Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.5, 10.6, 10.11, 11.2(EOL), 11.4, 11.7, 11.8
Description
CREATE TABLE t (a DECIMAL,KEY(a)); |
INSERT INTO t VALUES (1),(NULL); |
SELECT a FROM t GROUP BY 1 LIMIT 1 INTO @NULL; |
Leads to:
CS 11.2.6 67c0fd2a41034eae1ea04b81cace6a154783aedd (Optimized, UBASAN) |
==1577076==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b000015a78 at pc 0x56420bdb6ae0 bp 0x14d71d2fca10 sp 0x14d71d2fca00
|
WRITE of size 8 at 0x50b000015a78 thread T13
|
#0 0x56420bdb6adf in my_decimal::fix_buffer_pointer() /test/11.2_opt_san/sql/my_decimal.h:171
|
#1 0x56420bdb6adf in update_hash(user_var_entry*, bool, void*, unsigned long, Type_handler const*, charset_info_st const*) /test/11.2_opt_san/sql/item_func.cc:4948
|
#2 0x56420bdb6adf in update_hash(user_var_entry*, bool, void*, unsigned long, Type_handler const*, charset_info_st const*) /test/11.2_opt_san/sql/item_func.cc:4897
|
#3 0x56420bdb7353 in Item_func_set_user_var::update_hash(void*, unsigned long, Type_handler const*, charset_info_st const*) /test/11.2_opt_san/sql/item_func.cc:4980
|
#4 0x564209ccf481 in select_dumpvar::send_data_to_var_list(List<Item>&) /test/11.2_opt_san/sql/sql_class.cc:4323
|
#5 0x564209ccff42 in select_dumpvar::send_data(List<Item>&) /test/11.2_opt_san/sql/sql_class.cc:4342
|
#6 0x56420a41ae2b in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_opt_san/sql/sql_class.h:5990
|
#7 0x56420a41ae2b in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_opt_san/sql/sql_class.h:5980
|
#8 0x56420a41ae2b in end_send_group(JOIN*, st_join_table*, bool) /test/11.2_opt_san/sql/sql_select.cc:25581
|
#9 0x56420a21a749 in evaluate_join_record /test/11.2_opt_san/sql/sql_select.cc:24339
|
#10 0x56420a2e01e4 in sub_select(JOIN*, st_join_table*, bool) /test/11.2_opt_san/sql/sql_select.cc:24143
|
#11 0x56420a4b0bee in do_select /test/11.2_opt_san/sql/sql_select.cc:23617
|
#12 0x56420a4b0bee in JOIN::exec_inner() /test/11.2_opt_san/sql/sql_select.cc:5045
|
#13 0x56420a4b5dd3 in JOIN::exec() /test/11.2_opt_san/sql/sql_select.cc:4822
|
#14 0x56420a4a326d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.2_opt_san/sql/sql_select.cc:5360
|
#15 0x56420a4a6eb0 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.2_opt_san/sql/sql_select.cc:642
|
#16 0x564209fdda80 in execute_sqlcom_select /test/11.2_opt_san/sql/sql_parse.cc:6188
|
#17 0x56420a04e3df in mysql_execute_command(THD*, bool) /test/11.2_opt_san/sql/sql_parse.cc:3995
|
#18 0x56420a05f102 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.2_opt_san/sql/sql_parse.cc:7951
|
#19 0x56420a06fffa in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.2_opt_san/sql/sql_parse.cc:1905
|
#20 0x56420a0803a6 in do_command(THD*, bool) /test/11.2_opt_san/sql/sql_parse.cc:1418
|
#21 0x56420aa515d4 in do_handle_one_connection(CONNECT*, bool) /test/11.2_opt_san/sql/sql_connect.cc:1429
|
#22 0x56420aa5360c in handle_one_connection /test/11.2_opt_san/sql/sql_connect.cc:1341
|
#23 0x14d741c9ca93 in start_thread nptl/pthread_create.c:447
|
#24 0x14d741d29c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
0x50b000015a78 is located 0 bytes to the right of 104-byte region [0x50b000015a10,0x50b000015a78)
|
allocated by thread T13 here:
|
#0 0x5642096bed07 in __interceptor_malloc (/test/UBASAN_MD221124-mariadb-11.2.6-linux-x86_64-opt/bin/mariadbd+0x836dd07)
|
#1 0x56420dfd47b4 in my_malloc /test/11.2_opt_san/mysys/my_malloc.c:93
|
#2 0x56420bdafa72 in get_variable(st_hash*, st_mysql_const_lex_string*, bool) /test/11.2_opt_san/sql/item_func.cc:4668
|
#3 0x56420bdb5cc8 in Item_func_set_user_var::set_entry(THD*, bool) /test/11.2_opt_san/sql/item_func.cc:4713
|
#4 0x56420bdd83ef in Item_func_set_user_var::fix_fields(THD*, Item**) /test/11.2_opt_san/sql/item_func.cc:4739
|
#5 0x564209c84268 in my_var_user::set(THD*, Item*) /test/11.2_opt_san/sql/sql_class.cc:4292
|
#6 0x564209ccf481 in select_dumpvar::send_data_to_var_list(List<Item>&) /test/11.2_opt_san/sql/sql_class.cc:4323
|
#7 0x564209ccff42 in select_dumpvar::send_data(List<Item>&) /test/11.2_opt_san/sql/sql_class.cc:4342
|
#8 0x56420a41ae2b in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_opt_san/sql/sql_class.h:5990
|
#9 0x56420a41ae2b in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_opt_san/sql/sql_class.h:5980
|
#10 0x56420a41ae2b in end_send_group(JOIN*, st_join_table*, bool) /test/11.2_opt_san/sql/sql_select.cc:25581
|
#11 0x56420a21a749 in evaluate_join_record /test/11.2_opt_san/sql/sql_select.cc:24339
|
#12 0x56420a2e01e4 in sub_select(JOIN*, st_join_table*, bool) /test/11.2_opt_san/sql/sql_select.cc:24143
|
#13 0x56420a4b0bee in do_select /test/11.2_opt_san/sql/sql_select.cc:23617
|
#14 0x56420a4b0bee in JOIN::exec_inner() /test/11.2_opt_san/sql/sql_select.cc:5045
|
#15 0x56420a4b5dd3 in JOIN::exec() /test/11.2_opt_san/sql/sql_select.cc:4822
|
#16 0x56420a4a326d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.2_opt_san/sql/sql_select.cc:5360
|
#17 0x56420a4a6eb0 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.2_opt_san/sql/sql_select.cc:642
|
#18 0x564209fdda80 in execute_sqlcom_select /test/11.2_opt_san/sql/sql_parse.cc:6188
|
#19 0x56420a04e3df in mysql_execute_command(THD*, bool) /test/11.2_opt_san/sql/sql_parse.cc:3995
|
#20 0x56420a05f102 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.2_opt_san/sql/sql_parse.cc:7951
|
#21 0x56420a06fffa in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.2_opt_san/sql/sql_parse.cc:1905
|
#22 0x56420a0803a6 in do_command(THD*, bool) /test/11.2_opt_san/sql/sql_parse.cc:1418
|
#23 0x56420aa515d4 in do_handle_one_connection(CONNECT*, bool) /test/11.2_opt_san/sql/sql_connect.cc:1429
|
#24 0x56420aa5360c in handle_one_connection /test/11.2_opt_san/sql/sql_connect.cc:1341
|
#25 0x14d741c9ca93 in start_thread nptl/pthread_create.c:447
|
|
Thread T13 created by T0 here:
|
#0 0x564209662bb5 in pthread_create (/test/UBASAN_MD221124-mariadb-11.2.6-linux-x86_64-opt/bin/mariadbd+0x8311bb5)
|
#1 0x56420971861e in create_thread_to_handle_connection(CONNECT*) /test/11.2_opt_san/sql/mysqld.cc:6246
|
#2 0x56420972c1af in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.2_opt_san/sql/mysqld.cc:6370
|
#3 0x56420972d107 in handle_connections_sockets() /test/11.2_opt_san/sql/mysqld.cc:6494
|
#4 0x564209730113 in run_main_loop /test/11.2_opt_san/sql/mysqld.cc:5746
|
#5 0x564209730113 in mysqld_main(int, char**) /test/11.2_opt_san/sql/mysqld.cc:6147
|
#6 0x14d741c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
#7 0x14d741c2a28a in __libc_start_main_impl ../csu/libc-start.c:360
|
#8 0x56420962f974 in _start (/test/UBASAN_MD221124-mariadb-11.2.6-linux-x86_64-opt/bin/mariadbd+0x82de974)
|
|
SUMMARY: AddressSanitizer: heap-buffer-overflow /test/11.2_opt_san/sql/my_decimal.h:171 in my_decimal::fix_buffer_pointer()
|
Shadow bytes around the buggy address:
|
0x0a167fffaaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffab00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
|
0x0a167fffab10: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
|
0x0a167fffab20: 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 00 00
|
0x0a167fffab30: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
|
=>0x0a167fffab40: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]
|
0x0a167fffab50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffab60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffab70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffab80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffab90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1577076==ABORTING
|
241123 18:06:40 [ERROR] mysqld got signal 6 ;
|
CS 11.2.6 67c0fd2a41034eae1ea04b81cace6a154783aedd (Debug, UBASAN) |
==1577180==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b00001b7f8 at pc 0x558e0045828b bp 0x1509e5efd4c0 sp 0x1509e5efd4b0
|
WRITE of size 8 at 0x50b00001b7f8 thread T12
|
#0 0x558e0045828a in my_decimal::fix_buffer_pointer() /test/11.2_dbg_san/sql/my_decimal.h:171
|
#1 0x558e0045828a in update_hash(user_var_entry*, bool, void*, unsigned long, Type_handler const*, charset_info_st const*) /test/11.2_dbg_san/sql/item_func.cc:4948
|
#2 0x558e00458a31 in Item_func_set_user_var::update_hash(void*, unsigned long, Type_handler const*, charset_info_st const*) /test/11.2_dbg_san/sql/item_func.cc:4980
|
#3 0x558e0045edac in Item_func_set_user_var::update() /test/11.2_dbg_san/sql/item_func.cc:5247
|
#4 0x558dfe1860de in my_var_user::set(THD*, Item*) /test/11.2_dbg_san/sql/sql_class.cc:4292
|
#5 0x558dfe1cf037 in select_dumpvar::send_data_to_var_list(List<Item>&) /test/11.2_dbg_san/sql/sql_class.cc:4323
|
#6 0x558dfe1cfbd0 in select_dumpvar::send_data(List<Item>&) /test/11.2_dbg_san/sql/sql_class.cc:4342
|
#7 0x558dfe8a5a2d in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_dbg_san/sql/sql_class.h:5990
|
#8 0x558dfe8a5a2d in end_send_group(JOIN*, st_join_table*, bool) /test/11.2_dbg_san/sql/sql_select.cc:25581
|
#9 0x558dfe70c969 in evaluate_join_record /test/11.2_dbg_san/sql/sql_select.cc:24339
|
#10 0x558dfe7aa483 in sub_select(JOIN*, st_join_table*, bool) /test/11.2_dbg_san/sql/sql_select.cc:24143
|
#11 0x558dfe99533f in do_select /test/11.2_dbg_san/sql/sql_select.cc:23617
|
#12 0x558dfe99533f in JOIN::exec_inner() /test/11.2_dbg_san/sql/sql_select.cc:5045
|
#13 0x558dfe996aaa in JOIN::exec() /test/11.2_dbg_san/sql/sql_select.cc:4822
|
#14 0x558dfe984c63 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.2_dbg_san/sql/sql_select.cc:5360
|
#15 0x558dfe9891b1 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.2_dbg_san/sql/sql_select.cc:642
|
#16 0x558dfe4df40b in execute_sqlcom_select /test/11.2_dbg_san/sql/sql_parse.cc:6188
|
#17 0x558dfe544116 in mysql_execute_command(THD*, bool) /test/11.2_dbg_san/sql/sql_parse.cc:3995
|
#18 0x558dfe56eb6b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.2_dbg_san/sql/sql_parse.cc:7951
|
#19 0x558dfe57dd93 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.2_dbg_san/sql/sql_parse.cc:1905
|
#20 0x558dfe58c5fe in do_command(THD*, bool) /test/11.2_dbg_san/sql/sql_parse.cc:1418
|
#21 0x558dfefb0936 in do_handle_one_connection(CONNECT*, bool) /test/11.2_dbg_san/sql/sql_connect.cc:1429
|
#22 0x558dfefb1af5 in handle_one_connection /test/11.2_dbg_san/sql/sql_connect.cc:1341
|
#23 0x150a0a69ca93 in start_thread nptl/pthread_create.c:447
|
#24 0x150a0a729c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
0x50b00001b7f8 is located 0 bytes to the right of 104-byte region [0x50b00001b790,0x50b00001b7f8)
|
allocated by thread T12 here:
|
#0 0x558dfdbc9a17 in malloc (/test/UBASAN_MD221124-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd+0x88f3a17)
|
#1 0x558e02a512fd in my_malloc /test/11.2_dbg_san/mysys/my_malloc.c:93
|
#2 0x558e00450153 in get_variable(st_hash*, st_mysql_const_lex_string*, bool) /test/11.2_dbg_san/sql/item_func.cc:4668
|
#3 0x558e00457471 in Item_func_set_user_var::set_entry(THD*, bool) /test/11.2_dbg_san/sql/item_func.cc:4713
|
#4 0x558e0047d33e in Item_func_set_user_var::fix_fields(THD*, Item**) /test/11.2_dbg_san/sql/item_func.cc:4739
|
#5 0x558dfe185fca in my_var_user::set(THD*, Item*) /test/11.2_dbg_san/sql/sql_class.cc:4292
|
#6 0x558dfe1cf037 in select_dumpvar::send_data_to_var_list(List<Item>&) /test/11.2_dbg_san/sql/sql_class.cc:4323
|
#7 0x558dfe1cfbd0 in select_dumpvar::send_data(List<Item>&) /test/11.2_dbg_san/sql/sql_class.cc:4342
|
#8 0x558dfe8a5a2d in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.2_dbg_san/sql/sql_class.h:5990
|
#9 0x558dfe8a5a2d in end_send_group(JOIN*, st_join_table*, bool) /test/11.2_dbg_san/sql/sql_select.cc:25581
|
#10 0x558dfe70c969 in evaluate_join_record /test/11.2_dbg_san/sql/sql_select.cc:24339
|
#11 0x558dfe7aa483 in sub_select(JOIN*, st_join_table*, bool) /test/11.2_dbg_san/sql/sql_select.cc:24143
|
#12 0x558dfe99533f in do_select /test/11.2_dbg_san/sql/sql_select.cc:23617
|
#13 0x558dfe99533f in JOIN::exec_inner() /test/11.2_dbg_san/sql/sql_select.cc:5045
|
#14 0x558dfe996aaa in JOIN::exec() /test/11.2_dbg_san/sql/sql_select.cc:4822
|
#15 0x558dfe984c63 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.2_dbg_san/sql/sql_select.cc:5360
|
#16 0x558dfe9891b1 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.2_dbg_san/sql/sql_select.cc:642
|
#17 0x558dfe4df40b in execute_sqlcom_select /test/11.2_dbg_san/sql/sql_parse.cc:6188
|
#18 0x558dfe544116 in mysql_execute_command(THD*, bool) /test/11.2_dbg_san/sql/sql_parse.cc:3995
|
#19 0x558dfe56eb6b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.2_dbg_san/sql/sql_parse.cc:7951
|
#20 0x558dfe57dd93 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.2_dbg_san/sql/sql_parse.cc:1905
|
#21 0x558dfe58c5fe in do_command(THD*, bool) /test/11.2_dbg_san/sql/sql_parse.cc:1418
|
#22 0x558dfefb0936 in do_handle_one_connection(CONNECT*, bool) /test/11.2_dbg_san/sql/sql_connect.cc:1429
|
#23 0x558dfefb1af5 in handle_one_connection /test/11.2_dbg_san/sql/sql_connect.cc:1341
|
#24 0x150a0a69ca93 in start_thread nptl/pthread_create.c:447
|
|
Thread T12 created by T0 here:
|
#0 0x558dfdb6d8c5 in __interceptor_pthread_create (/test/UBASAN_MD221124-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd+0x88978c5)
|
#1 0x558dfdc22d85 in create_thread_to_handle_connection(CONNECT*) /test/11.2_dbg_san/sql/mysqld.cc:6246
|
#2 0x558dfdc36c16 in create_new_thread(CONNECT*) /test/11.2_dbg_san/sql/mysqld.cc:6308
|
#3 0x558dfdc37496 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.2_dbg_san/sql/mysqld.cc:6370
|
#4 0x558dfdc384dd in handle_connections_sockets() /test/11.2_dbg_san/sql/mysqld.cc:6494
|
#5 0x558dfdc3d016 in run_main_loop /test/11.2_dbg_san/sql/mysqld.cc:5746
|
#6 0x558dfdc3d016 in mysqld_main(int, char**) /test/11.2_dbg_san/sql/mysqld.cc:6147
|
#7 0x558dfdc0f5ba in main /test/11.2_dbg_san/sql/main.cc:34
|
#8 0x150a0a62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
#9 0x150a0a62a28a in __libc_start_main_impl ../csu/libc-start.c:360
|
#10 0x558dfdb3a684 in _start (/test/UBASAN_MD221124-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd+0x8864684)
|
|
SUMMARY: AddressSanitizer: heap-buffer-overflow /test/11.2_dbg_san/sql/my_decimal.h:171 in my_decimal::fix_buffer_pointer()
|
Shadow bytes around the buggy address:
|
0x0a167fffb6a0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
|
0x0a167fffb6b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
|
0x0a167fffb6c0: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
|
0x0a167fffb6d0: 00 00 00 fa fa fa fa fa fa fa fa fa 00 00 00 00
|
0x0a167fffb6e0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
|
=>0x0a167fffb6f0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]
|
0x0a167fffb700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffb710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffb720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffb730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0a167fffb740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1577180==ABORTING
|
241123 18:06:39 [ERROR] mysqld got signal 6 ;
|
Setup:
Compiled with a recent version of GCC (I used GCC 11.4.0) and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
|
Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.2.6 (dbg), 11.2.6 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.6.2 (dbg), 11.6.2 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)
Tetstcase is CLI and MTR compatible. Happens with both MyISAM and InnoDB.