ASAN | heap-buffer-overflow in sp_get_linestring_mbr when inserting data to geometry type column

CREATE TABLE t1 (g GEOMETRY NOT NULL,SPATIAL KEY (g)) ENGINE=MYISAM;

INSERT INTO t1 VALUES (0x0000000001050000000200000001020000000100000000000000000024400000000000003440);

==25384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000007a43 at pc 0x557ca9b3fc94 bp 0x145d849e12e0 sp 0x145d849e12d0

READ of size 1 at 0x606000007a43 thread T5

    #0 0x557ca9b3fc93 in sp_get_linestring_mbr /test/10.5_opt_san/storage/myisam/sp_key.c:154

    #1 0x557ca9b3fc93 in sp_get_geometry_mbr /test/10.5_opt_san/storage/myisam/sp_key.c:239

    #2 0x557ca9b3fc93 in sp_mbr_from_wkb /test/10.5_opt_san/storage/myisam/sp_key.c:111

    #3 0x557ca9b3fc93 in sp_make_key /test/10.5_opt_san/storage/myisam/sp_key.c:56

    #4 0x557ca9a4fc07 in _mi_make_key /test/10.5_opt_san/storage/myisam/mi_key.c:70

    #5 0x557ca9ac67ed in mi_write /test/10.5_opt_san/storage/myisam/mi_write.c:125

    #6 0x557ca70ae1d1 in handler::ha_write_row(unsigned char const*) /test/10.5_opt_san/sql/handler.cc:7373

    #7 0x557ca58b6f62 in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/10.5_opt_san/sql/sql_insert.cc:2227

    #8 0x557ca5914f61 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.5_opt_san/sql/sql_insert.cc:1139

    #9 0x557ca5b3af3c in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4650

    #10 0x557ca5aa1d8d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8237

    #11 0x557ca5b0a3e2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891

    #12 0x557ca5b1cdef in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375

    #13 0x557ca642a6d4 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1407

    #14 0x557ca642c80c in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1319

    #15 0x145d8c508608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #16 0x145d8b77d132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x606000007a43 is located 3 bytes to the right of 64-byte region [0x606000007a00,0x606000007a40)

allocated by thread T5 here:

    #0 0x557ca5340ec8 in __interceptor_malloc (/test/UBASAN_MD191124-mariadb-10.5.28-linux-x86_64-opt/bin/mariadbd+0x7c06ec8)

    #1 0x557ca9bd8944 in my_malloc /test/10.5_opt_san/mysys/my_malloc.c:91

    #2 0x557ca60819ce in Binary_string::real_alloc(unsigned long) /test/10.5_opt_san/sql/sql_string.cc:44

    #3 0x557ca608488a in Binary_string::alloc(unsigned long) /test/10.5_opt_san/sql/sql_string.h:745

    #4 0x557ca608488a in Binary_string::copy(char const*, unsigned long) /test/10.5_opt_san/sql/sql_string.cc:260

    #5 0x557ca69513c1 in String::copy(char const*, unsigned long, charset_info_st const*) /test/10.5_opt_san/sql/sql_string.h:936

    #6 0x557ca69513c1 in Field_geom::store(char const*, unsigned long, charset_info_st const*) /test/10.5_opt_san/sql/sql_type_geom.cc:889

    #7 0x557ca574881b in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool, bool) /test/10.5_opt_san/sql/sql_base.cc:8911

    #8 0x557ca5749d45 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /test/10.5_opt_san/sql/sql_base.cc:8966

    #9 0x557ca59178ca in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.5_opt_san/sql/sql_insert.cc:1080

    #10 0x557ca5b3af3c in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4650

    #11 0x557ca5aa1d8d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8237

    #12 0x557ca5b0a3e2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891

    #13 0x557ca5b1cdef in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375

    #14 0x557ca642a6d4 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1407

    #15 0x557ca642c80c in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1319

    #16 0x145d8c508608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:

    #0 0x557ca526df05 in pthread_create (/test/UBASAN_MD191124-mariadb-10.5.28-linux-x86_64-opt/bin/mariadbd+0x7b33f05)

    #1 0x557ca53922b3 in create_thread_to_handle_connection(CONNECT*) /test/10.5_opt_san/sql/mysqld.cc:6116

    #2 0x557ca53a1ee9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.5_opt_san/sql/mysqld.cc:6240

    #3 0x557ca53a2c99 in handle_connections_sockets() /test/10.5_opt_san/sql/mysqld.cc:6367

    #4 0x557ca53a4a7f in run_main_loop /test/10.5_opt_san/sql/mysqld.cc:5357

    #5 0x557ca53a4a7f in mysqld_main(int, char**) /test/10.5_opt_san/sql/mysqld.cc:5768

    #6 0x145d8b682082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /test/10.5_opt_san/storage/myisam/sp_key.c:154 in sp_get_linestring_mbr

==1022790==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000009a83 at pc 0x00000245a77a bp 0x14ea955595a0 sp 0x14ea95559598

READ of size 4 at 0x606000009a83 thread T12

    #0 0x245a779 in rtree_get_linestring_mbr(unsigned char const**, unsigned char const*, unsigned int, double*) /test/10.6_opt_san/storage/innobase/gis/gis0geo.cc:139:13

    #1 0x245a779 in rtree_get_geometry_mbr(unsigned char const**, unsigned char const*, unsigned int, double*, int) /test/10.6_opt_san/storage/innobase/gis/gis0geo.cc:243:8

    #2 0x245a157 in rtree_mbr_from_wkb(unsigned char const*, unsigned int, unsigned int, double*) /test/10.6_opt_san/storage/innobase/gis/gis0geo.cc:302:9

    #3 0x2093e11 in row_ins_spatial_index_entry_set_mbr_field(dfield_t*, dfield_t const*) /test/10.6_opt_san/storage/innobase/row/row0ins.cc:3397:2

    #4 0x2093e11 in row_ins_index_entry_set_vals(ins_node_t const*, que_thr_t*) /test/10.6_opt_san/storage/innobase/row/row0ins.cc:3495:4

    #5 0x2093e11 in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/10.6_opt_san/storage/innobase/row/row0ins.cc:3527:8

    #6 0x2093e11 in row_ins(ins_node_t*, que_thr_t*) /test/10.6_opt_san/storage/innobase/row/row0ins.cc:3660:28

    #7 0x2093e11 in row_ins_step(que_thr_t*) /test/10.6_opt_san/storage/innobase/row/row0ins.cc:3789:8

    #8 0x20c256a in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/10.6_opt_san/storage/innobase/row/row0mysql.cc:1291:2

    #9 0x1df9e1d in ha_innobase::write_row(unsigned char const*) /test/10.6_opt_san/storage/innobase/handler/ha_innodb.cc:7889:10

    #10 0x14263b7 in handler::ha_write_row(unsigned char const*) /test/10.6_opt_san/sql/handler.cc:7738:3

    #11 0xa6c741 in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/10.6_opt_san/sql/sql_insert.cc:2235:12

    #12 0xa64529 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_opt_san/sql/sql_insert.cc:1146:14

    #13 0xb5ad7c in mysql_execute_command(THD*, bool) /test/10.6_opt_san/sql/sql_parse.cc:4625:10

    #14 0xb3e620 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_san/sql/sql_parse.cc:8199:18

    #15 0xb382c0 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_san/sql/sql_parse.cc:1909:7

    #16 0xb3f2f9 in do_command(THD*, bool) /test/10.6_opt_san/sql/sql_parse.cc:1422:17

    #17 0xf9ac54 in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_san/sql/sql_connect.cc:1386:11

    #18 0xf9a37b in handle_one_connection /test/10.6_opt_san/sql/sql_connect.cc:1298:5

    #19 0x14eab7dee608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

    #20 0x14eab7b04132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95