Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34405

LSAN: memory leaks in sp_add_used_routine upon double view creation with missing user

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.11, 11.1(EOL), 11.2(EOL), 11.4, 11.5(EOL)
    • 10.11, 11.4
    • Stored routines

    Description

      SET GLOBAL log_bin_trust_function_creators=1;
      CREATE FUNCTION f (c INT) RETURNS INT MODIFIES SQL DATA RETURN CONCAT ('1','2');
      RENAME USER current_user TO '';
      CREATE VIEW v AS SELECT f();
      CREATE VIEW v AS WITH q(foo,bar) AS (SELECT * FROM v) SELECT * FROM q;
      SHUTDOWN;
      

      Leads to:

      11.5.0 e4afa610539ae01164485554e2de839bea9de816 (Optimized, UBASAN)

      2024-06-15 15:44:39 0 [Note] /test/UBASAN_MD250524-mariadb-11.5.0-linux-x86_64-opt/bin/mariadbd: Shutdown complete
       
      Warning: Memory not freed: 280
       
      =================================================================
      ==2064173==ERROR: LeakSanitizer: detected memory leaks
       
      Direct leak of 280 byte(s) in 1 object(s) allocated from:
          #0 0x55935f94ec17 in __interceptor_malloc (/test/UBASAN_MD250524-mariadb-11.5.0-linux-x86_64-opt/bin/mariadbd+0x7ec6c17)
          #1 0x559363f4e234 in my_malloc /test/11.5_opt_san/mysys/my_malloc.c:93
          #2 0x559363ecde0e in init_dynamic_array2 /test/11.5_opt_san/mysys/array.c:73
          #3 0x5593626d76b3 in sp_add_used_routine(Query_tables_list*, Query_arena*, MDL_key const*, Sp_handler const*, TABLE_LIST*) /test/11.5_opt_san/sql/sp.cc:2358
          #4 0x5593626dcba9 in Sp_handler::add_used_routine(Query_tables_list*, Query_arena*, Database_qualified_name const*) const /test/11.5_opt_san/sql/sp.cc:2673
          #5 0x559361cb3f56 in Create_sp_func::create_with_db(THD*, Lex_ident_db_normalized const&, Lex_ident_routine const&, bool, List<Item>*) /test/11.5_opt_san/sql/item_create.cc:3007
          #6 0x559361c66d35 in Create_qfunc::create_func(THD*, st_mysql_const_lex_string const*, List<Item>*) /test/11.5_opt_san/sql/item_create.cc:2854
          #7 0x559361441d62 in MYSQLparse(THD*) /test/11.5_opt_san/sql/sql_yacc.yy:10712
          #8 0x559360212794 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /test/11.5_opt_san/sql/sql_parse.cc:10168
          #9 0x5593609de6f8 in mysql_make_view(THD*, TABLE_SHARE*, TABLE_LIST*, bool) /test/11.5_opt_san/sql/sql_view.cc:1495
          #10 0x55935fdedd3a in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.5_opt_san/sql/sql_base.cc:2141
          #11 0x55935fe04a59 in open_and_process_table /test/11.5_opt_san/sql/sql_base.cc:4165
          #12 0x55935fe04a59 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.5_opt_san/sql/sql_base.cc:4651
          #13 0x55935fe08e2c in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.5_opt_san/sql/sql_base.cc:5625
          #14 0x5593609cafc5 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/11.5_opt_san/sql/sql_base.h:530
          #15 0x5593609cafc5 in mysql_create_view(THD*, TABLE_LIST*, enum_view_create_mode) /test/11.5_opt_san/sql/sql_view.cc:467
          #16 0x559360221dd2 in mysql_execute_command(THD*, bool) /test/11.5_opt_san/sql/sql_parse.cc:5610
          #17 0x55936023a382 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.5_opt_san/sql/sql_parse.cc:7815
          #18 0x559360245853 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.5_opt_san/sql/sql_parse.cc:1892
          #19 0x559360252428 in do_command(THD*, bool) /test/11.5_opt_san/sql/sql_parse.cc:1405
          #20 0x559360bca6fc in do_handle_one_connection(CONNECT*, bool) /test/11.5_opt_san/sql/sql_connect.cc:1445
          #21 0x559360bcccfc in handle_one_connection /test/11.5_opt_san/sql/sql_connect.cc:1347
          #22 0x14fdcfa97ad9 in start_thread nptl/pthread_create.c:444
       
      SUMMARY: AddressSanitizer: 280 byte(s) leaked in 1 allocation(s).
      

      Possibly the bug exists in earlier versions, but the current t/c SQL fails, more on this later.

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.