INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE TABLE t (c INT) ENGINE=Spider;

ALTER TABLE t ENGINE=InnoDB;

SET character_set_connection=utf16;

SELECT spider_direct_sql ('DROP TABLE "t2"','','SRV "srv",WRAPPER "odbc"');

==1075136==ERROR: AddressSanitizer: heap-use-after-free on address 0x515000058338 at pc 0x151b6a321c3a bp 0x151b6bcffdd0 sp 0x151b6bcffdc8

WRITE of size 4 at 0x515000058338 thread T14

    #0 0x151b6a321c39 in spider_db_mbase::connect(char*, char*, char*, long, char*, char*, int, long long) /test/10.5_dbg_san/storage/spider/spd_db_mysql.cc:2039:25

    #1 0x151b6a11875a in spider_db_udf_direct_sql_connect(st_spider_direct_sql const*, st_spider_conn*) /test/10.5_dbg_san/storage/spider/spd_db_conn.cc:9051:35

    #2 0x151b6a1e0c13 in spider_udf_direct_sql_get_conn(st_spider_direct_sql const*, st_spider_transaction*, int*) /test/10.5_dbg_san/storage/spider/spd_direct_sql.cc:554:23

    #3 0x151b6a1ecb14 in spider_direct_sql_body(st_udf_init*, st_udf_args*, unsigned char*, unsigned char*, char) /test/10.5_dbg_san/storage/spider/spd_direct_sql.cc:1386:16

    #4 0x55e61550ba78 in udf_handler::val_int(char*) /test/10.5_dbg_san/sql/sql_udf.h:108:18

    #5 0x55e61550ba78 in Item_func_udf_int::val_int() /test/10.5_dbg_san/sql/item_func.cc:3877:12

    #6 0x55e614e0c154 in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/10.5_dbg_san/sql/sql_type.cc:7605:22

    #7 0x55e6140fe5fe in Protocol::send_result_set_row(List<Item>*) /test/10.5_dbg_san/sql/protocol.cc:1086:15

    #8 0x55e6143961c0 in select_send::send_data(List<Item>&) /test/10.5_dbg_san/sql/sql_class.cc:3173:17

    #9 0x55e614705c71 in JOIN::exec_inner() /test/10.5_dbg_san/sql/sql_select.cc:4532:22

    #10 0x55e614702493 in JOIN::exec() /test/10.5_dbg_san/sql/sql_select.cc:4444:3

    #11 0x55e614683966 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.5_dbg_san/sql/sql_select.cc:4921:9

    #12 0x55e614682392 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.5_dbg_san/sql/sql_select.cc:449:10

    #13 0x55e6145b11f3 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_parse.cc:6452:12

    #14 0x55e614599242 in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:4043:12

    #15 0x55e614569467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18

    #16 0x55e61455d3b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7

    #17 0x55e61456b5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17

    #18 0x55e614b75257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11

    #19 0x55e614b74b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5

    #20 0x55e61407e03c in asan_thread_start(void*) asan_interceptors.cpp.o

    #21 0x151b98e9ca93 in start_thread nptl/pthread_create.c:447:8

    #22 0x151b98f29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x515000058338 is located 184 bytes inside of 512-byte region [0x515000058280,0x515000058480)

freed by thread T14 here:

    #0 0x55e6140802ba in free (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22bd2ba) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)

    #1 0x151b6a2171d1 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/10.5_dbg_san/storage/spider/spd_malloc.cc:182:3

    #2 0x151b6a24a40e in ha_spider::close() /test/10.5_dbg_san/storage/spider/ha_spider.cc:586:5

    #3 0x55e614a466cf in closefrm(TABLE*) /test/10.5_dbg_san/sql/table.cc:4455:24

    #4 0x55e614ef61d5 in intern_close_table(TABLE*) /test/10.5_dbg_san/sql/table_cache.cc:220:3

    #5 0x55e6142db4f1 in close_all_tables_for_name(THD*, TABLE_SHARE*, ha_extra_function, TABLE*) /test/10.5_dbg_san/sql/sql_base.cc:753:7

    #6 0x55e61492cf87 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /test/10.5_dbg_san/sql/sql_table.cc:11575:3

    #7 0x55e614b951f3 in Sql_cmd_alter_table::execute(THD*) /test/10.5_dbg_san/sql/sql_alter.cc:587:11

    #8 0x55e614589f3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26

    #9 0x55e614569467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18

    #10 0x55e61455d3b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7

    #11 0x55e61456b5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17

    #12 0x55e614b75257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11

    #13 0x55e614b74b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5

    #14 0x55e61407e03c in asan_thread_start(void*) asan_interceptors.cpp.o

previously allocated by thread T14 here:

    #0 0x55e614080553 in malloc (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22bd553) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)

    #1 0x55e616d2e794 in my_malloc /test/10.5_dbg_san/mysys/my_malloc.c:91:29

    #2 0x151b6a217567 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/10.5_dbg_san/storage/spider/spd_malloc.cc:230:29

    #3 0x151b6a1ad97c in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/10.5_dbg_san/storage/spider/spd_table.cc:4502:7

    #4 0x151b6a23cd4e in ha_spider::open(char const*, int, unsigned int) /test/10.5_dbg_san/storage/spider/ha_spider.cc:309:18

    #5 0x55e615251cdd in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/10.5_dbg_san/sql/handler.cc:3106:7

    #6 0x55e614a41806 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.5_dbg_san/sql/table.cc:4351:33

    #7 0x55e6142e6b7e in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.5_dbg_san/sql/sql_base.cc:2044:12

    #8 0x55e6142f4147 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/10.5_dbg_san/sql/sql_base.cc:3839:14

    #9 0x55e6142f4147 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.5_dbg_san/sql/sql_base.cc:4323:14

    #10 0x55e614922ac4 in open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.5_dbg_san/sql/sql_base.h:264:10

    #11 0x55e614922ac4 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /test/10.5_dbg_san/sql/sql_table.cc:10536:10

    #12 0x55e614b951f3 in Sql_cmd_alter_table::execute(THD*) /test/10.5_dbg_san/sql/sql_alter.cc:587:11

    #13 0x55e614589f3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26

    #14 0x55e614569467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18

    #15 0x55e61455d3b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7

    #16 0x55e61456b5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17

    #17 0x55e614b75257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11

    #18 0x55e614b74b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5

    #19 0x55e61407e03c in asan_thread_start(void*) asan_interceptors.cpp.o

Thread T14 created by T0 here:

    #0 0x55e614065ec5 in pthread_create (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22a2ec5) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)

    #1 0x55e6140d164a in create_thread_to_handle_connection(CONNECT*) /test/10.5_dbg_san/sql/mysqld.cc:6072:19

    #2 0x55e6140d2721 in handle_connections_sockets() /test/10.5_dbg_san/sql/mysqld.cc:6327:9

    #3 0x55e6140d08ea in run_main_loop() /test/10.5_dbg_san/sql/mysqld.cc:5313:3

    #4 0x55e6140c78f4 in mysqld_main(int, char**) /test/10.5_dbg_san/sql/mysqld.cc:5724:3

    #5 0x151b98e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

    #6 0x151b98e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3

    #7 0x55e613fe5704 in _start (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x2222704) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)

SUMMARY: AddressSanitizer: heap-use-after-free /test/10.5_dbg_san/storage/spider/spd_db_mysql.cc:2039:25 in spider_db_mbase::connect(char*, char*, char*, long, char*, char*, int, long long)

Shadow bytes around the buggy address:

  0x515000058080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x515000058100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x515000058180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa

  0x515000058200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x515000058280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x515000058300: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd

  0x515000058380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x515000058400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x515000058480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x515000058500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x515000058580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==1075136==ABORTING

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1