Details
-
Bug
-
Status: Stalled (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
-
None
-
Ubuntu 20.04
Description
Run these queries in debug build:
CREATE TABLE t0 ( c8 INT , CONSTRAINT cc0 UNIQUE i0 ( c8 ) ) ; |
INSERT INTO t0 VALUES ( ) , ( ) ; |
ALTER TABLE t0 ADD COLUMN c59 TEXT NOT NULL AFTER c8 ; |
INSERT INTO t0 VALUES ( -95 , 86 ) , ( -58 , -36 ) ; |
SELECT t1 . c41 AS c18 FROM ( SELECT c59 AS c41 FROM t0 ) AS t1 JOIN t0 ON c8 IN ( SELECT c8 AS c45 FROM t0 GROUP BY c59 , c8 HAVING c59 = AVG ( ( SELECT c8 AS c30 FROM t0 HAVING ATAN ( ROUND ( -588949354837696189 , IF ( 6068938522839077129 , -1 BETWEEN 79 AND 49 , 21 ) ) , RAND ( ) ) = t0 . c59 LIMIT 1 ) ) ) ; |
Will trigger Heap-Use-After-Free.
ASAN info:
=================================================================
|
==10747==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001e52a0 at pc 0x555559052512 bp 0x7fffd1626d70 sp 0x7fffd1626d60
|
READ of size 1 at 0x6290001e52a0 thread T15
|
#0 0x555559052511 in my_strtod_int /home/wx/mariadb-11.3.0/strings/dtoa.c:1378
|
#1 0x55555904eb04 in my_strtod /home/wx/mariadb-11.3.0/strings/dtoa.c:469
|
#2 0x555558fbc7ff in my_strntod_8bit /home/wx/mariadb-11.3.0/strings/ctype-simple.c:800
|
#3 0x555556f02963 in charset_info_st::strntod(char*, unsigned long, char**, int*) const /home/wx/mariadb-11.3.0/include/m_ctype.h:930
|
#4 0x555556f033f8 in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:210
|
#5 0x555556f03768 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:281
|
#6 0x555557ac216f in Field_blob::val_real() /home/wx/mariadb-11.3.0/sql/field.cc:8744
|
#7 0x555557b8a817 in Item_field::val_result() /home/wx/mariadb-11.3.0/sql/item.cc:3428
|
#8 0x555557bb2e6f in Item_ref::val_real() /home/wx/mariadb-11.3.0/sql/item.cc:8513
|
#9 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
|
#10 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
|
#11 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
|
#12 0x555557369752 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24685
|
#13 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
|
#14 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
|
#15 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
|
#16 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
#17 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
|
#18 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
|
#19 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
|
#20 0x555557db09ea in Item_singlerow_subselect::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525
|
#21 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
|
#22 0x555557e05b78 in Item_sum_avg::reset_field() /home/wx/mariadb-11.3.0/sql/item_sum.cc:2923
|
#23 0x55555738760f in init_tmptable_sum_functions /home/wx/mariadb-11.3.0/sql/sql_select.cc:28763
|
#24 0x55555736dee6 in end_unique_update /home/wx/mariadb-11.3.0/sql/sql_select.cc:25138
|
#25 0x5555573a1a76 in AGGR_OP::put_record(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:32254
|
#26 0x5555573b632c in AGGR_OP::put_record() (/usr/local/mysql/bin/mariadbd+0x1e6232c)
|
#27 0x55555735ec69 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23134
|
#28 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
|
#29 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
|
#30 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
|
#31 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
#32 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
|
#33 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
|
#34 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
|
#35 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
|
#36 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
|
#37 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
|
#38 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
|
#39 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
|
#40 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
|
#41 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
|
#42 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
|
#43 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
|
#44 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
|
#45 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
|
#46 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
#47 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
|
#48 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
|
#49 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
|
#50 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
|
#51 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
|
#52 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
|
#53 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
|
#54 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
|
#55 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
|
#56 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
|
#57 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
|
#58 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
|
#59 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
|
 |
0x6290001e52a0 is located 160 bytes inside of 16536-byte region [0x6290001e5200,0x6290001e9298)
|
freed by thread T15 here:
|
#0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
|
#1 0x555558563801 in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:424
|
#2 0x55555872d475 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:416
|
#3 0x5555588a10ad in mem_heap_free /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:419
|
#4 0x5555588a3967 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /home/wx/mariadb-11.3.0/storage/innobase/row/row0mysql.cc:101
|
#5 0x55555891fea6 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3148
|
#6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689
|
#7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289
|
#8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485
|
#9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615
|
#10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513
|
#11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81
|
#12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461
|
#13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
|
#14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
#15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
|
#16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
|
#17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
|
#18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
|
#19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
|
#20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
|
#21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
|
#22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
|
#23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
|
#24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
|
#25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
|
#26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
|
#27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
|
#28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
|
#29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
 |
previously allocated by thread T15 here:
|
#0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
|
#1 0x5555585632ec in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:375
|
#2 0x55555872c719 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:277
|
#3 0x55555890917c in mem_heap_create_func /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:377
|
#4 0x55555891f76c in row_sel_store_mysql_field /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3089
|
#5 0x555558920887 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3235
|
#6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689
|
#7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289
|
#8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485
|
#9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615
|
#10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513
|
#11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81
|
#12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461
|
#13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
|
#14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
#15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
|
#16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
|
#17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
|
#18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
|
#19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
|
#20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
|
#21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
|
#22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
|
#23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
|
#24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
|
#25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
|
#26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
|
#27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
|
#28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
|
#29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
|
 |
Thread T15 created by T0 here:
|
#0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
|
#1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
|
#2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
|
#3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
|
#4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
|
#5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
|
#6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
|
#7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
|
#8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
|
#9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
|
#10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308
|
 |
SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/dtoa.c:1378 in my_strtod_int
|
Shadow bytes around the buggy address:
|
0x0c5280034a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c5280034a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c5280034a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c5280034a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c5280034a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c5280034a50: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
|
0x0c5280034a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c5280034a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c5280034a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c5280034a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c5280034aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==10747==ABORTING
|
Attachments
Issue Links
- relates to
-
MDEV-18414 Server crash or ASAN heap-use-after-free in my_strtod_int / Value_source::Converter_strntod::Converter_strntod
- Closed
-
MDEV-28345 ASAN: use-after-poison or unknown-crash in my_strtod_int from charset_info_st::strntod or test_if_number
- Closed
-
MDEV-32416 Heap-Use-Sfter-Free at /mariadb-11.3.0/sql/item_strfunc.cc:2432
- Confirmed
-
MDEV-34616 ASAN: heap-use-after-free in my_strtod_int
- Open