Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
11.4.1
-
None
-
Ubuntu 20.04, tags/mariadb-11.4.1, AddressSanitizer enabled
Description
PoC:
SELECT CONV(-29223372036854775809, -10, 18446744073709551614); |
ASAN report:
=================================================================
|
==1873==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fabd2b5db61 at pc 0x0000024a9f37 bp 0x7fabd2b5d990 sp 0x7fabd2b5d988
|
WRITE of size 1 at 0x7fabd2b5db61 thread T12
|
#0 0x24a9f36 in int2str /root/mariadb/strings/int2str.c:129:18
|
#1 0x15d5a06 in Item_func_conv::val_str(String*) /root/mariadb/sql/item_strfunc.cc:3960:14
|
#2 0x11831a9 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /root/mariadb/sql/sql_type.cc:7496:19
|
#3 0x90ea0a in Protocol::send_result_set_row(List<Item>*) /root/mariadb/sql/protocol.cc:1333:15
|
#4 0xa7584c in select_send::send_data(List<Item>&) /root/mariadb/sql/sql_class.cc:3187:17
|
#5 0xcb3d4d in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /root/mariadb/sql/sql_class.h:5995:12
|
#6 0xcb3d4d in JOIN::exec_inner() /root/mariadb/sql/sql_select.cc:4862:22
|
#7 0xcb1198 in JOIN::exec() /root/mariadb/sql/sql_select.cc:4774:8
|
#8 0xc527c7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /root/mariadb/sql/sql_select.cc:5304:21
|
#9 0xc51c68 in handle_select(THD*, LEX*, select_result*, unsigned long long) /root/mariadb/sql/sql_select.cc:630:10
|
#10 0xba71f1 in execute_sqlcom_select(THD*, TABLE_LIST*) /root/mariadb/sql/sql_parse.cc:6094:12
|
#11 0xb95e8b in mysql_execute_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:3943:12
|
#12 0xc22e52 in Prepared_statement::execute(String*, bool) /root/mariadb/sql/sql_prepare.cc:5076:14
|
#13 0xc1c93a in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /root/mariadb/sql/sql_prepare.cc:4461:10
|
#14 0xc1b646 in mysql_stmt_execute_common(THD*, unsigned long, unsigned char*, unsigned char*, unsigned long, bool, bool) /root/mariadb/sql/sql_prepare.cc:3368:11
|
#15 0xc1affe in mysqld_stmt_execute(THD*, char*, unsigned int) /root/mariadb/sql/sql_prepare.cc:3139:3
|
#16 0xb81a77 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /root/mariadb/sql/sql_parse.cc:1818:5
|
#17 0xb89c41 in do_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:1406:17
|
#18 0xf82df8 in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1437:11
|
#19 0xf82848 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1339:5
|
#20 0x1b267da in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3
|
#21 0x7fabf7914608 in start_thread /build/glibc-e2p3jK/glibc-2.31/nptl/pthread_create.c:477:8
|
#22 0x7fabf762a352 in clone /build/glibc-e2p3jK/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
|
|
Address 0x7fabd2b5db61 is located in stack of thread T12 at offset 129 in frame
|
#0 0x15d540f in Item_func_conv::val_str(String*) /root/mariadb/sql/item_strfunc.cc:3919
|
|
|
This frame has 4 object(s):
|
[32, 40) 'endptr' (line 3922)
|
[64, 129) 'ans' (line 3922) <== Memory access at offset 129 overflows this variable
|
[176, 180) 'err' (line 3926)
|
[192, 196) 'dummy_errors' (line 3959)
|
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
|
(longjmp and C++ exceptions *are* supported)
|
Thread T12 created by T0 here:
|
#0 0x8161fc in pthread_create (/root/bin_original/usr/local/mysql/bin/mariadbd+0x8161fc)
|
#1 0x1b26a9d in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/storage/perfschema/my_thread.h:52:10
|
#2 0x1b26a9d in pfs_spawn_thread_v1 /root/mariadb/storage/perfschema/pfs.cc:2252:15
|
#3 0x871689 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/include/mysql/psi/mysql_thread.h:1139:11
|
#4 0x871689 in create_thread_to_handle_connection(CONNECT*) /root/mariadb/sql/mysqld.cc:6074:19
|
#5 0x872518 in create_new_thread(CONNECT*) /root/mariadb/sql/mysqld.cc:6136:3
|
#6 0x872518 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /root/mariadb/sql/mysqld.cc:6198:5
|
#7 0x86f988 in handle_connections_sockets() /root/mariadb/sql/mysqld.cc:6311:9
|
#8 0x86714a in mysqld_main(int, char**) /root/mariadb/sql/mysqld.cc:5969:3
|
#9 0x7fabf752f082 in __libc_start_main /build/glibc-e2p3jK/glibc-2.31/csu/../csu/libc-start.c:308:16
|
|
|
SUMMARY: AddressSanitizer: stack-buffer-overflow /root/mariadb/strings/int2str.c:129:18 in int2str
|
Shadow bytes around the buggy address:
|
0x0ff5fa563b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563b30: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00
|
0x0ff5fa563b40: 01 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
|
0x0ff5fa563b50: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
|
=>0x0ff5fa563b60: 00 f2 f2 f2 00 00 00 00 00 00 00 00[01]f2 f2 f2
|
0x0ff5fa563b70: f2 f2 04 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00
|
0x0ff5fa563b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563b90: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
|
0x0ff5fa563ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1873==ABORTING
|
Attachments
Issue Links
- duplicates
-
-
- Closed
-
- relates to
-
-
- Closed
-
Activity
| Field | Original Value | New Value |
|---|---|---|
| Link |
This issue relates to |
| Link |
This issue duplicates |
| Component/s | N/A [ 14411 ] | |
| Fix Version/s | N/A [ 14700 ] | |
| Resolution | Duplicate [ 3 ] | |
| Status | Open [ 1 ] | Closed [ 6 ] |
Thanks! This is the same bug as
MDEV-32755, I will add the test case there:Version: '11.2.4-MariaDB-debug-log'===================================================================3002864==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f69611a4631 at pc 0x559933784394 bp 0x7f69611a43d0 sp 0x7f69611a43c0WRITE of size 1 at 0x7f69611a4631 thread T11#0 0x559933784393 in int2str /11.2/src/strings/int2str.c:122#1 0x559932442827 in Item_func_conv::val_str(String*) /11.2/src/sql/item_strfunc.cc:3845#2 0x559931fd9e5f in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /11.2/src/sql/sql_type.cc:7570#3 0x559931d54cfb in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /11.2/src/sql/sql_type.h:5523#4 0x55993151a38d in Item::send(Protocol*, st_value*) /11.2/src/sql/item.h:1254#5 0x5599315dbcea in Protocol::send_result_set_row(List<Item>*) /11.2/src/sql/protocol.cc:1333#6 0x559931782cbd in select_send::send_data(List<Item>&) /11.2/src/sql/sql_class.cc:3134#7 0x559931ac1918 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_class.h:5914#8 0x5599319e65b6 in JOIN::exec_inner() /11.2/src/sql/sql_select.cc:4859#9 0x5599319e509d in JOIN::exec() /11.2/src/sql/sql_select.cc:4770#10 0x5599319e9908 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /11.2/src/sql/sql_select.cc:5308#11 0x5599319b8419 in handle_select(THD*, LEX*, select_result*, unsigned long long) /11.2/src/sql/sql_select.cc:628#12 0x5599318d9801 in execute_sqlcom_select /11.2/src/sql/sql_parse.cc:6153#13 0x5599318c9f2b in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3976#14 0x5599318e471d in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7896#15 0x5599318bc275 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893#16 0x5599318b8fbf in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406#17 0x559931d9db44 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1437#18 0x559931d9d4a1 in handle_one_connection /11.2/src/sql/sql_connect.cc:1339#19 0x559932a0ee1b in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201#20 0x7f6971629608 in start_thread /build/glibc-e2p3jK/glibc-2.31/nptl/pthread_create.c:477#21 0x7f69711fa352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352)Address 0x7f69611a4631 is located in stack of thread T11 at offset 177 in frame#0 0x559932441e1b in Item_func_conv::val_str(String*) /11.2/src/sql/item_strfunc.cc:3804This frame has 4 object(s):[48, 52) 'err' (line 3811)[64, 68) 'dummy_errors' (line 3844)[80, 88) 'endptr' (line 3807)[112, 177) 'ans' (line 3807) <== Memory access at offset 177 overflows this variableHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork(longjmp and C++ exceptions *are* supported)Thread T11 created by T0 here:#0 0x7f6971ae4815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208#1 0x559932a0a9f8 in my_thread_create /11.2/src/storage/perfschema/my_thread.h:52#2 0x559932a0f20e in pfs_spawn_thread_v1 /11.2/src/storage/perfschema/pfs.cc:2252#3 0x5599314f0117 in inline_mysql_thread_create /11.2/src/include/mysql/psi/mysql_thread.h:1139#4 0x5599315088fb in create_thread_to_handle_connection(CONNECT*) /11.2/src/sql/mysqld.cc:6200#5 0x559931508f8b in create_new_thread(CONNECT*) /11.2/src/sql/mysqld.cc:6262#6 0x5599315092f8 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.2/src/sql/mysqld.cc:6324#7 0x559931509cee in handle_connections_sockets() /11.2/src/sql/mysqld.cc:6448#8 0x559931508108 in mysqld_main(int, char**) /11.2/src/sql/mysqld.cc:6095#9 0x5599314ef13c in main /11.2/src/sql/main.cc:34#10 0x7f69710ff082 in __libc_start_main ../csu/libc-start.c:308SUMMARY: AddressSanitizer: stack-buffer-overflow /11.2/src/strings/int2str.c:122 in int2strShadow bytes around the buggy address:0x0fedac22c870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c880: 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00 000x0fedac22c890: 00 00 00 00 00 00 01 f3 f3 f3 f3 f3 00 00 00 000x0fedac22c8a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c8b0: f1 f1 f1 f1 f1 f1 04 f2 00 00 00 f2 f2 f2 00 00=>0x0fedac22c8c0: 00 00 00 00 00 00[01]f3 f3 f3 f3 f3 00 00 00 000x0fedac22c8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c8f0: 00 00 f1 f1 f1 f1 00 00 00 00 f2 f2 f2 f2 00 000x0fedac22c900: 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 000x0fedac22c910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Shadow byte legend (one shadow byte represents 8 application bytes):Addressable: 00Partially addressable: 01 02 03 04 05 06 07Heap left redzone: faFreed heap region: fdStack left redzone: f1Stack mid redzone: f2Stack right redzone: f3Stack after return: f5Stack use after scope: f8Global redzone: f9Global init order: f6Poisoned by user: f7Container overflow: fcArray cookie: acIntra object redzone: bbASan internal: feLeft alloca redzone: caRight alloca redzone: cbShadow gap: cc==3002864==ABORTING