SIGSEGV in server_mysql_real_connect, spider_db_connect, __strcmp_evex and __strnlen_evex, ASAN heap-use-after-free in spider_db_connect on INSERT

$ git branch -r --contain '696c2497fccc320b1f306758cdf6b24c97669509' | grep '11.4'

  origin/11.4

...

SET sql_mode='';

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

SET optimizer_trace=1;

CREATE TABLE t1 (c INT, PRIMARY KEY(c)) ENGINE=Spider;

CREATE TABLE t2 (c INT) ENGINE=Spider;

XA START 'a';

SELECT * FROM t2;

SET GLOBAL table_open_cache=10;

INSERT INTO t1 VALUES (0);

INSERT INTO t2 VALUES (0);

SELECT SLEEP(3);

INSERT INTO t1 VALUES (0);  # Repeat if needed to produce crash

Core was generated by `/test/MD310824-mariadb-11.4.4-linux-x86_64-opt/bin/mariadbd --no-defaults --bas'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x00005597a7ffbf4c in server_mysql_real_connect (mysql=0x150c500632a8, host=0x150c500bdf28 "0y\001P\f\025", user=0xe <error: Cannot access memory at address 0xe>, passwd=0x0, db=0x0, port=3306, unix_socket=0x150c500b4d58 "/tmp/mysql.sock", client_flag=65536)at /test/11.4_opt/sql-common/client.c:2745

2745	  if (!user || !user[0])

[Current thread is 1 (LWP 2135149)]

(gdb) bt

#0  0x00005597a7ffbf4c in server_mysql_real_connect (mysql=0x150c500632a8, host=0x150c500bdf28 "0y\001P\f\025", user=0xe <error: Cannot access memory at address 0xe>, passwd=0x0, db=0x0, port=3306, unix_socket=0x150c500b4d58 "/tmp/mysql.sock", client_flag=65536)at /test/11.4_opt/sql-common/client.c:2745

#1  0x0000150ca8116d43 in spider_db_mbase::connect (this=0x150c50016740, tgt_host=0x150c500bdf28 "0y\001P\f\025", tgt_username=0xe <error: Cannot access memory at address 0xe>, tgt_password=0x0, tgt_port=3306, tgt_socket=0x150c500b4d58 "/tmp/mysql.sock", server_name=0x5 <error: Cannot access memory at address 0x5>, connect_retry_count=1000, connect_retry_interval=1000)at /test/11.4_opt/storage/spider/spd_db_mysql.cc:1962

#2  0x0000150ca80aaccb in spider_db_connect (share=0x150c50157628, conn=conn@entry=0x150c50086a38, link_idx=0)at /test/11.4_opt/storage/spider/spd_db_conn.cc:143

#3  0x0000150ca80ab835 in spider_db_conn_queue_action (conn=conn@entry=0x150c50086a38)at /test/11.4_opt/storage/spider/spd_db_conn.cc:256

#4  0x0000150ca80b19d0 in spider_db_before_query (conn=0x150c50086a38, need_mon=<optimized out>)at /test/11.4_opt/storage/spider/spd_db_conn.cc:571

#5  0x0000150ca80b1bd2 in spider_db_set_names_internal (trx=0x150c5024db38, share=0x150c500d6a78, conn=conn@entry=0x150c50086a38, all_link_idx=0, need_mon=0x5597abc523b8)at /test/11.4_opt/storage/spider/spd_db_conn.cc:799

#6  0x0000150ca80b1d89 in spider_db_set_names (spider=spider@entry=0x150c5009e850, conn=conn@entry=0x150c50086a38, link_idx=link_idx@entry=0)at /test/11.4_opt/storage/spider/spd_db_conn.cc:842

#7  0x0000150ca80b5ab2 in spider_db_bulk_insert (spider=spider@entry=0x150c5009e850, table=0x150c500826f8, copy_info=copy_info@entry=0x150c5009ec90, bulk_end=bulk_end@entry=false)at /test/11.4_opt/storage/spider/spd_db_conn.cc:5439

#8  0x0000150ca810b7b9 in ha_spider::write_row (this=0x150c5009e850, buf=0x150c5005afb8 "\377")at /test/11.4_opt/storage/spider/ha_spider.cc:7842

#9  0x00005597a8036f5f in handler::ha_write_row (this=0x150c5009e850, buf=0x150c5005afb8 "\377") at /test/11.4_opt/sql/handler.cc:7962

#10 0x00005597a7d5918d in write_record (thd=thd@entry=0x150c50000c68, table=table@entry=0x150c500826f8, info=info@entry=0x150ca81b2990, sink=sink@entry=0x0) at /test/11.4_opt/sql/sql_insert.cc:2299

#11 0x00005597a7d62c86 in mysql_insert (thd=thd@entry=0x150c50000c68, table_list=0x150c50017f70, fields=@0x150c50005e78: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5597a91b1290 <end_of_list>, last = 0x150c50005e78, elements = 0}, <No data fields>}, values_list=@0x150c50005ec0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150c50018bf8, last = 0x150c50018bf8, elements = 1}, <No data fields>}, update_fields=@0x150c50005ea8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5597a91b1290 <end_of_list>, last = 0x150c50005ea8, elements = 0}, <No data fields>}, update_values=@0x150c50005e90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5597a91b1290 <end_of_list>, last = 0x150c50005e90, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=<optimized out>, result=0x0)at /test/11.4_opt/sql/sql_insert.cc:1167

#12 0x00005597a7d97d62 in mysql_execute_command (thd=thd@entry=0x150c50000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.4_opt/sql/sql_parse.cc:4456

#13 0x00005597a7d9c26e in mysql_parse (thd=0x150c50000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.4_opt/sql/sql_parse.cc:7871

#14 0x00005597a7d9ec35 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150c50000c68, packet=packet@entry=0x150c500087f9 "INSERT INTO t1 VALUES (0);", packet_length=packet_length@entry=26, blocking=blocking@entry=true)at /test/11.4_opt/sql/sql_parse.cc:1993

#15 0x00005597a7da08bd in do_command (thd=0x150c50000c68, blocking=blocking@entry=true) at /test/11.4_opt/sql/sql_parse.cc:1407

#16 0x00005597a7ed54df in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5597abc09678, put_in_cache=put_in_cache@entry=true)at /test/11.4_opt/sql/sql_connect.cc:1439

#17 0x00005597a7ed584d in handle_one_connection (arg=arg@entry=0x5597abc09678)at /test/11.4_opt/sql/sql_connect.cc:1341

#18 0x00005597a829a883 in pfs_spawn_thread (arg=0x5597abc0ca68)at /test/11.4_opt/storage/perfschema/pfs.cc:2201

#19 0x0000150caa29ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#20 0x0000150caa329c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Core was generated by `/test/MD310824-mariadb-11.4.4-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGSEGV, Segmentation fault.

Download failed: Invalid argument.  Continuing without source file ./string/../sysdeps/x86_64/multiarch/strcmp-evex.S.

#0  __strcmp_evex () at ../sysdeps/x86_64/multiarch/strcmp-evex.S:314

[Current thread is 1 (LWP 426995)]

(gdb) bt

#0  __strcmp_evex () at ../sysdeps/x86_64/multiarch/strcmp-evex.S:314

#1  0x00001509f46cbccc in spider_db_mbase::connect (this=0x150998016740, tgt_host=0x9 <error: Cannot access memory at address 0x9>, tgt_username=0xe <error: Cannot access memory at address 0xe>, tgt_password=0x5 <error: Cannot access memory at address 0x5>, tgt_port=3306, tgt_socket=0x1509980a0208 "/tmp/mysql.sock", server_name=0x0, connect_retry_count=1000, connect_retry_interval=1000)at /test/11.4_opt/storage/spider/spd_db_mysql.cc:1935

#2  0x00001509f465fccb in spider_db_connect (share=0x15099804f6b8, conn=conn@entry=0x1509980663e8, link_idx=0)at /test/11.4_opt/storage/spider/spd_db_conn.cc:143

#3  0x00001509f4660835 in spider_db_conn_queue_action (conn=conn@entry=0x1509980663e8)at /test/11.4_opt/storage/spider/spd_db_conn.cc:256

#4  0x00001509f46669d0 in spider_db_before_query (conn=0x1509980663e8, need_mon=<optimized out>)at /test/11.4_opt/storage/spider/spd_db_conn.cc:571

#5  0x00001509f4666bd2 in spider_db_set_names_internal (trx=0x1509980cd258, share=0x1509980ac668, conn=conn@entry=0x1509980663e8, all_link_idx=0, need_mon=0x564f0fad95b8)at /test/11.4_opt/storage/spider/spd_db_conn.cc:799

#6  0x00001509f4666d89 in spider_db_set_names (spider=spider@entry=0x150998047190, conn=conn@entry=0x1509980663e8, link_idx=link_idx@entry=0)at /test/11.4_opt/storage/spider/spd_db_conn.cc:842

#7  0x00001509f466aab2 in spider_db_bulk_insert (spider=spider@entry=0x150998047190, table=0x1509980a32c8, copy_info=copy_info@entry=0x1509980475d0, bulk_end=bulk_end@entry=false)at /test/11.4_opt/storage/spider/spd_db_conn.cc:5439

#8  0x00001509f46c07b9 in ha_spider::write_row (this=0x150998047190, buf=0x15099804e248 "\377")at /test/11.4_opt/storage/spider/ha_spider.cc:7842

#9  0x0000564f0ba03f5f in handler::ha_write_row (this=0x150998047190, buf=0x15099804e248 "\377") at /test/11.4_opt/sql/handler.cc:7962

#10 0x0000564f0b72618d in write_record (thd=thd@entry=0x150998000c68, table=table@entry=0x1509980a32c8, info=info@entry=0x1509f4767990, sink=sink@entry=0x0) at /test/11.4_opt/sql/sql_insert.cc:2299

#11 0x0000564f0b72fc86 in mysql_insert (thd=thd@entry=0x150998000c68, table_list=0x150998017f70, fields=@0x150998005e78: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x564f0cb7e290 <end_of_list>, last = 0x150998005e78, elements = 0}, <No data fields>}, values_list=@0x150998005ec0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150998018bf8, last = 0x150998018bf8, elements = 1}, <No data fields>}, update_fields=@0x150998005ea8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x564f0cb7e290 <end_of_list>, last = 0x150998005ea8, elements = 0}, <No data fields>}, update_values=@0x150998005e90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x564f0cb7e290 <end_of_list>, last = 0x150998005e90, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=<optimized out>, result=0x0)at /test/11.4_opt/sql/sql_insert.cc:1167

#12 0x0000564f0b764d62 in mysql_execute_command (thd=thd@entry=0x150998000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.4_opt/sql/sql_parse.cc:4456

#13 0x0000564f0b76926e in mysql_parse (thd=0x150998000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.4_opt/sql/sql_parse.cc:7871

#14 0x0000564f0b76bc35 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150998000c68, packet=packet@entry=0x1509980087f9 "INSERT INTO t1 VALUES (0)", packet_length=packet_length@entry=25, blocking=blocking@entry=true)at /test/11.4_opt/sql/sql_parse.cc:1993

#15 0x0000564f0b76d8bd in do_command (thd=0x150998000c68, blocking=blocking@entry=true) at /test/11.4_opt/sql/sql_parse.cc:1407

#16 0x0000564f0b8a24df in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564f0fa77d08, put_in_cache=put_in_cache@entry=true)at /test/11.4_opt/sql/sql_connect.cc:1439

#17 0x0000564f0b8a284d in handle_one_connection (arg=arg@entry=0x564f0fa77d08)at /test/11.4_opt/sql/sql_connect.cc:1341

#18 0x0000564f0bc67883 in pfs_spawn_thread (arg=0x564f0fa9ded8)at /test/11.4_opt/storage/perfschema/pfs.cc:2201

#19 0x00001509f6e9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#20 0x00001509f6f29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Core was generated by `/test/MD310824-mariadb-11.4.4-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000014726bf27335 in spider_db_connect (share=0x147210061808, conn=conn@entry=0x1472101d00c8, link_idx=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:106

106	    conn->connect_timeout = spider_param_connect_timeout(thd,

[Current thread is 1 (LWP 1955317)]

(gdb) bt

#0  0x000014726bf27335 in spider_db_connect (share=0x147210061808, conn=conn@entry=0x1472101d00c8, link_idx=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:106

#1  0x000014726bf27b5c in spider_db_conn_queue_action (conn=conn@entry=0x1472101d00c8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:256

#2  0x000014726bf2ea8b in spider_db_before_query (conn=conn@entry=0x1472101d00c8, need_mon=need_mon@entry=0x1472100199a8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:571

#3  0x000014726bf2f0d9 in spider_db_set_names_internal (trx=0x1472103f5d88, share=0x14721031ebe8, conn=conn@entry=0x1472101d00c8, all_link_idx=0, need_mon=0x1472100199a8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:798

#4  0x000014726bf2f3fa in spider_db_set_names (spider=spider@entry=0x147210014ab0, conn=conn@entry=0x1472101d00c8, link_idx=link_idx@entry=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:842

#5  0x000014726bf35441 in spider_db_bulk_insert (spider=spider@entry=0x147210014ab0, table=0x14721005cb28, copy_info=copy_info@entry=0x147210014ef0, bulk_end=bulk_end@entry=false)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:5439

#6  0x000014726bf988c7 in ha_spider::write_row (this=0x147210014ab0, buf=0x147210054a88 "\377")at /test/11.4_dbg/storage/spider/ha_spider.cc:7842

#7  0x000055c9afa01e9f in handler::ha_write_row (this=0x147210014ab0, buf=0x147210054a88 "\377") at /test/11.4_dbg/sql/handler.cc:7962

#8  0x000055c9af695a20 in write_record (thd=thd@entry=0x147210000d58, table=table@entry=0x14721005cb28, info=info@entry=0x147270167a50, sink=sink@entry=0x0) at /test/11.4_dbg/sql/sql_insert.cc:2299

#9  0x000055c9af6a0692 in mysql_insert (thd=thd@entry=0x147210000d58, table_list=0x14721001aa40, fields=@0x147210006130: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55c9b0efe780 <end_of_list>, last = 0x147210006130, elements = 0}, <No data fields>}, values_list=@0x147210006178: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14721001b6c8, last = 0x14721001b6c8, elements = 1}, <No data fields>}, update_fields=@0x147210006160: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55c9b0efe780 <end_of_list>, last = 0x147210006160, elements = 0}, <No data fields>}, update_values=@0x147210006148: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55c9b0efe780 <end_of_list>, last = 0x147210006148, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0)at /test/11.4_dbg/sql/sql_insert.cc:1167

#10 0x000055c9af6dc94e in mysql_execute_command (thd=thd@entry=0x147210000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.4_dbg/sql/sql_parse.cc:4456

#11 0x000055c9af6e1bff in mysql_parse (thd=thd@entry=0x147210000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1472701682a0)at /test/11.4_dbg/sql/sql_parse.cc:7871

#12 0x000055c9af6e4096 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x147210000d58, packet=packet@entry=0x14721000b2c9 "INSERT INTO t1 VALUES (0)", packet_length=packet_length@entry=25, blocking=blocking@entry=true)at /test/11.4_dbg/sql/sql_class.h:254

#13 0x000055c9af6e62c5 in do_command (thd=0x147210000d58, blocking=blocking@entry=true) at /test/11.4_dbg/sql/sql_parse.cc:1407

#14 0x000055c9af854984 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c9b3e8cfb8, put_in_cache=put_in_cache@entry=true)at /test/11.4_dbg/sql/sql_connect.cc:1439

#15 0x000055c9af854c84 in handle_one_connection (arg=arg@entry=0x55c9b3e8cfb8)at /test/11.4_dbg/sql/sql_connect.cc:1341

#16 0x000055c9afca3f10 in pfs_spawn_thread (arg=0x55c9b3e031d8)at /test/11.4_dbg/storage/perfschema/pfs.cc:2201

#17 0x000014727129ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#18 0x0000147271329c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78