Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32762

Heap-Use-After-Free at /mariadb-11.3.0/sql/sql_string.cc:261

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
    • 10.4, 10.5, 10.6, 10.11, 11.1, 11.2
    • Server
    • None
    • Ubuntu 20.04

    Description

      Run these queries in debug build:

      CREATE TABLE t0 ( c45 INT , c21 DECIMAL ( 21 ) DEFAULT ( -8725565205802107820 ) ) ;
      		 
      INSERT INTO t0 VALUES ( -28 , ELT ( -117 , 'I2Rm21I.E099H<DHr)>JkQFR*\\JrC|i`pb}Ju lz<ZY>`U50/=L:8An<DN]3<y' , 'Vzt*h)zg#-{' ) = -76 ) , ( -25 , 51 ) ;
      		 
      CREATE INDEX i0 ON t0 ( c45 ) ;
      		 
      INSERT INTO t0 VALUES ( -112 , -29 ) , ( -36 , 5 ) ;
      		 
      DROP INDEX i0 ON t0 ;
      		 
      SELECT c5 AS c6 FROM ( SELECT MAKE_SET ( c45 , LTRIM ( t0 . c45 ) , RAND ( ) ) AS c5 FROM t0 ) AS t1 JOIN ( SELECT c45 AS c16 FROM t0 ) AS t2 ON c16 = c16 ;

      Will trigger Heap-Use-After-Free.
      ASAN info:
      =================================================================
      ==17195==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000026b68 at pc 0x7ffff7623f50 bp 0x7fffd1629130 sp 0x7fffd16288d8
      READ of size 3 at 0x60e000026b68 thread T15
      #0 0x7ffff7623f4f in __interceptor_memmove ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:773
      #1 0x555557481cbf in Binary_string::copy(Binary_string const&) /home/wx/mariadb-11.3.0/sql/sql_string.cc:261
      #2 0x555556ea1847 in String::copy(String const&) /home/wx/mariadb-11.3.0/sql/sql_string.h:972
      #3 0x555557d1f430 in Item_func_make_set::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3334
      #4 0x555557ba4ba9 in Item::save_str_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6805
      #5 0x5555578b219f in Type_handler_string_result::Item_save_in_field(Item*, Field*, bool) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:4320
      #6 0x555557ba540a in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853
      #7 0x55555702c43a in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_base.cc:9320
      #8 0x555557514c5b in select_unit::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_union.cc:122
      #9 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
      #10 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
      #11 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
      #12 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
      #13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #16 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
      #17 0x5555570d9be9 in mysql_derived_fill /home/wx/mariadb-11.3.0/sql/sql_derived.cc:1266
      #18 0x5555570d27b5 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200
      #19 0x55555732a50b in st_join_table::preread_init() /home/wx/mariadb-11.3.0/sql/sql_select.cc:16029
      #20 0x55555735f8c7 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23392
      #21 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #22 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #23 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #24 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
      #25 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
      #26 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
      #27 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
      #28 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
      #29 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
      #30 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
      #31 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
      #32 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
      #33 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
      #34 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
      #35 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

      0x60e000026b68 is located 136 bytes inside of 156-byte region [0x60e000026ae0,0x60e000026b7c)
      freed by thread T15 here:
      #0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
      #1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297
      #2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203
      #3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217
      #4 0x555556e1020b in Binary_string::free_buffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:308
      #5 0x5555574804dd in Binary_string::real_alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:44
      #6 0x555556eddc40 in Binary_string::alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.h:792
      #7 0x555557481e0b in Binary_string::copy(char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:269
      #8 0x555556e109dd in String::copy(char const*, unsigned long, charset_info_st const*) /home/wx/mariadb-11.3.0/sql/sql_string.h:977
      #9 0x555557482ab6 in String::copy(char const*, unsigned long, charset_info_st const*, charset_info_st const*, unsigned int*) /home/wx/mariadb-11.3.0/sql/sql_string.cc:466
      #10 0x555557481942 in String::set_real(double, unsigned int, charset_info_st const*) /home/wx/mariadb-11.3.0/sql/sql_string.cc:227
      #11 0x555557c6fb5f in Item_real_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:691
      #12 0x555557d1f2ec in Item_func_make_set::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3314
      #13 0x555557ba4ba9 in Item::save_str_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6805
      #14 0x5555578b219f in Type_handler_string_result::Item_save_in_field(Item*, Field*, bool) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:4320
      #15 0x555557ba540a in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853
      #16 0x55555702c43a in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_base.cc:9320
      #17 0x555557514c5b in select_unit::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_union.cc:122
      #18 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
      #19 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
      #20 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
      #21 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
      #22 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #23 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #24 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #25 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
      #26 0x5555570d9be9 in mysql_derived_fill /home/wx/mariadb-11.3.0/sql/sql_derived.cc:1266
      #27 0x5555570d27b5 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200
      #28 0x55555732a50b in st_join_table::preread_init() /home/wx/mariadb-11.3.0/sql/sql_select.cc:16029
      #29 0x55555735f8c7 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23392

      previously allocated by thread T15 here:
      #0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
      #1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126
      #2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89
      #3 0x555557480581 in Binary_string::real_alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:45
      #4 0x555556eddc40 in Binary_string::alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.h:792
      #5 0x555557a94eae in Field_int::val_str_from_long(String*, unsigned int, int, long) /home/wx/mariadb-11.3.0/sql/field.cc:4318
      #6 0x555557a96786 in Field_long::val_str(String*, String*) /home/wx/mariadb-11.3.0/sql/field.cc:4499
      #7 0x555557b89713 in Item_field::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:3328
      #8 0x555557d1549d in Item_func_ltrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2352
      #9 0x555557d1f2ec in Item_func_make_set::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3314
      #10 0x555557ba4ba9 in Item::save_str_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6805
      #11 0x5555578b219f in Type_handler_string_result::Item_save_in_field(Item*, Field*, bool) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:4320
      #12 0x555557ba540a in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853
      #13 0x55555702c43a in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_base.cc:9320
      #14 0x555557514c5b in select_unit::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_union.cc:122
      #15 0x5555573b2fd4 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
      #16 0x555557369b65 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
      #17 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
      #18 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
      #19 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #20 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #21 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #22 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
      #23 0x5555570d9be9 in mysql_derived_fill /home/wx/mariadb-11.3.0/sql/sql_derived.cc:1266
      #24 0x5555570d27b5 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200
      #25 0x55555732a50b in st_join_table::preread_init() /home/wx/mariadb-11.3.0/sql/sql_select.cc:16029
      #26 0x55555735f8c7 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23392
      #27 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #28 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #29 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718

      Thread T15 created by T0 here:
      #0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
      #1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
      #2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
      #3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
      #4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
      #5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
      #6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
      #7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
      #8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
      #9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
      #10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

      SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:773 in __interceptor_memmove
      Shadow bytes around the buggy address:
      0x0c1c7fffcd10: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa
      0x0c1c7fffcd20: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c1c7fffcd30: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa
      0x0c1c7fffcd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x0c1c7fffcd50: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
      =>0x0c1c7fffcd60: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
      0x0c1c7fffcd70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c1c7fffcd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c1c7fffcd90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c1c7fffcda0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c1c7fffcdb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable: 00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone: fa
      Freed heap region: fd
      Stack left redzone: f1
      Stack mid redzone: f2
      Stack right redzone: f3
      Stack after return: f5
      Stack use after scope: f8
      Global redzone: f9
      Global init order: f6
      Poisoned by user: f7
      Container overflow: fc
      Array cookie: ac
      Intra object redzone: bb
      ASan internal: fe
      Left alloca redzone: ca
      Right alloca redzone: cb
      Shadow gap: cc
      ==17195==ABORTING

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-22196 ASAN heap-use-after-free in String::copy/Binary_string::copy after query using WITH ROLLUP

          • Major - Major loss of function.
          • Confirmed

          Activity

            People

              psergei Sergei Petrunia
              Xin Wen Xin Wen
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.