Stack smashing in spider_db_mbase::xa_end (opt), ASAN: stack-buffer-overflow in Binary_string::q_append, and Assertion `str.alloced_length() >= str.length() + data_len' failed in spider_string::q_append on SELECT

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD '');

CREATE TABLE t (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';

ALTER TABLE t ENGINE=InnoDB;

SET NAMES utf8,@@collation_connection=utf16le_bin;

CREATE TABLE Ｔ４ (Ｃ１ CHAR(1)) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';

XA START 'xaaaaaaaaaaaaaaa1','xaaaaaaaaaaaaaaa2',1234567890;

SET NAMES cp932;

SELECT �b�P,SUBSTRING(�b�P,4) FROM �s�S;

2024-11-16 13:54:53 0 [Note] /test/MD141024-mariadb-11.2.6-linux-x86_64-opt/bin/mariadbd: ready for connections.

Version: '11.2.6-MariaDB'  socket: '/test/MD141024-mariadb-11.2.6-linux-x86_64-opt/socket.sock'  port: 10250  MariaDB Server

*** stack smashing detected ***: terminated

Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGABRT, Aborted.

Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1671278)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x000014e98004526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x000014e9800288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x000014e9800297b6 in __libc_message_impl (fmt=fmt@entry=0x14e9801ce765 "*** %s ***: terminated\n")at ../sysdeps/posix/libc_fatal.c:132

#6  0x000014e980136c19 in __GI___fortify_fail (msg=msg@entry=0x14e9801ce77d "stack smashing detected")at ./debug/fortify_fail.c:24

#7  0x000014e980137ea4 in __stack_chk_fail () at ./debug/stack_chk_fail.c:24

#8  0x000014e97d9ad429 in spider_db_mbase::xa_end (this=<optimized out>, xid=<optimized out>, need_mon=0x14e97dce0e8c)at /test/11.2_opt/storage/spider/spd_db_mysql.cc:2593

#9  0x000014e97d94cc08 in spider_db_xa_end (conn=conn@entry=0x14e92024a4f8, xid=xid@entry=0x14e920275280)at /test/11.2_opt/storage/spider/spd_db_conn.cc:1167

#10 0x000014e97d945492 in spider_internal_xa_rollback (thd=thd@entry=0x14e920000c68, trx=trx@entry=0x14e920275258)at /test/11.2_opt/storage/spider/spd_trx.cc:2089

#11 0x000014e97d94699b in spider_rollback (hton=<optimized out>, thd=0x14e920000c68, all=<optimized out>)at /test/11.2_opt/storage/spider/spd_trx.cc:3178

#12 0x000055b21a973608 in ha_rollback_trans (thd=thd@entry=0x14e920000c68, all=all@entry=true) at /test/11.2_opt/sql/handler.cc:2324

#13 0x000055b21a8f87fb in xa_trans_force_rollback (thd=thd@entry=0x14e920000c68) at /test/11.2_opt/sql/xa.cc:412

#14 0x000055b21a8f9ccd in trans_xa_detach (thd=thd@entry=0x14e920000c68)at /test/11.2_opt/sql/xa.cc:913

#15 0x000055b21a685422 in THD::cleanup (this=this@entry=0x14e920000c68)at /test/11.2_opt/sql/sql_class.cc:1601

#16 0x000055b21a5c7bd3 in unlink_thd (thd=0x14e920000c68)at /test/11.2_opt/sql/mysqld.cc:2868

#17 0x000055b21a822f21 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b21e990208, put_in_cache=put_in_cache@entry=true)at /test/11.2_opt/sql/sql_connect.cc:1450

#18 0x000055b21a8234fd in handle_one_connection (arg=arg@entry=0x55b21e990208)at /test/11.2_opt/sql/sql_connect.cc:1341

#19 0x000055b21abe0d03 in pfs_spawn_thread (arg=0x55b21e9d4da8)at /test/11.2_opt/storage/perfschema/pfs.cc:2201

#20 0x000014e98009ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#21 0x000014e980129c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

mariadbd: /test/11.2_dbg/storage/spider/spd_malloc.cc:1093: void spider_string::q_append(const char*, uint32): Assertion `str.alloced_length() >= str.length() + data_len' failed.

Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGABRT, Aborted.

Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1671242)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x0000154089e4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x0000154089e288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x0000154089e2881b in __assert_fail_base (fmt=0x154089fd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x15407d5d60a0 "str.alloced_length() >= str.length() + data_len", file=file@entry=0x15407d5d50c0 "/test/11.2_dbg/storage/spider/spd_malloc.cc", line=line@entry=1093, function=function@entry=0x15407d5d60d0 "void spider_string::q_append(const char*, uint32)") at ./assert/assert.c:94

#6  0x0000154089e3b507 in __assert_fail (assertion=0x15407d5d60a0 "str.alloced_length() >= str.length() + data_len", file=0x15407d5d50c0 "/test/11.2_dbg/storage/spider/spd_malloc.cc", line=1093, function=0x15407d5d60d0 "void spider_string::q_append(const char*, uint32)") at ./assert/assert.c:103

#7  0x000015407d590e1d in spider_string::q_append (this=this@entry=0x154083f67c40, data=data@entry=0x154083f67bed "1234567890", data_len=data_len@entry=10)at /test/11.2_dbg/storage/spider/spd_malloc.cc:1093

#8  0x000015407d5470b4 in spider_db_append_xid_str (tmp_str=tmp_str@entry=0x154083f67c40, xid=xid@entry=0x15402c1df4a0)at /test/11.2_dbg/storage/spider/spd_db_conn.cc:1151

#9  0x000015407d5ac099 in spider_db_mbase::xa_end (this=0x15402c257260, xid=0x15402c1df4a0, need_mon=0x154083f67d7c)at /test/11.2_dbg/storage/spider/spd_db_mysql.cc:2590

#10 0x000015407d54712c in spider_db_xa_end (conn=conn@entry=0x15402c0521b8, xid=xid@entry=0x15402c1df4a0)at /test/11.2_dbg/storage/spider/spd_db_conn.cc:1167

#11 0x000015407d53f91e in spider_internal_xa_rollback (thd=thd@entry=0x15402c000d58, trx=trx@entry=0x15402c1df478)at /test/11.2_dbg/storage/spider/spd_trx.cc:2089

#12 0x000015407d540a1e in spider_rollback (hton=<optimized out>, thd=0x15402c000d58, all=<optimized out>)at /test/11.2_dbg/storage/spider/spd_trx.cc:3178

#13 0x00005589911adc04 in ha_rollback_trans (thd=thd@entry=0x15402c000d58, all=all@entry=true) at /test/11.2_dbg/sql/handler.cc:2324

#14 0x000055899111b7aa in xa_trans_force_rollback (thd=thd@entry=0x15402c000d58) at /test/11.2_dbg/sql/xa.cc:412

#15 0x000055899111ce72 in trans_xa_detach (thd=thd@entry=0x15402c000d58)at /test/11.2_dbg/sql/xa.cc:913

#16 0x0000558990e32f19 in THD::cleanup (this=this@entry=0x15402c000d58)at /test/11.2_dbg/sql/sql_class.cc:1601

#17 0x0000558990d69718 in unlink_thd (thd=0x15402c000d58)at /test/11.2_dbg/sql/mysqld.cc:2868

#18 0x0000558991014046 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558994ec7608, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1450

#19 0x00005589910142ef in handle_one_connection (arg=arg@entry=0x558994ec7608)at /test/11.2_dbg/sql/sql_connect.cc:1341

#20 0x000055899145bf14 in pfs_spawn_thread (arg=0x558994e1a328)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201

#21 0x0000154089e9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#22 0x0000154089f29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==1676667==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x14b850eff8b8 at pc 0x55d93e6fb513 bp 0x14b850eff620 sp 0x14b850efedc8

WRITE of size 10 at 0x14b850eff8b8 thread T12

    #0 0x55d93e6fb512 in __interceptor_memcpy (/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd+0x849a512)

    #1 0x14b84fba892a in Binary_string::q_append(char const*, unsigned long) /test/11.7_opt_san/sql/sql_string.h:424

    #2 0x14b84fba892a in spider_string::q_append(char const*, unsigned int) /test/11.7_opt_san/storage/spider/spd_malloc.cc:1094

    #3 0x14b84fa0ed21 in spider_db_append_xid_str(spider_string*, xid_t*) /test/11.7_opt_san/storage/spider/spd_db_conn.cc:1151

    #4 0x14b84fcb52cc in spider_db_mbase::xa_end(xid_t*, int*) /test/11.7_opt_san/storage/spider/spd_db_mysql.cc:2590

    #5 0x14b84fa0f0cc in spider_db_xa_end(st_spider_conn*, xid_t*) /test/11.7_opt_san/storage/spider/spd_db_conn.cc:1167

    #6 0x14b84f9df72c in spider_internal_xa_rollback(THD*, st_spider_transaction*) /test/11.7_opt_san/storage/spider/spd_trx.cc:2089

    #7 0x14b84f9e621b in spider_rollback(handlerton*, THD*, bool) /test/11.7_opt_san/storage/spider/spd_trx.cc:3180

    #8 0x55d94090680e in ha_rollback_trans(THD*, bool) /test/11.7_opt_san/sql/handler.cc:2336

    #9 0x55d9403b4994 in xa_trans_force_rollback(THD*) /test/11.7_opt_san/sql/xa.cc:412

    #10 0x55d93ed9f2df in THD::cleanup() /test/11.7_opt_san/sql/sql_class.cc:1659

    #11 0x55d93e7cd52f in unlink_thd(THD*) /test/11.7_opt_san/sql/mysqld.cc:2865

    #12 0x55d93fb73542 in do_handle_one_connection(CONNECT*, bool) /test/11.7_opt_san/sql/sql_connect.cc:1459

    #13 0x55d93fb769b4 in handle_one_connection /test/11.7_opt_san/sql/sql_connect.cc:1350

    #14 0x14b87609ca93 in start_thread nptl/pthread_create.c:447

    #15 0x14b876129c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x14b850eff8b8 is located in stack of thread T12 at offset 312 in frame

    #0 0x14b84fcb519f in spider_db_mbase::xa_end(xid_t*, int*) /test/11.7_opt_san/storage/spider/spd_db_mysql.cc:2581

  This frame has 2 object(s):

    [32, 120) 'sql_str' (line 2583)

    [160, 312) 'sql_buf' (line 2582) <== Memory access at offset 312 overflows this variable

HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork

      (longjmp and C++ exceptions *are* supported)

Thread T12 created by T0 here:

    #0 0x55d93e718fa5 in __interceptor_pthread_create (/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd+0x84b7fa5)

    #1 0x55d93e7cf2de in create_thread_to_handle_connection(CONNECT*) /test/11.7_opt_san/sql/mysqld.cc:6271

    #2 0x55d93e7e370f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.7_opt_san/sql/mysqld.cc:6395

    #3 0x55d93e7e47f7 in handle_connections_sockets() /test/11.7_opt_san/sql/mysqld.cc:6508

    #4 0x55d93e7e7a0c in mysqld_main(int, char**) /test/11.7_opt_san/sql/mysqld.cc:6166

    #5 0x14b87602a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    #6 0x14b87602a28a in __libc_start_main_impl ../csu/libc-start.c:360

    #7 0x55d93e6e5d64 in _start (/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd+0x8484d64)

SUMMARY: AddressSanitizer: stack-buffer-overflow (/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd+0x849a512) in __interceptor_memcpy

Shadow bytes around the buggy address:

  0x02978a1d7ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x02978a1d7ed0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 03 f3 f3

  0x02978a1d7ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x02978a1d7ef0: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 f2

  0x02978a1d7f00: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00

=>0x02978a1d7f10: 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3

  0x02978a1d7f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x02978a1d7f30: f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00

  0x02978a1d7f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x02978a1d7f50: 00 00 f1 f1 f1 f1 f1 f1 04 f2 00 f2 f2 f2 00 00

  0x02978a1d7f60: 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==1676667==ABORTING

241116 13:55:36 [ERROR] mysqld got signal 6 ;

Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 11.7.0-MariaDB source revision: 35cebfdc513f92b143b1a7229c480f4f684f1698

key_buffer_size=134217728

read_buffer_size=131072

max_used_connections=3

max_threads=10002

thread_count=5

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 22159669 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x52b00015e218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x14b850f00c10 thread_stack 0xb00000

2024-11-16 13:55:36 0 [Note] /test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd (initiated by: root[root] @ localhost []): Normal shutdown

asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x55d93e706e5e]

mysys/stacktrace.c:216(my_print_stacktrace)[0x55d94318ee87]

sql/signal_handler.cc:247(handle_fatal_signal)[0x55d9408eab17]

libc_sigaction.c:0(__restore_rt)[0x14b876045320]

nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14b87609eb1c]

posix/raise.c:27(__GI_raise)[0x14b87604526e]

stdlib/abort.c:81(__GI_abort)[0x14b8760288ff]

/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd(+0x8531f82)[0x55d93e792f82]

/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd(+0x853db3c)[0x55d93e79eb3c]

/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd(+0x851cfec)[0x55d93e77dfec]

/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd(+0x851c885)[0x55d93e77d885]

/test/UBASAN_MD171024-mariadb-11.7.0-linux-x86_64-opt/bin/mariadbd(__interceptor_memcpy+0x1f5)[0x55d93e6fb535]

sql/sql_string.h:424(Binary_string::q_append(char const*, unsigned long))[0x14b84fba892b]

spider/spd_db_conn.cc:1129(spider_db_append_xid_str(spider_string*, xid_t*))[0x14b84fa0ed22]

spider/spd_db_mysql.cc:2591(spider_db_mbase::xa_end(xid_t*, int*))[0x14b84fcb52cd]

spider/spd_db_conn.cc:1167(spider_db_xa_end(st_spider_conn*, xid_t*))[0x14b84fa0f0cd]

spider/spd_trx.cc:2088(spider_internal_xa_rollback(THD*, st_spider_transaction*))[0x14b84f9df72d]

spider/spd_trx.cc:3185(spider_rollback(handlerton*, THD*, bool))[0x14b84f9e621c]

sql/handler.cc:2336(ha_rollback_trans(THD*, bool))[0x55d94090680f]

sql/xa.cc:412(xa_trans_force_rollback(THD*))[0x55d9403b4995]

sql/sql_class.cc:1674(THD::cleanup())[0x55d93ed9f2e0]

sql/mysqld.cc:2866(unlink_thd(THD*))[0x55d93e7cd530]

sql/sql_connect.cc:1460(do_handle_one_connection(CONNECT*, bool))[0x55d93fb73543]

sql/sql_connect.cc:1356(handle_one_connection)[0x55d93fb769b5]

nptl/pthread_create.c:447(start_thread)[0x14b87609ca94]

x86_64/clone3.S:80(clone3)[0x14b876129c3c]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x0): (null)

Connection ID (thread ID): 5

Status: KILL_CONNECTION

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/ contains

information that should help you find out what is causing the crash.

We think the query pointer is invalid, but we will try to print it anyway. 

Query: 

Writing a core file...