PoC:
SELECT CONV(-29223372036854775809, -10, 18446744073709551614);
|
ASAN report:
=================================================================
|
==1873==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fabd2b5db61 at pc 0x0000024a9f37 bp 0x7fabd2b5d990 sp 0x7fabd2b5d988
|
WRITE of size 1 at 0x7fabd2b5db61 thread T12
|
#0 0x24a9f36 in int2str /root/mariadb/strings/int2str.c:129:18
|
#1 0x15d5a06 in Item_func_conv::val_str(String*) /root/mariadb/sql/item_strfunc.cc:3960:14
|
#2 0x11831a9 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /root/mariadb/sql/sql_type.cc:7496:19
|
#3 0x90ea0a in Protocol::send_result_set_row(List<Item>*) /root/mariadb/sql/protocol.cc:1333:15
|
#4 0xa7584c in select_send::send_data(List<Item>&) /root/mariadb/sql/sql_class.cc:3187:17
|
#5 0xcb3d4d in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /root/mariadb/sql/sql_class.h:5995:12
|
#6 0xcb3d4d in JOIN::exec_inner() /root/mariadb/sql/sql_select.cc:4862:22
|
#7 0xcb1198 in JOIN::exec() /root/mariadb/sql/sql_select.cc:4774:8
|
#8 0xc527c7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /root/mariadb/sql/sql_select.cc:5304:21
|
#9 0xc51c68 in handle_select(THD*, LEX*, select_result*, unsigned long long) /root/mariadb/sql/sql_select.cc:630:10
|
#10 0xba71f1 in execute_sqlcom_select(THD*, TABLE_LIST*) /root/mariadb/sql/sql_parse.cc:6094:12
|
#11 0xb95e8b in mysql_execute_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:3943:12
|
#12 0xc22e52 in Prepared_statement::execute(String*, bool) /root/mariadb/sql/sql_prepare.cc:5076:14
|
#13 0xc1c93a in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /root/mariadb/sql/sql_prepare.cc:4461:10
|
#14 0xc1b646 in mysql_stmt_execute_common(THD*, unsigned long, unsigned char*, unsigned char*, unsigned long, bool, bool) /root/mariadb/sql/sql_prepare.cc:3368:11
|
#15 0xc1affe in mysqld_stmt_execute(THD*, char*, unsigned int) /root/mariadb/sql/sql_prepare.cc:3139:3
|
#16 0xb81a77 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /root/mariadb/sql/sql_parse.cc:1818:5
|
#17 0xb89c41 in do_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:1406:17
|
#18 0xf82df8 in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1437:11
|
#19 0xf82848 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1339:5
|
#20 0x1b267da in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3
|
#21 0x7fabf7914608 in start_thread /build/glibc-e2p3jK/glibc-2.31/nptl/pthread_create.c:477:8
|
#22 0x7fabf762a352 in clone /build/glibc-e2p3jK/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
|
Address 0x7fabd2b5db61 is located in stack of thread T12 at offset 129 in frame
|
#0 0x15d540f in Item_func_conv::val_str(String*) /root/mariadb/sql/item_strfunc.cc:3919
|
|
This frame has 4 object(s):
|
[32, 40) 'endptr' (line 3922)
|
[64, 129) 'ans' (line 3922) <== Memory access at offset 129 overflows this variable
|
[176, 180) 'err' (line 3926)
|
[192, 196) 'dummy_errors' (line 3959)
|
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
|
(longjmp and C++ exceptions *are* supported)
|
Thread T12 created by T0 here:
|
#0 0x8161fc in pthread_create (/root/bin_original/usr/local/mysql/bin/mariadbd+0x8161fc)
|
#1 0x1b26a9d in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/storage/perfschema/my_thread.h:52:10
|
#2 0x1b26a9d in pfs_spawn_thread_v1 /root/mariadb/storage/perfschema/pfs.cc:2252:15
|
#3 0x871689 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/include/mysql/psi/mysql_thread.h:1139:11
|
#4 0x871689 in create_thread_to_handle_connection(CONNECT*) /root/mariadb/sql/mysqld.cc:6074:19
|
#5 0x872518 in create_new_thread(CONNECT*) /root/mariadb/sql/mysqld.cc:6136:3
|
#6 0x872518 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /root/mariadb/sql/mysqld.cc:6198:5
|
#7 0x86f988 in handle_connections_sockets() /root/mariadb/sql/mysqld.cc:6311:9
|
#8 0x86714a in mysqld_main(int, char**) /root/mariadb/sql/mysqld.cc:5969:3
|
#9 0x7fabf752f082 in __libc_start_main /build/glibc-e2p3jK/glibc-2.31/csu/../csu/libc-start.c:308:16
|
|
SUMMARY: AddressSanitizer: stack-buffer-overflow /root/mariadb/strings/int2str.c:129:18 in int2str
|
Shadow bytes around the buggy address:
|
0x0ff5fa563b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563b30: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00
|
0x0ff5fa563b40: 01 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
|
0x0ff5fa563b50: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
|
=>0x0ff5fa563b60: 00 f2 f2 f2 00 00 00 00 00 00 00 00[01]f2 f2 f2
|
0x0ff5fa563b70: f2 f2 04 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00
|
0x0ff5fa563b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563b90: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
|
0x0ff5fa563ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0ff5fa563bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1873==ABORTING
|
{"report":{"fcp":880,"ttfb":206.89999997615814,"pageVisibility":"visible","entityId":128960,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":1,"journeyId":"bccdd0ab-4da6-4f78-8cf1-4959aa64b9e1","navigationType":0,"readyForUser":968,"redirectCount":0,"resourceLoadedEnd":802.1999999880791,"resourceLoadedStart":214.10000002384186,"resourceTiming":[{"duration":172.79999995231628,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2bv2/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":214.10000002384186,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":214.10000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":386.89999997615814,"responseStart":0,"secureConnectionStart":0},{"duration":172.89999997615814,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2bv2/820016/12ta74/2380add21a9a1006587582385952de73/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":214.30000001192093,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":214.30000001192093,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":387.19999998807907,"responseStart":0,"secureConnectionStart":0},{"duration":181.80000001192093,"initiatorType":"script","name":"https://jira.mariadb.org/s/e9b27a47da5fb0f74a35acd57e9847fb-CDN/lu2bv2/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":214.5,"connectEnd":214.5,"connectStart":214.5,"domainLookupEnd":214.5,"domainLookupStart":214.5,"fetchStart":214.5,"redirectEnd":0,"redirectStart":0,"requestStart":214.5,"responseEnd":396.30000001192093,"responseStart":396.30000001192093,"secureConnectionStart":214.5},{"duration":261.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/c32eb0da7ad9831253f8397e6cc26afd-CDN/lu2bv2/820016/12ta74/2380add21a9a1006587582385952de73/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":214.69999998807907,"connectEnd":214.69999998807907,"connectStart":214.69999998807907,"domainLookupEnd":214.69999998807907,"domainLookupStart":214.69999998807907,"fetchStart":214.69999998807907,"redirectEnd":0,"redirectStart":0,"requestStart":214.69999998807907,"responseEnd":476.19999998807907,"responseStart":476.10000002384186,"secureConnectionStart":214.69999998807907},{"duration":265.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/bc0bcb146314416123c992714ee00ff7-CDN/lu2bv2/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":214.80000001192093,"connectEnd":214.80000001192093,"connectStart":214.80000001192093,"domainLookupEnd":214.80000001192093,"domainLookupStart":214.80000001192093,"fetchStart":214.80000001192093,"redirectEnd":0,"redirectStart":0,"requestStart":214.80000001192093,"responseEnd":480.30000001192093,"responseStart":480.30000001192093,"secureConnectionStart":214.80000001192093},{"duration":265.69999998807907,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bv2/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":215.10000002384186,"connectEnd":215.10000002384186,"connectStart":215.10000002384186,"domainLookupEnd":215.10000002384186,"domainLookupStart":215.10000002384186,"fetchStart":215.10000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":215.10000002384186,"responseEnd":480.80000001192093,"responseStart":480.80000001192093,"secureConnectionStart":215.10000002384186},{"duration":266,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bv2/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":215.19999998807907,"connectEnd":215.19999998807907,"connectStart":215.19999998807907,"domainLookupEnd":215.19999998807907,"domainLookupStart":215.19999998807907,"fetchStart":215.19999998807907,"redirectEnd":0,"redirectStart":0,"requestStart":215.19999998807907,"responseEnd":481.19999998807907,"responseStart":481.19999998807907,"secureConnectionStart":215.19999998807907},{"duration":322.2000000476837,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2bv2/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":215.39999997615814,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":215.39999997615814,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":537.6000000238419,"responseStart":0,"secureConnectionStart":0},{"duration":266,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":215.69999998807907,"connectEnd":215.69999998807907,"connectStart":215.69999998807907,"domainLookupEnd":215.69999998807907,"domainLookupStart":215.69999998807907,"fetchStart":215.69999998807907,"redirectEnd":0,"redirectStart":0,"requestStart":215.69999998807907,"responseEnd":481.69999998807907,"responseStart":481.69999998807907,"secureConnectionStart":215.69999998807907},{"duration":321.89999997615814,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2bv2/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":215.80000001192093,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":215.80000001192093,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":537.6999999880791,"responseStart":0,"secureConnectionStart":0},{"duration":266.30000001192093,"initiatorType":"script","name":"https://jira.mariadb.org/s/719848dd97ebe0663199f49a3936487a-CDN/lu2bv2/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":216,"connectEnd":216,"connectStart":216,"domainLookupEnd":216,"domainLookupStart":216,"fetchStart":216,"redirectEnd":0,"redirectStart":0,"requestStart":216,"responseEnd":482.30000001192093,"responseStart":482.30000001192093,"secureConnectionStart":216},{"duration":368.69999998807907,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bv2/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":221.69999998807907,"connectEnd":221.69999998807907,"connectStart":221.69999998807907,"domainLookupEnd":221.69999998807907,"domainLookupStart":221.69999998807907,"fetchStart":221.69999998807907,"redirectEnd":0,"redirectStart":0,"requestStart":221.69999998807907,"responseEnd":590.3999999761581,"responseStart":590.3999999761581,"secureConnectionStart":221.69999998807907},{"duration":362.69999998807907,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bv2/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":228.19999998807907,"connectEnd":228.19999998807907,"connectStart":228.19999998807907,"domainLookupEnd":228.19999998807907,"domainLookupStart":228.19999998807907,"fetchStart":228.19999998807907,"redirectEnd":0,"redirectStart":0,"requestStart":228.19999998807907,"responseEnd":590.8999999761581,"responseStart":590.8999999761581,"secureConnectionStart":228.19999998807907},{"duration":26.30000001192093,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":564.8999999761581,"connectEnd":564.8999999761581,"connectStart":564.8999999761581,"domainLookupEnd":564.8999999761581,"domainLookupStart":564.8999999761581,"fetchStart":564.8999999761581,"redirectEnd":0,"redirectStart":0,"requestStart":564.8999999761581,"responseEnd":591.1999999880791,"responseStart":591.1999999880791,"secureConnectionStart":564.8999999761581},{"duration":207.69999998807907,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2bv2/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":594.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":594.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":802.1999999880791,"responseStart":0,"secureConnectionStart":0}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":31,"responseStart":207,"responseEnd":228,"domLoading":212,"domInteractive":1037,"domContentLoadedEventStart":1037,"domContentLoadedEventEnd":1097,"domComplete":1240,"loadEventStart":1240,"loadEventEnd":1240,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1011.5},{"name":"bigPipe.sidebar-id.end","time":1012.1999999880791},{"name":"bigPipe.activity-panel-pipe-id.start","time":1012.3000000119209},{"name":"bigPipe.activity-panel-pipe-id.end","time":1015.1999999880791},{"name":"activityTabFullyLoaded","time":1111.199999988079}],"measures":[],"correlationId":"82d8324fb0d6cb","effectiveType":"4g","downlink":9.6,"rtt":0,"serverDuration":106,"dbReadsTimeInMs":13,"dbConnsTimeInMs":22,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
Bug
Major
Thanks! This is the same bug as
MDEV-32755, I will add the test case there:Version: '11.2.4-MariaDB-debug-log'===================================================================3002864==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f69611a4631 at pc 0x559933784394 bp 0x7f69611a43d0 sp 0x7f69611a43c0WRITE of size 1 at 0x7f69611a4631 thread T11#0 0x559933784393 in int2str /11.2/src/strings/int2str.c:122#1 0x559932442827 in Item_func_conv::val_str(String*) /11.2/src/sql/item_strfunc.cc:3845#2 0x559931fd9e5f in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /11.2/src/sql/sql_type.cc:7570#3 0x559931d54cfb in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /11.2/src/sql/sql_type.h:5523#4 0x55993151a38d in Item::send(Protocol*, st_value*) /11.2/src/sql/item.h:1254#5 0x5599315dbcea in Protocol::send_result_set_row(List<Item>*) /11.2/src/sql/protocol.cc:1333#6 0x559931782cbd in select_send::send_data(List<Item>&) /11.2/src/sql/sql_class.cc:3134#7 0x559931ac1918 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_class.h:5914#8 0x5599319e65b6 in JOIN::exec_inner() /11.2/src/sql/sql_select.cc:4859#9 0x5599319e509d in JOIN::exec() /11.2/src/sql/sql_select.cc:4770#10 0x5599319e9908 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /11.2/src/sql/sql_select.cc:5308#11 0x5599319b8419 in handle_select(THD*, LEX*, select_result*, unsigned long long) /11.2/src/sql/sql_select.cc:628#12 0x5599318d9801 in execute_sqlcom_select /11.2/src/sql/sql_parse.cc:6153#13 0x5599318c9f2b in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3976#14 0x5599318e471d in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7896#15 0x5599318bc275 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893#16 0x5599318b8fbf in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406#17 0x559931d9db44 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1437#18 0x559931d9d4a1 in handle_one_connection /11.2/src/sql/sql_connect.cc:1339#19 0x559932a0ee1b in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201#20 0x7f6971629608 in start_thread /build/glibc-e2p3jK/glibc-2.31/nptl/pthread_create.c:477#21 0x7f69711fa352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352)Address 0x7f69611a4631 is located in stack of thread T11 at offset 177 in frame#0 0x559932441e1b in Item_func_conv::val_str(String*) /11.2/src/sql/item_strfunc.cc:3804This frame has 4 object(s):[48, 52) 'err' (line 3811)[64, 68) 'dummy_errors' (line 3844)[80, 88) 'endptr' (line 3807)[112, 177) 'ans' (line 3807) <== Memory access at offset 177 overflows this variableHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork(longjmp and C++ exceptions *are* supported)Thread T11 created by T0 here:#0 0x7f6971ae4815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208#1 0x559932a0a9f8 in my_thread_create /11.2/src/storage/perfschema/my_thread.h:52#2 0x559932a0f20e in pfs_spawn_thread_v1 /11.2/src/storage/perfschema/pfs.cc:2252#3 0x5599314f0117 in inline_mysql_thread_create /11.2/src/include/mysql/psi/mysql_thread.h:1139#4 0x5599315088fb in create_thread_to_handle_connection(CONNECT*) /11.2/src/sql/mysqld.cc:6200#5 0x559931508f8b in create_new_thread(CONNECT*) /11.2/src/sql/mysqld.cc:6262#6 0x5599315092f8 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.2/src/sql/mysqld.cc:6324#7 0x559931509cee in handle_connections_sockets() /11.2/src/sql/mysqld.cc:6448#8 0x559931508108 in mysqld_main(int, char**) /11.2/src/sql/mysqld.cc:6095#9 0x5599314ef13c in main /11.2/src/sql/main.cc:34#10 0x7f69710ff082 in __libc_start_main ../csu/libc-start.c:308SUMMARY: AddressSanitizer: stack-buffer-overflow /11.2/src/strings/int2str.c:122 in int2strShadow bytes around the buggy address:0x0fedac22c870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c880: 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00 000x0fedac22c890: 00 00 00 00 00 00 01 f3 f3 f3 f3 f3 00 00 00 000x0fedac22c8a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c8b0: f1 f1 f1 f1 f1 f1 04 f2 00 00 00 f2 f2 f2 00 00=>0x0fedac22c8c0: 00 00 00 00 00 00[01]f3 f3 f3 f3 f3 00 00 00 000x0fedac22c8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000x0fedac22c8f0: 00 00 f1 f1 f1 f1 00 00 00 00 f2 f2 f2 f2 00 000x0fedac22c900: 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 000x0fedac22c910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Shadow byte legend (one shadow byte represents 8 application bytes):Addressable: 00Partially addressable: 01 02 03 04 05 06 07Heap left redzone: faFreed heap region: fdStack left redzone: f1Stack mid redzone: f2Stack right redzone: f3Stack after return: f5Stack use after scope: f8Global redzone: f9Global init order: f6Poisoned by user: f7Container overflow: fcArray cookie: acIntra object redzone: bbASan internal: feLeft alloca redzone: caRight alloca redzone: cbShadow gap: cc==3002864==ABORTING