Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.5, 10.6, 10.11, 11.4, 11.8, 12.0
Description
SET sql_mode=''; |
INSTALL PLUGIN ARCHIVE SONAME 'ha_archive.so'; |
CREATE TABLE t (c BLOB) ENGINE=ARCHIVE; |
INSERT INTO t VALUES (0); |
--error 1031
|
TRUNCATE t; |
OPTIMIZE TABLE t; |
Leads to:
|
CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Debug, UBASAN, Clang) Build 15/02/2025 |
==2791010==ERROR: AddressSanitizer: heap-use-after-free on address 0x50400000c8eb at pc 0x5b64e8268406 bp 0x72bbce300070 sp 0x72bbce2ff830
|
READ of size 1 at 0x50400000c8eb thread T14
|
#0 0x5b64e8268405 in __asan_memcpy (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22bb405) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
|
#1 0x5b64e93a562d in Field_blob::pack(unsigned char*, unsigned char const*, unsigned int) /test/10.5_dbg_san/sql/field.cc:9045:5
|
#2 0x72bcc914f672 in Field::pack(unsigned char*, unsigned char const*) /test/10.5_dbg_san/sql/field.h:1616:26
|
#3 0x72bcc914f672 in ha_archive::pack_row(unsigned char const*, azio_stream*) /test/10.5_dbg_san/storage/archive/ha_archive.cc:952:22
|
#4 0x72bcc914eb55 in ha_archive::real_write_row(unsigned char const*, azio_stream*) /test/10.5_dbg_san/storage/archive/ha_archive.cc:890:18
|
#5 0x72bcc9159013 in ha_archive::optimize(THD*, st_ha_check_opt*) /test/10.5_dbg_san/storage/archive/ha_archive.cc:1566:9
|
#6 0x5b64e8da7fea in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, char const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/10.5_dbg_san/sql/sql_admin.cc:875:21
|
#7 0x5b64e8dad57b in Sql_cmd_optimize_table::execute(THD*) /test/10.5_dbg_san/sql/sql_admin.cc:1517:5
|
#8 0x5b64e8773f3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26
|
#9 0x5b64e8753467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
|
#10 0x5b64e87473b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
|
#11 0x5b64e87555be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
|
#12 0x5b64e8d5f257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
|
#13 0x5b64e8d5eb1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
|
#14 0x5b64e826803c in asan_thread_start(void*) asan_interceptors.cpp.o
|
#15 0x72bcd569ca93 in start_thread nptl/pthread_create.c:447:8
|
#16 0x72bcd5729c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
0x50400000c8eb is located 27 bytes inside of 40-byte region [0x50400000c8d0,0x50400000c8f8)
|
freed by thread T14 here:
|
#0 0x5b64e826a970 in realloc (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22bd970) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
|
#1 0x5b64eaf18a65 in my_realloc /test/10.5_dbg_san/mysys/my_malloc.c:153:7
|
#2 0x72bcc9151410 in ha_archive::fix_rec_buff(unsigned int) /test/10.5_dbg_san/storage/archive/ha_archive.cc:1230:27
|
#3 0x72bcc914f030 in ha_archive::pack_row(unsigned char const*, azio_stream*) /test/10.5_dbg_san/storage/archive/ha_archive.cc:938:7
|
#4 0x72bcc914eb55 in ha_archive::real_write_row(unsigned char const*, azio_stream*) /test/10.5_dbg_san/storage/archive/ha_archive.cc:890:18
|
#5 0x72bcc9159013 in ha_archive::optimize(THD*, st_ha_check_opt*) /test/10.5_dbg_san/storage/archive/ha_archive.cc:1566:9
|
#6 0x5b64e8da7fea in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, char const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/10.5_dbg_san/sql/sql_admin.cc:875:21
|
#7 0x5b64e8dad57b in Sql_cmd_optimize_table::execute(THD*) /test/10.5_dbg_san/sql/sql_admin.cc:1517:5
|
#8 0x5b64e8773f3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26
|
#9 0x5b64e8753467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
|
#10 0x5b64e87473b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
|
#11 0x5b64e87555be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
|
#12 0x5b64e8d5f257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
|
#13 0x5b64e8d5eb1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
|
#14 0x5b64e826803c in asan_thread_start(void*) asan_interceptors.cpp.o
|
|
|
previously allocated by thread T14 here:
|
#0 0x5b64e826a553 in malloc (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22bd553) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
|
#1 0x5b64eaf18794 in my_malloc /test/10.5_dbg_san/mysys/my_malloc.c:91:29
|
#2 0x72bcc914cbd1 in ha_archive::create_record_buffer(unsigned int) /test/10.5_dbg_san/storage/archive/ha_archive.cc:1912:29
|
#3 0x72bcc914cbd1 in ha_archive::open(char const*, int, unsigned int) /test/10.5_dbg_san/storage/archive/ha_archive.cc:643:18
|
#4 0x5b64e943bcdd in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/10.5_dbg_san/sql/handler.cc:3106:7
|
#5 0x5b64e8c2b806 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.5_dbg_san/sql/table.cc:4351:33
|
#6 0x5b64e84d0b7e in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.5_dbg_san/sql/sql_base.cc:2044:12
|
#7 0x5b64e84de147 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/10.5_dbg_san/sql/sql_base.cc:3839:14
|
#8 0x5b64e84de147 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.5_dbg_san/sql/sql_base.cc:4323:14
|
#9 0x5b64e84eaf24 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.5_dbg_san/sql/sql_base.cc:5270:7
|
#10 0x5b64e8661d2e in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.5_dbg_san/sql/sql_base.h:509:10
|
#11 0x5b64e8dfcd82 in Sql_cmd_truncate_table::handler_truncate(THD*, TABLE_LIST*, bool) /test/10.5_dbg_san/sql/sql_truncate.cc:230:7
|
#12 0x5b64e8e005d7 in Sql_cmd_truncate_table::truncate_table(THD*, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_truncate.cc:492:14
|
#13 0x5b64e8e015d1 in Sql_cmd_truncate_table::execute(THD*) /test/10.5_dbg_san/sql/sql_truncate.cc:557:15
|
#14 0x5b64e8773f3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26
|
#15 0x5b64e8753467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
|
#16 0x5b64e87473b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
|
#17 0x5b64e87555be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
|
#18 0x5b64e8d5f257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
|
#19 0x5b64e8d5eb1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
|
#20 0x5b64e826803c in asan_thread_start(void*) asan_interceptors.cpp.o
|
|
|
Thread T14 created by T0 here:
|
#0 0x5b64e824fec5 in pthread_create (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22a2ec5) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
|
#1 0x5b64e82bb64a in create_thread_to_handle_connection(CONNECT*) /test/10.5_dbg_san/sql/mysqld.cc:6072:19
|
#2 0x5b64e82bc721 in handle_connections_sockets() /test/10.5_dbg_san/sql/mysqld.cc:6327:9
|
#3 0x5b64e82ba8ea in run_main_loop() /test/10.5_dbg_san/sql/mysqld.cc:5313:3
|
#4 0x5b64e82b18f4 in mysqld_main(int, char**) /test/10.5_dbg_san/sql/mysqld.cc:5724:3
|
#5 0x72bcd562a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
|
#6 0x72bcd562a28a in __libc_start_main csu/../csu/libc-start.c:360:3
|
#7 0x5b64e81cf704 in _start (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x2222704) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22bb405) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3) in __asan_memcpy
|
Shadow bytes around the buggy address:
|
0x50400000c600: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
|
0x50400000c680: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa
|
0x50400000c700: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
|
0x50400000c780: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
|
0x50400000c800: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
|
=>0x50400000c880: fa fa 00 00 00 00 00 fa fa fa fd fd fd[fd]fd fa
|
0x50400000c900: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
|
0x50400000c980: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00
|
0x50400000ca00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x50400000ca80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x50400000cb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==2791010==ABORTING
|
And:
|
ES 10.6.21-17 a99e9e4101f5d56a379577e6d81c829b7658df99 (Optimized, UBASAN, Clang) Build 14/03/2025 |
/test/10.6-es_opt_san/storage/archive/ha_archive.cc:793:39: runtime error: member access within null pointer of type 'KEY' (aka 'st_key')
|
#0 0x719d3314d5b0 in ha_archive::create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.6-es_opt_san/storage/archive/ha_archive.cc:793:39
|
#1 0x5b8ae1c1ff83 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.6-es_dbg_san/sql/handler.cc:5622:14
|
#2 0x5b8ae1c283eb in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*, bool) /test/10.6-es_dbg_san/sql/handler.cc:6091:22
|
#3 0x5b8ae12161e7 in create_table_impl(THD*, st_ddl_log_state*, st_ddl_log_state*, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/10.6-es_dbg_san/sql/sql_table.cc:4742:11
|
#4 0x5b8ae1218f57 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/10.6-es_dbg_san/sql/sql_table.cc:4842:8
|
#5 0x5b8ae121aeb7 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /test/10.6-es_dbg_san/sql/sql_table.cc:5081:7
|
#6 0x5b8ae127096a in Sql_cmd_create_table_like::execute(THD*) /test/10.6-es_dbg_san/sql/sql_table.cc:12632:12
|
#7 0x5b8ae0e35f52 in mysql_execute_command(THD*, bool) /test/10.6-es_dbg_san/sql/sql_parse.cc:6173:26
|
#8 0x5b8ae0e136a8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6-es_dbg_san/sql/sql_parse.cc:8236:18
|
#9 0x5b8ae0e0c7f0 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6-es_dbg_san/sql/sql_parse.cc:1915:7
|
#10 0x5b8ae0e16223 in do_command(THD*, bool) /test/10.6-es_dbg_san/sql/sql_parse.cc:1428:17
|
#11 0x5b8ae14b36bc in do_handle_one_connection(CONNECT*, bool) /test/10.6-es_dbg_san/sql/sql_connect.cc:1386:11
|
#12 0x5b8ae14b2f7b in handle_one_connection /test/10.6-es_dbg_san/sql/sql_connect.cc:1298:5
|
#13 0x5b8ae092126c in asan_thread_start(void*) asan_interceptors.cpp.o
|
#14 0x719d3f29ca93 in start_thread nptl/pthread_create.c:447:8
|
#15 0x719d3f329c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/10.6-es_opt_san/storage/archive/ha_archive.cc:793:39
|
250405 10:15:09 [ERROR] /test/UBASAN_EMD140325-mariadb-10.6.21-17-linux-x86_64-opt/bin/mariadbd got signal 11 ;
|
Setup:
Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
|
export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
|
|
SAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
ES 10.5 dbg 140325 6553c62369ab3606efc74295c902181f793fd6d1 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
ES 10.5 opt 140325 6553c62369ab3606efc74295c902181f793fd6d1 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
ES 10.6 dbg 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
ES 10.6 opt 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 UBSAN|member access within null pointer of type 'KEY' (aka 'st_key')|storage/archive/ha_archive.cc|ha_archive::create|handler::ha_create|ha_create_table|create_table_impl
|
ES 11.4 dbg 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|
ES 11.4 opt 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|sql/field.cc|__asan_memcpy|Field_blob::pack|Field::pack|ha_archive::pack_row
|