*, bool*) (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x1bcc518)#20 0x5645629e27f1 in Item_func_case_simple::find_item() /10.4/src/sql/item_cmpfunc.cc:3026#21 0x5645629e2faa in Item_func_case::int_op() /10.4/src/sql/item_cmpfunc.cc:3064#22 0x5645626e8dbd in Item_func_hybrid_field_type::val_int_from_int_op() (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x18a1dbd)#23 0x5645626bd775 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /10.4/src/sql/sql_type.cc:4961#24 0x5645620f7952 in Item_func_hybrid_field_type::val_int() /10.4/src/sql/item_func.h:843#25 0x5645626c7dbd in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7137#26 0x5645626e24cd in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x189b4cd)#27 0x564561e6fd1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045#28 0x564561e6125c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033#29 0x5645620144c6 in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3137Thread T27 created by T0 here:#0 0x7fe31e9f8815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208#1 0x5645631d5fa0 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919#2 0x564561e1cf71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275#3 0x564561e35161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296#4 0x564561e358fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366#5 0x564561e35de2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464#6 0x564561e36c9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622#7 0x564561e34866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954#8 0x564561e1af3c in main /10.4/src/sql/main.cc:25#9 0x7fe31dfa3082 in __libc_start_main ../csu/libc-start.c:308SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/ctype-simple.c:1226 in my_instr_simpleShadow bytes around the buggy address:0x0c2a7fffe640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a7fffe650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a7fffe660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a7fffe670: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa0x0c2a7fffe680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa=>0x0c2a7fffe690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd0x0c2a7fffe6a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a7fffe6b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a7fffe6c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa0x0c2a7fffe6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa0x0c2a7fffe6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa faShadow byte legend (one shadow byte represents 8 application bytes):Addressable: 00Partially addressable: 01 02 03 04 05 06 07Heap left redzone: faFreed heap region: fdStack left redzone: f1Stack mid redzone: f2Stack right redzone: f3Stack after return: f5Stack use after scope: f8Global redzone: f9Global init order: f6Poisoned by user: f7Container overflow: fcArray cookie: acIntra object redzone: bbASan internal: feLeft alloca redzone: caRight alloca redzone: cbShadow gap: cc==686997==ABORTING----------SERVER LOG END-------------===================================================================1458084==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000604f0 at pc 0x563f6aee9226 bp 0x7f62364548a0 sp 0x7f6236454890READ of size 1 at 0x6150000604f0 thread T31#0 0x563f6aee9225 in my_instr_simple /10.4/src/strings/ctype-simple.c:1226#1 0x563f69b9435f in Item_func_locate::val_int() /10.4/src/sql/item_func.cc:3087#2 0x563f697e1773 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7137#3 0x563f697fbe83 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/10.4-bld/sql/mysqld+0x189be83)#4 0x563f68f88d1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045#5 0x563f68f7a25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033#6 0x563f6912d55e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130#7 0x563f693a5b5e in end_send /10.4/src/sql/sql_select.cc:22118#8 0x563f6939df0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149#9 0x563f6939c841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922#10 0x563f6939a5e7 in do_select /10.4/src/sql/sql_select.cc:20443#11 0x563f6932812f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625#12 0x563f6932575f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407#13 0x563f6932993b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846#14 0x563f692fa1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442#15 0x563f692611ad in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475#16 0x563f6924e924 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978#17 0x563f6926a728 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014#18 0x563f69240ab4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857#19 0x563f6923d5df in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378#20 0x563f69652031 in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419#21 0x563f696518d5 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323#22 0x563f6a2ef747 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869#23 0x7f6250d8b608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477#24 0x7f625095c132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)0x6150000604f0 is located 112 bytes inside of 468-byte region [0x615000060480,0x615000060654)freed by thread T31 here:#0 0x7f625138940f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122#1 0x563f6ae77e6d in free_memory /10.4/src/mysys/safemalloc.c:279#2 0x563f6ae77429 in sf_free /10.4/src/mysys/safemalloc.c:197#3 0x563f6ae46021 in my_free /10.4/src/mysys/my_malloc.c:222#4 0x563f68f5ba25 in Binary_string::free() /10.4/src/sql/sql_string.h:711#5 0x563f68f5b811 in Binary_string::~Binary_string() /10.4/src/sql/sql_string.h:515#6 0x563f68f5bc03 in String::~String() /10.4/src/sql/sql_string.h:829#7 0x563f69c3b22b in StringBuffer<22ul>::~StringBuffer() /10.4/src/sql/sql_string.h:1172#8 0x563f69bfd1e8 in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:158#9 0x563f69aab19a in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543#10 0x563f69ac9ce4 in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953#11 0x563f69b94100 in Item_func_locate::val_int() /10.4/src/sql/item_func.cc:3071#12 0x563f697e1773 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7137#13 0x563f697fbe83 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x189be83)#14 0x563f68f88d1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045#15 0x563f68f7a25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033#16 0x563f6912d55e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130#17 0x563f693a5b5e in end_send /10.4/src/sql/sql_select.cc:22118#18 0x563f6939df0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149#19 0x563f6939c841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922#20 0x563f6939a5e7 in do_select /10.4/src/sql/sql_select.cc:20443#21 0x563f6932812f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625#22 0x563f6932575f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407#23 0x563f6932993b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846#24 0x563f692fa1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442#25 0x563f692611ad in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475#26 0x563f6924e924 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978#27 0x563f6926a728 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014#28 0x563f69240ab4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857#29 0x563f6923d5df in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378previously allocated by thread T31 here:#0 0x7f6251389808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144#1 0x563f6ae76ddd in sf_malloc /10.4/src/mysys/safemalloc.c:118#2 0x563f6ae4552a in my_malloc /10.4/src/mysys/my_malloc.c:101#3 0x563f69489195 in Binary_string::real_alloc(unsigned long) /10.4/src/sql/sql_string.cc:44#4 0x563f68f816b3 in Binary_string::alloc(unsigned long) /10.4/src/sql/sql_string.h:720#5 0x563f69999ef4 in Field_double::val_str(String*, String*) /10.4/src/sql/field.cc:4936#6 0x563f69a7ef55 in Item_field::val_str(String*) /10.4/src/sql/item.cc:3251#7 0x563f69c0fea4 in Item_func_trim::val_str(String*) /10.4/src/sql/item_strfunc.cc:2096#8 0x563f69bfd1a7 in Item_str_func::val_int() /10.4/src/sql/item_strfunc.cc:159#9 0x563f69aab19a in Item_direct_ref::val_int() /10.4/src/sql/item.cc:8543#10 0x563f69ac9ce4 in Item_direct_view_ref::val_int() /10.4/src/sql/item.h:5953#11 0x563f69b94100 in Item_func_locate::val_int() /10.4/src/sql/item_func.cc:3071#12 0x563f697e1773 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /10.4/src/sql/sql_type.cc:7137#13 0x563f697fbe83 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x189be83)#14 0x563f68f88d1b in Item::send(Protocol*, st_value*) /10.4/src/sql/item.h:1045#15 0x563f68f7a25c in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1033#16 0x563f6912d55e in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3130#17 0x563f693a5b5e in end_send /10.4/src/sql/sql_select.cc:22118#18 0x563f6939df0c in evaluate_join_record /10.4/src/sql/sql_select.cc:21149#19 0x563f6939c841 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922#20 0x563f6939a5e7 in do_select /10.4/src/sql/sql_select.cc:20443#21 0x563f6932812f in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625#22 0x563f6932575f in JOIN::exec() /10.4/src/sql/sql_select.cc:4407#23 0x563f6932993b in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846#24 0x563f692fa1b1 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442#25 0x563f692611ad in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475#26 0x563f6924e924 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978#27 0x563f6926a728 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014#28 0x563f69240ab4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857#29 0x563f6923d5df in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378Thread T31 created by T0 here:#0 0x7f62512b6815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208#1 0x563f6a2efb38 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919#2 0x563f68f35f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275#3 0x563f68f4e161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296#4 0x563f68f4e8fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366#5 0x563f68f4ede2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464#6 0x563f68f4fc9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622#7 0x563f68f4d866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954#8 0x563f68f33f3c in main /10.4/src/sql/main.cc:25#9 0x7f6250861082 in __libc_start_main ../csu/libc-start.c:308SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/ctype-simple.c:1226 in my_instr_simpleShadow bytes around the buggy address:0x0c2a80004040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0c2a80004050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0c2a80004060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0c2a80004070: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa0x0c2a80004080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa=>0x0c2a80004090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd0x0c2a800040a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a800040b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd0x0c2a800040c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa0x0c2a800040d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa0x0c2a800040e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa faShadow byte legend (one shadow byte represents 8 application bytes):Addressable: 00Partially addressable: 01 02 03 04 05 06 07Heap left redzone: faFreed heap region: fdStack left redzone: f1Stack mid redzone: f2Stack right redzone: f3Stack after return: f5Stack use after scope: f8Global redzone: f9Global init order: f6Poisoned by user: f7Container overflow: fcArray cookie: acIntra object redzone: bbASan internal: feLeft alloca redzone: caRight alloca redzone: cbShadow gap: cc==1458084==ABORTING----------SERVER LOG END-------------