Freeing unallocated data THD::set_db when path-resolved routine in trigger

CREATE DATABASE test1;

USE test1;

CREATE TABLE t1 (c INT);

USE test;

CREATE PROCEDURE p1() FLUSH TABLES;

SET PATH 'test,test1';

USE test1;

CREATE TRIGGER trg BEFORE INSERT ON t1 FOR EACH ROW CALL p1;

CREATE TEMPORARY TABLE tmp1 (a INT);

DROP TABLE tmp1;

SELECT * FROM t1;

Core was generated by `/test/mtest/MDEV-34391/MD231225-mariadb-12.3.0-linux-x86_64-opt/bin/mariadbd --'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 756103)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x0000736d8124527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x0000736d812288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x0000736d812297b6 in __libc_message_impl (fmt=fmt@entry=0x736d813ce8d7 "%s\n") at ../sysdeps/posix/libc_fatal.c:134

#6  0x0000736d812a8ff5 in malloc_printerr (str=str@entry=0x736d813cc672 "free(): invalid pointer")at ./malloc/malloc.c:5772

#7  0x0000736d812ab38c in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at ./malloc/malloc.c:4507

#8  0x0000736d812addae in __GI___libc_free (mem=0x736cb403c4b0)at ./malloc/malloc.c:3398

#9  0x00005806c893ccda in THD::set_db (this=0x736cb4000c68, new_db=0x5806c940fad0 <null_clex_str>)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_class.cc:1639

#10 0x00005806c8950cb7 in mysql_change_db_impl (thd=0x736cb4000c68, new_db_name=0x736d53968820, new_db_access=(SELECT_ACL | INSERT_ACL | UPDATE_ACL | DELETE_ACL | CREATE_ACL | DROP_ACL | GRANT_ACL | REFERENCES_ACL | INDEX_ACL | ALTER_ACL | CREATE_TMP_ACL | LOCK_TABLES_ACL | EXECUTE_ACL | CREATE_VIEW_ACL | SHOW_VIEW_ACL | CREATE_PROC_ACL | ALTER_PROC_ACL | EVENT_ACL | TRIGGER_ACL | DELETE_HISTORY_ACL | SHOW_CREATE_ROUTINE_ACL), new_db_charset=0x5806d80a9cd8)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_db.cc:1600

#11 mysql_change_db (thd=thd@entry=0x736cb4000c68, new_db_name=new_db_name@entry=0x736d5396ca70, force_switch=<optimized out>)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_db.cc:1855

#12 0x00005806c8950f5a in mysql_opt_change_db (thd=thd@entry=0x736cb4000c68, new_db_name=new_db_name@entry=0x736d5396ca70, saved_db_name=saved_db_name@entry=0x736d53968ab0, force_switch=true, cur_db_changed=cur_db_changed@entry=0x736d53968b07)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_db.cc:1901

#13 0x00005806c88e71f7 in Sp_handler::db_load_routine (this=this@entry=0x5806c9c4f780 <sp_handler_procedure>, thd=thd@entry=0x736cb4000c68, name=name@entry=0x736d5396ca70, sphp=sphp@entry=0x736d5396ca38, sql_mode=sql_mode@entry=1411383296, sql_path=@0x736d5396c198: {m_schemas = {{<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x736cb40283d8 "CURRENT_SCHEMA", length = 0}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x0, length = 0}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>} <repeats 15 times>}, m_count = 1}, params=@0x736d5396ab80: {str = 0x5806c9406e88 "", length = 0}, returns=@0x736d5396abe0: {str = 0x5806c9406e88 "", length = 0}, body=@0x736d5396ab90: {str = 0x736cb40410f8 "FLUSH TABLES", length = 12}, chistics=@0x736d5396abc0: {comment = {str = 0x5806c9406e88 "", length = 0}, suid = SP_IS_SUID, detistic = false, daccess = SP_CONTAINS_SQL, agg_type = NOT_AGGREGATE}, definer=@0x736d5396aba0: {user = {str = 0x736cb40410e8 "root", length = 4}, host = {str = 0x736cb40410ed "localhost", length = 9}}, created=20260109131833, modified=20260109131833, parent=0x0, creation_ctx=0x736cb4041150)at /test/mtest/MDEV-34391/12.3_opt/sql/sp.cc:1020

#14 0x00005806c88e6fef in Sp_handler::db_find_routine (this=this@entry=0x5806c9c4f780 <sp_handler_procedure>, thd=thd@entry=0x736cb4000c68, name=name@entry=0x736d5396ca70, sphp=sphp@entry=0x736d5396ca38)at /test/mtest/MDEV-34391/12.3_opt/sql/sp.cc:776

#15 0x00005806c88e9bfd in Sp_handler::db_find_and_cache_routine (this=0x5806c9c4f780 <sp_handler_procedure>, thd=0x736cb4000c68, name=0x736d5396ca70, sp=0x736d5396ca38)at /test/mtest/MDEV-34391/12.3_opt/sql/sp.cc:800

#16 Sp_handler::sp_find_routine (this=0x5806c9c4f780 <sp_handler_procedure>, thd=0x736cb4000c68, name=0x736d5396ca70, cache_only=false)at /test/mtest/MDEV-34391/12.3_opt/sql/sp.cc:2257

#17 0x00005806c88d279f in Sql_path::try_resolve_in_schema (this=<optimized out>, thd=thd@entry=0x736cb4000c68, schema=@0x736d5396cb10: {<Lex_ident_db> = {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x736cb4008228 "test", length = 4}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, name=name@entry=0x736cb4041058, sph=sph@entry=0x736d5396cba0, pkgname=pkgname@entry=0x736d5396cb80, resolved=0x736d5396cb08)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_path.cc:62

#18 0x00005806c88d2a6c in Sql_path::resolve (this=0x736cb4001a90, thd=0x736cb4000c68, caller=0x736cb403ffb0, name=0x736cb4041058, sph=0x736d5396cba0, pkgname=0x736d5396cb80)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_path.cc:171

#19 0x00005806c8982b2b in LEX::call_statement_start (this=0x736cb40448a0, thd=0xb8987, name=0x736cb4041058)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_lex.cc:10200

#20 0x00005806c8ba4166 in MYSQLparse (thd=thd@entry=0x736cb4000c68)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_yacc.yy:3361

#21 0x00005806c89a3245 in parse_sql (thd=thd@entry=0x736cb4000c68, parser_state=parser_state@entry=0x736d5396d910, creation_ctx=creation_ctx@entry=0x736cb4018fe0, do_pfs_digest=false)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_parse.cc:10315

#22 0x00005806c8a6511a in Table_triggers_list::check_n_load (thd=0x736cb4000c68, db=0x736cb403c228, table_name=0x736cb403c238, table=0x736cb4021d08, names_only=false)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_trigger.cc:1854

#23 0x00005806c8926051 in open_table_entry_fini (thd=0xb83b9, thd@entry=0x736cb4000c68, share=share@entry=0x736cb403bfb0, entry=0x736cb4021d08)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_base.cc:3310

#24 0x00005806c89258a1 in open_table (thd=0x736cb4000c68, table_list=table_list@entry=0x736cb4017f00, ot_ctx=ot_ctx@entry=0x736d53970738)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_base.cc:2344

#25 0x00005806c892838d in open_and_process_table (thd=0x736cb4000c68, tables=0x736cb4017f00, counter=0x736d539709ec, flags=0, prelocking_strategy=0x736d53970a50, ot_ctx=0x736d53970738, has_prelocking_list=<optimized out>)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_base.cc:4273

#26 open_tables (thd=thd@entry=0x736cb4000c68, options=@0x736cb40067b4: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x736d539709e0, counter=counter@entry=0x736d539709ec, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x736d53970a50)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_base.cc:4756

#27 0x00005806c892a164 in open_and_lock_tables (thd=0xb83b9, thd@entry=0x736cb4000c68, options=<error reading variable: Cannot access memory at address 0xb8987>, tables=0x736cb4017f00, derived=true, flags=4294967295, flags@entry=0, prelocking_strategy=0x0, prelocking_strategy@entry=0x736d53970a50)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_base.cc:5797

#28 0x00005806c899fc04 in open_and_lock_tables (thd=0x736cb4000c68, tables=0x736cb4017f00, derived=true, flags=0)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_base.h:537

#29 execute_sqlcom_select (thd=thd@entry=0x736cb4000c68, all_tables=0x736cb4017f00)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_parse.cc:6093

#30 0x00005806c899ea0c in mysql_execute_command (thd=thd@entry=0x736cb4000c68, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_parse.cc:3951

#31 0x00005806c8996d91 in mysql_parse (thd=thd@entry=0x736cb4000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x736d539714d0)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_parse.cc:7895

#32 0x00005806c89952ac in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x736cb4000c68, packet=packet@entry=0x736cb4008b89 "SELECT * FROM t1", packet_length=packet_length@entry=16, blocking=true)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_parse.cc:1878

#33 0x00005806c89971a1 in do_command (thd=thd@entry=0x736cb4000c68, blocking=true) at /test/mtest/MDEV-34391/12.3_opt/sql/sql_parse.cc:1417

#34 0x00005806c8ac289d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5806d89aebe8, put_in_cache=true)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_connect.cc:1503

#35 0x00005806c8ac265f in handle_one_connection (arg=arg@entry=0x5806d89aebe8)at /test/mtest/MDEV-34391/12.3_opt/sql/sql_connect.cc:1415

#36 0x00005806c8e760b9 in pfs_spawn_thread (arg=0x5806d8951838)at /test/mtest/MDEV-34391/12.3_opt/storage/perfschema/pfs.cc:2198

#37 0x0000736d8129caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#38 0x0000736d81329c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==181351==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x525000113638 in thread T12

    #0 0x5e454720590a in free (/test/mtest/MDEV-34391/UBASAN_MD231225-mariadb-12.3.0-linux-x86_64-opt/bin/mariadbd+0x293190a) (BuildId: ed6df9b3f5f1a67f)

    #1 0x5e4547f95c09 in THD::set_db(st_mysql_const_lex_string const*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_class.cc:1639:5

    #2 0x5e45481ea3e8 in mysql_change_db_impl(THD*, st_mysql_const_lex_string*, privilege_t, charset_info_st const*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_db.cc:1600:10

    #3 0x5e45481e9cd0 in mysql_change_db(THD*, st_mysql_const_lex_string const*, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_db.cc:1855:5

    #4 0x5e45481eaf93 in mysql_opt_change_db(THD*, st_mysql_const_lex_string const*, st_mysql_lex_string*, bool, bool*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_db.cc:1901:10

    #5 0x5e4547d9072b in Sp_handler::db_load_routine(THD*, Database_qualified_name const*, sp_head**, unsigned long long, Sql_path const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_sp_chistics const&, AUTHID const&, long long, long long, sp_package*, Stored_program_creation_ctx*) const /test/mtest/MDEV-34391/12.3_opt_san/sql/sp.cc:1020:7

    #6 0x5e4547d8f9f6 in Sp_handler::db_find_routine(THD*, Database_qualified_name const*, sp_head**) const /test/mtest/MDEV-34391/12.3_opt_san/sql/sp.cc:776:8

    #7 0x5e4547d91ff7 in Sp_handler::db_find_and_cache_routine(THD*, Database_qualified_name const*, sp_head**) const /test/mtest/MDEV-34391/12.3_opt_san/sql/sp.cc:800:11

    #8 0x5e4547da2a93 in Sp_handler::sp_find_routine(THD*, Database_qualified_name const*, bool) const /test/mtest/MDEV-34391/12.3_opt_san/sql/sp.cc:2257:5

    #9 0x5e4547d1aa03 in Sql_path::try_resolve_in_schema(THD*, Lex_ident_db_normalized const&, sp_name*, Sp_handler const**, Database_qualified_name*, bool*) const /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_path.cc:62:25

    #10 0x5e4547d1ba13 in Sql_path::resolve(THD*, sp_head*, sp_name*, Sp_handler const**, Database_qualified_name*) const /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_path.cc:171:9

    #11 0x5e454832d909 in LEX::call_statement_start(THD*, sp_name*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_lex.cc:10200:23

    #12 0x5e454800b461 in MYSQLparse(THD*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_yacc.yy:3361:17

    #13 0x5e4548406caf in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_parse.cc:10315:46

    #14 0x5e45488c4d53 in Table_triggers_list::check_n_load(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, TABLE*, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_trigger.cc:1854:27

    #15 0x5e4547f1552c in open_table_entry_fini(THD*, TABLE_SHARE*, TABLE*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_base.cc:3310:7

    #16 0x5e4547f128d4 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_base.cc:2344:9

    #17 0x5e4547f1ff2a in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_base.cc:4273:14

    #18 0x5e4547f1ff2a in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_base.cc:4756:14

    #19 0x5e4547f2a648 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_base.cc:5797:7

    #20 0x5e45479e27de in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_base.h:537:10

    #21 0x5e45483f5a17 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_parse.cc:6093:14

    #22 0x5e45483d77f0 in mysql_execute_command(THD*, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_parse.cc:3951:12

    #23 0x5e45483b9780 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_parse.cc:7895:18

    #24 0x5e45483b0ad0 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_parse.cc:1878:7

    #25 0x5e45483bba46 in do_command(THD*, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_parse.cc:1417:17

    #26 0x5e4548b1fa9c in do_handle_one_connection(CONNECT*, bool) /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_connect.cc:1503:11

    #27 0x5e4548b1f2f6 in handle_one_connection /test/mtest/MDEV-34391/12.3_opt_san/sql/sql_connect.cc:1415:5

    #28 0x5e454720368c in asan_thread_start(void*) crtstuff.c

    #29 0x79675009caa3 in start_thread nptl/pthread_create.c:447:8

    #30 0x796750129c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78