Heap-Use-After-Free at /mariadb-11.3.0/strings/dtoa.c:1378

Run these queries in debug build:

CREATE TABLE t0 ( c8 INT , CONSTRAINT cc0 UNIQUE i0 ( c8 ) ) ;
INSERT INTO t0 VALUES ( ) , ( ) ;
ALTER TABLE t0 ADD COLUMN c59 TEXT NOT NULL AFTER c8 ;
INSERT INTO t0 VALUES ( -95 , 86 ) , ( -58 , -36 ) ;
SELECT t1 . c41 AS c18 FROM ( SELECT c59 AS c41 FROM t0 ) AS t1 JOIN t0 ON c8 IN ( SELECT c8 AS c45 FROM t0 GROUP BY c59 , c8 HAVING c59 = AVG ( ( SELECT c8 AS c30 FROM t0 HAVING ATAN ( ROUND ( -588949354837696189 , IF ( 6068938522839077129 , -1 BETWEEN 79 AND 49 , 21 ) ) , RAND ( ) ) = t0 . c59 LIMIT 1 ) ) ) ;

Will trigger Heap-Use-After-Free.
ASAN info:
=================================================================
==10747==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001e52a0 at pc 0x555559052512 bp 0x7fffd1626d70 sp 0x7fffd1626d60
READ of size 1 at 0x6290001e52a0 thread T15
#0 0x555559052511 in my_strtod_int /home/wx/mariadb-11.3.0/strings/dtoa.c:1378
#1 0x55555904eb04 in my_strtod /home/wx/mariadb-11.3.0/strings/dtoa.c:469
#2 0x555558fbc7ff in my_strntod_8bit /home/wx/mariadb-11.3.0/strings/ctype-simple.c:800
#3 0x555556f02963 in charset_info_st::strntod(char*, unsigned long, char*, int) const /home/wx/mariadb-11.3.0/include/m_ctype.h:930
#4 0x555556f033f8 in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:210
#5 0x555556f03768 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:281
#6 0x555557ac216f in Field_blob::val_real() /home/wx/mariadb-11.3.0/sql/field.cc:8744
#7 0x555557b8a817 in Item_field::val_result() /home/wx/mariadb-11.3.0/sql/item.cc:3428
#8 0x555557bb2e6f in Item_ref::val_real() /home/wx/mariadb-11.3.0/sql/item.cc:8513
#9 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
#10 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#11 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#12 0x555557369752 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24685
#13 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#14 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#15 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#16 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#17 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#18 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
#19 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#20 0x555557db09ea in Item_singlerow_subselect::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525
#21 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
#22 0x555557e05b78 in Item_sum_avg::reset_field() /home/wx/mariadb-11.3.0/sql/item_sum.cc:2923
#23 0x55555738760f in init_tmptable_sum_functions /home/wx/mariadb-11.3.0/sql/sql_select.cc:28763
#24 0x55555736dee6 in end_unique_update /home/wx/mariadb-11.3.0/sql/sql_select.cc:25138
#25 0x5555573a1a76 in AGGR_OP::put_record(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:32254
#26 0x5555573b632c in AGGR_OP::put_record() (/usr/local/mysql/bin/mariadbd+0x1e6232c)
#27 0x55555735ec69 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23134
#28 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#29 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#30 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#31 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#32 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#33 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
#34 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#35 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#36 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#37 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#38 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#39 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#40 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
#41 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
#42 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#43 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#44 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#45 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#46 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#47 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#48 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#49 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#50 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#51 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#52 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#53 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#54 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#55 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#56 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#57 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#58 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#59 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6290001e52a0 is located 160 bytes inside of 16536-byte region [0x6290001e5200,0x6290001e9298)
freed by thread T15 here:
#0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x555558563801 in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:424
#2 0x55555872d475 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:416
#3 0x5555588a10ad in mem_heap_free /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:419
#4 0x5555588a3967 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /home/wx/mariadb-11.3.0/storage/innobase/row/row0mysql.cc:101
#5 0x55555891fea6 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3148
#6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689
#7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289
#8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485
#9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615
#10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513
#11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81
#12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461
#13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
#17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
#24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
#25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

previously allocated by thread T15 here:
#0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x5555585632ec in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:375
#2 0x55555872c719 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:277
#3 0x55555890917c in mem_heap_create_func /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:377
#4 0x55555891f76c in row_sel_store_mysql_field /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3089
#5 0x555558920887 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3235
#6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689
#7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289
#8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485
#9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615
#10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513
#11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81
#12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461
#13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
#17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
#24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
#25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

Thread T15 created by T0 here:
#0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
#2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
#3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
#4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
#5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
#6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
#7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
#8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
#9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
#10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/dtoa.c:1378 in my_strtod_int
Shadow bytes around the buggy address:
0x0c5280034a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c5280034a50: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==10747==ABORTING