[MDEV-32759] Heap-Use-After-Free at /mariadb-11.3.0/strings/dtoa.c:1378 - Jira

XML

Word

Printable

Details

Type: Bug
Status: Stalled (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
Fix Version/s: 10.5, 10.6, 11.4
Component/s: Server
Labels:
None
Environment:
Ubuntu 20.04

Description

Run these queries in debug build:

CREATE TABLE t0 ( c8 INT , CONSTRAINT cc0 UNIQUE i0 ( c8 ) ) ;

INSERT INTO t0 VALUES ( ) , ( ) ;

ALTER TABLE t0 ADD COLUMN c59 TEXT NOT NULL AFTER c8 ;

INSERT INTO t0 VALUES ( -95 , 86 ) , ( -58 , -36 ) ;

SELECT t1 . c41 AS c18 FROM ( SELECT c59 AS c41 FROM t0 ) AS t1 JOIN t0 ON c8 IN ( SELECT c8 AS c45 FROM t0 GROUP BY c59 , c8 HAVING c59 = AVG ( ( SELECT c8 AS c30 FROM t0 HAVING ATAN ( ROUND ( -588949354837696189 , IF ( 6068938522839077129 , -1 BETWEEN 79 AND 49 , 21 ) ) , RAND ( ) ) = t0 . c59 LIMIT 1 ) ) ) ;

Will trigger Heap-Use-After-Free.
ASAN info:

=================================================================

==10747==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001e52a0 at pc 0x555559052512 bp 0x7fffd1626d70 sp 0x7fffd1626d60

READ of size 1 at 0x6290001e52a0 thread T15

    #0 0x555559052511 in my_strtod_int /home/wx/mariadb-11.3.0/strings/dtoa.c:1378

    #1 0x55555904eb04 in my_strtod /home/wx/mariadb-11.3.0/strings/dtoa.c:469

    #2 0x555558fbc7ff in my_strntod_8bit /home/wx/mariadb-11.3.0/strings/ctype-simple.c:800

    #3 0x555556f02963 in charset_info_st::strntod(char*, unsigned long, char**, int*) const /home/wx/mariadb-11.3.0/include/m_ctype.h:930

    #4 0x555556f033f8 in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:210

    #5 0x555556f03768 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:281

    #6 0x555557ac216f in Field_blob::val_real() /home/wx/mariadb-11.3.0/sql/field.cc:8744

    #7 0x555557b8a817 in Item_field::val_result() /home/wx/mariadb-11.3.0/sql/item.cc:3428

    #8 0x555557bb2e6f in Item_ref::val_real() /home/wx/mariadb-11.3.0/sql/item.cc:8513

    #9 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848

    #10 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104

    #11 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780

    #12 0x555557369752 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24685

    #13 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677

    #14 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444

    #15 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #16 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #17 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #18 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159

    #19 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812

    #20 0x555557db09ea in Item_singlerow_subselect::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525

    #21 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293

    #22 0x555557e05b78 in Item_sum_avg::reset_field() /home/wx/mariadb-11.3.0/sql/item_sum.cc:2923

    #23 0x55555738760f in init_tmptable_sum_functions /home/wx/mariadb-11.3.0/sql/sql_select.cc:28763

    #24 0x55555736dee6 in end_unique_update /home/wx/mariadb-11.3.0/sql/sql_select.cc:25138

    #25 0x5555573a1a76 in AGGR_OP::put_record(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:32254

    #26 0x5555573b632c in AGGR_OP::put_record() (/usr/local/mysql/bin/mariadbd+0x1e6232c)

    #27 0x55555735ec69 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23134

    #28 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677

    #29 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481

    #30 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #31 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #32 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #33 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730

    #34 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812

    #35 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994

    #36 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991

    #37 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797

    #38 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664

    #39 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914

    #40 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502

    #41 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342

    #42 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158

    #43 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192

    #44 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378

    #45 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963

    #46 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #47 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #48 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249

    #49 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628

    #50 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013

    #51 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912

    #52 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734

    #53 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893

    #54 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406

    #55 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445

    #56 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347

    #57 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201

    #58 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #59 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6290001e52a0 is located 160 bytes inside of 16536-byte region [0x6290001e5200,0x6290001e9298)

freed by thread T15 here:

    #0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122

    #1 0x555558563801 in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:424

    #2 0x55555872d475 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:416

    #3 0x5555588a10ad in mem_heap_free /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:419

    #4 0x5555588a3967 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /home/wx/mariadb-11.3.0/storage/innobase/row/row0mysql.cc:101

    #5 0x55555891fea6 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3148

    #6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689

    #7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289

    #8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485

    #9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615

    #10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513

    #11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81

    #12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461

    #13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730

    #17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812

    #18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994

    #19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991

    #20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797

    #21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664

    #22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914

    #23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502

    #24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342

    #25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158

    #26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192

    #27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378

    #28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963

    #29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

previously allocated by thread T15 here:

    #0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x5555585632ec in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:375

    #2 0x55555872c719 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:277

    #3 0x55555890917c in mem_heap_create_func /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:377

    #4 0x55555891f76c in row_sel_store_mysql_field /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3089

    #5 0x555558920887 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3235

    #6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689

    #7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289

    #8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485

    #9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615

    #10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513

    #11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81

    #12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461

    #13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961

    #14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

    #15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

    #16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730

    #17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812

    #18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994

    #19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991

    #20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797

    #21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664

    #22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914

    #23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502

    #24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342

    #25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158

    #26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192

    #27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378

    #28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963

    #29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

Thread T15 created by T0 here:

    #0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52

    #2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252

    #3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139

    #4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150

    #5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212

    #6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274

    #7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398

    #8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045

    #9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34

    #10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/dtoa.c:1378 in my_strtod_int

Shadow bytes around the buggy address:

  0x0c5280034a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280034a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280034a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280034a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280034a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c5280034a50: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280034a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280034a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280034a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280034a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280034aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==10747==ABORTING

Attachments

Issue Links

relates to

MDEV-18414 Server crash or ASAN heap-use-after-free in my_strtod_int / Value_source::Converter_strntod::Converter_strntod

Closed

MDEV-28345 ASAN: use-after-poison or unknown-crash in my_strtod_int from charset_info_st::strntod or test_if_number

Closed

MDEV-32416 Heap-Use-Sfter-Free at /mariadb-11.3.0/sql/item_strfunc.cc:2432

Confirmed

MDEV-34616 ASAN: heap-use-after-free in my_strtod_int

Open

Activity

People

Assignee:: Unassigned

Reporter:: Xin Wen

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 2023-11-10 07:54

Updated:: 2024-11-22 17:12

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.