[MDEV-38561] ASAN heap-use-after-free in Query_arena::free_items/sp_lex_cursor::~sp_lex_cursor - Jira

XML

Word

Printable

Details

Type: Bug
Status: In Progress (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 11.4, 11.8, 12.2
Fix Version/s: 11.4, 11.8, 12.2
Component/s: Stored routines
Labels:
- Oracle

Description

set sql_mode='oracle';

--delimiter //

CREATE OR REPLACE  PACKAGE a as

procedure p1 ();

procedure p2 ();

end a;

//

CREATE OR REPLACE PACKAGE BODY a AS

PROCEDURE p1() is

CURSOR c IS SELECT a FROM t1;

va c%ROWTYPE;

  BEGIN

    select 1;

end p1;

PROCEDURE p2() is

BEGIN

FOR i IN 1..10

LOOP

    SELECT i;

    CREATE OR REPLACE temporary TABLE t1 (a INT);

    CALL a.p1;

    CALL a.p1;

  END loop;

END p2;

end a//

--delimiter ;

call a.p2();

2026-01-15  9:16:14 0 [Note] Starting MariaDB 11.4.10-MariaDB-asan-debug-log source revision ab2e0d4f0d27803fb331b9d052f0dfe711a0e60c

Version: '11.4.10-MariaDB-asan-debug-log'

=================================================================

==4192045==ERROR: AddressSanitizer: heap-use-after-free on address 0x525000485e60 at pc 0x5990e7233066 bp 0x7ed1a1c74cd0 sp 0x7ed1a1c74cc0

READ of size 8 at 0x525000485e60 thread T11

    #0 0x5990e7233065 in Query_arena::free_items() /11.4/src/sql/sql_class.cc:4080

    #1 0x5990e7c116eb in sp_lex_cursor::~sp_lex_cursor() /11.4/src/sql/sp_instr.h:33

    #2 0x5990e7c11739 in sp_lex_cursor::~sp_lex_cursor() /11.4/src/sql/sp_instr.h:33

    #3 0x5990e710d0f1 in sp_lex_keeper::~sp_lex_keeper() /11.4/src/sql/sp_instr.h:286

    #4 0x5990e710d303 in sp_lex_instr::~sp_lex_instr() /11.4/src/sql/sp_instr.h:424

    #5 0x5990e7aa2184 in sp_instr_cpush::~sp_instr_cpush() /11.4/src/sql/sp_instr.h:1281

    #6 0x5990e7aa21b1 in sp_instr_cpush::~sp_instr_cpush() /11.4/src/sql/sp_instr.h:1281

    #7 0x5990e70ef7d1 in sp_head::~sp_head() /11.4/src/sql/sp_head.cc:902

    #8 0x5990e70ef9f9 in sp_head::~sp_head() /11.4/src/sql/sp_head.cc:921

    #9 0x5990e70eb1ef in sp_head::destroy(sp_head*) /11.4/src/sql/sp_head.cc:536

    #10 0x5990e72e80aa in lex_end_nops(LEX*) /11.4/src/sql/sql_lex.cc:1381

    #11 0x5990e72e7c36 in lex_end(LEX*) /11.4/src/sql/sql_lex.cc:1350

    #12 0x5990e70eface in sp_package::LexList::cleanup() /11.4/src/sql/sp_head.cc:929

    #13 0x5990e70ec6c7 in sp_package::~sp_package() /11.4/src/sql/sp_head.cc:650

    #14 0x5990e70ec837 in sp_package::~sp_package() /11.4/src/sql/sp_head.cc:656

    #15 0x5990e70eb1ef in sp_head::destroy(sp_head*) /11.4/src/sql/sp_head.cc:536

    #16 0x5990e70e6828 in hash_free_sp_head /11.4/src/sql/sp_cache.cc:284

    #17 0x5990e9347fd1 in my_hash_free_elements /11.4/src/mysys/hash.c:135

    #18 0x5990e934835b in my_hash_reset /11.4/src/mysys/hash.c:178

    #19 0x5990e70e6941 in sp_cache::clear() /11.4/src/sql/sp_cache.cc:316

    #20 0x5990e70e6ab1 in Sp_caches::sp_caches_empty() /11.4/src/sql/sp_cache.cc:336

    #21 0x5990e7372cf8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.4/src/sql/sql_parse.cc:2457

    #22 0x5990e736c5c4 in do_command(THD*, bool) /11.4/src/sql/sql_parse.cc:1433

    #23 0x5990e78768ea in do_handle_one_connection(CONNECT*, bool) /11.4/src/sql/sql_connect.cc:1497

    #24 0x5990e787643d in handle_one_connection /11.4/src/sql/sql_connect.cc:1409

    #25 0x5990e855984f in pfs_spawn_thread /11.4/src/storage/perfschema/pfs.cc:2201

    #26 0x7ed1b9c5ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #27 0x7ed1b8e9caa3 in start_thread nptl/pthread_create.c:447

    #28 0x7ed1b8f29c6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x525000485e60 is located 1376 bytes inside of 8184-byte region [0x525000485900,0x5250004878f8)

freed by thread T11 here:

    #0 0x7ed1b9cfc4d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52

    #1 0x5990e93b8792 in my_free /11.4/src/mysys/my_malloc.c:218

    #2 0x5990e9389b4d in root_free /11.4/src/mysys/my_alloc.c:77

    #3 0x5990e938c6a5 in free_root /11.4/src/mysys/my_alloc.c:517

    #4 0x5990e710d2c2 in sp_lex_instr::~sp_lex_instr() /11.4/src/sql/sp_instr.h:421

    #5 0x5990e7aa1e2a in sp_instr_cursor_copy_struct::~sp_instr_cursor_copy_struct() /11.4/src/sql/sp_instr.h:1434

    #6 0x5990e7aa1e49 in sp_instr_cursor_copy_struct::~sp_instr_cursor_copy_struct() /11.4/src/sql/sp_instr.h:1434

    #7 0x5990e70ef7d1 in sp_head::~sp_head() /11.4/src/sql/sp_head.cc:902

    #8 0x5990e70ef9f9 in sp_head::~sp_head() /11.4/src/sql/sp_head.cc:921

    #9 0x5990e70eb1ef in sp_head::destroy(sp_head*) /11.4/src/sql/sp_head.cc:536

    #10 0x5990e72e80aa in lex_end_nops(LEX*) /11.4/src/sql/sql_lex.cc:1381

    #11 0x5990e72e7c36 in lex_end(LEX*) /11.4/src/sql/sql_lex.cc:1350

    #12 0x5990e70eface in sp_package::LexList::cleanup() /11.4/src/sql/sp_head.cc:929

    #13 0x5990e70ec6c7 in sp_package::~sp_package() /11.4/src/sql/sp_head.cc:650

    #14 0x5990e70ec837 in sp_package::~sp_package() /11.4/src/sql/sp_head.cc:656

    #15 0x5990e70eb1ef in sp_head::destroy(sp_head*) /11.4/src/sql/sp_head.cc:536

    #16 0x5990e70e6828 in hash_free_sp_head /11.4/src/sql/sp_cache.cc:284

    #17 0x5990e9347fd1 in my_hash_free_elements /11.4/src/mysys/hash.c:135

    #18 0x5990e934835b in my_hash_reset /11.4/src/mysys/hash.c:178

    #19 0x5990e70e6941 in sp_cache::clear() /11.4/src/sql/sp_cache.cc:316

    #20 0x5990e70e6ab1 in Sp_caches::sp_caches_empty() /11.4/src/sql/sp_cache.cc:336

    #21 0x5990e7372cf8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.4/src/sql/sql_parse.cc:2457

    #22 0x5990e736c5c4 in do_command(THD*, bool) /11.4/src/sql/sql_parse.cc:1433

    #23 0x5990e78768ea in do_handle_one_connection(CONNECT*, bool) /11.4/src/sql/sql_connect.cc:1497

    #24 0x5990e787643d in handle_one_connection /11.4/src/sql/sql_connect.cc:1409

    #25 0x5990e855984f in pfs_spawn_thread /11.4/src/storage/perfschema/pfs.cc:2201

    #26 0x7ed1b9c5ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #27 0x7ed1b8e9caa3 in start_thread nptl/pthread_create.c:447

previously allocated by thread T11 here:

    #0 0x7ed1b9cfd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x5990e93b7893 in my_malloc /11.4/src/mysys/my_malloc.c:93

    #2 0x5990e9389ac5 in root_alloc /11.4/src/mysys/my_alloc.c:66

    #3 0x5990e938a30e in init_alloc_root /11.4/src/mysys/my_alloc.c:178

    #4 0x5990e77c26c4 in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /11.4/src/sql/thr_malloc.cc:64

    #5 0x5990e7a92a23 in sp_lex_instr::setup_memroot_for_reparsing(sp_head*, bool*) /11.4/src/sql/sp_instr.cc:788

    #6 0x5990e7a92fe7 in sp_lex_instr::parse_expr(THD*, sp_head*, LEX*) /11.4/src/sql/sp_instr.cc:856

    #7 0x5990e7a91527 in sp_lex_keeper::validate_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /11.4/src/sql/sp_instr.cc:485

    #8 0x5990e7a91bdc in sp_lex_keeper::cursor_reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /11.4/src/sql/sp_instr.cc:567

    #9 0x5990e7a9ce32 in sp_instr_cursor_copy_struct::execute(THD*, unsigned int*) /11.4/src/sql/sp_instr.cc:2184

    #10 0x5990e70f1dba in sp_head::execute(THD*, bool) /11.4/src/sql/sp_head.cc:1286

    #11 0x5990e70f830c in sp_head::execute_procedure(THD*, List<Item>*) /11.4/src/sql/sp_head.cc:2305

    #12 0x5990e7376e5b in do_execute_sp /11.4/src/sql/sql_parse.cc:3094

    #13 0x5990e7378b0c in Sql_cmd_call::execute(THD*) /11.4/src/sql/sql_parse.cc:3317

    #14 0x5990e738beb7 in mysql_execute_command(THD*, bool) /11.4/src/sql/sql_parse.cc:5916

    #15 0x5990e7a94f9e in sp_instr_stmt::exec_core(THD*, unsigned int*) /11.4/src/sql/sp_instr.cc:1157

    #16 0x5990e7a90588 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*, bool) /11.4/src/sql/sp_instr.cc:333

    #17 0x5990e7a917d7 in sp_lex_keeper::validate_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /11.4/src/sql/sp_instr.cc:512

    #18 0x5990e7a946da in sp_instr_stmt::execute(THD*, unsigned int*) /11.4/src/sql/sp_instr.cc:1060

    #19 0x5990e70f1dba in sp_head::execute(THD*, bool) /11.4/src/sql/sp_head.cc:1286

    #20 0x5990e70f830c in sp_head::execute_procedure(THD*, List<Item>*) /11.4/src/sql/sp_head.cc:2305

    #21 0x5990e7376e5b in do_execute_sp /11.4/src/sql/sql_parse.cc:3094

    #22 0x5990e7378b0c in Sql_cmd_call::execute(THD*) /11.4/src/sql/sql_parse.cc:3317

    #23 0x5990e738beb7 in mysql_execute_command(THD*, bool) /11.4/src/sql/sql_parse.cc:5916

    #24 0x5990e73997f3 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.4/src/sql/sql_parse.cc:7945

    #25 0x5990e736f987 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.4/src/sql/sql_parse.cc:1923

    #26 0x5990e736c5c4 in do_command(THD*, bool) /11.4/src/sql/sql_parse.cc:1433

    #27 0x5990e78768ea in do_handle_one_connection(CONNECT*, bool) /11.4/src/sql/sql_connect.cc:1497

    #28 0x5990e787643d in handle_one_connection /11.4/src/sql/sql_connect.cc:1409

    #29 0x5990e855984f in pfs_spawn_thread /11.4/src/storage/perfschema/pfs.cc:2201

Thread T11 created by T0 here:

    #0 0x7ed1b9cf51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x5990e855540c in my_thread_create /11.4/src/storage/perfschema/my_thread.h:52

    #2 0x5990e8559c42 in pfs_spawn_thread_v1 /11.4/src/storage/perfschema/pfs.cc:2252

    #3 0x5990e6f7237b in inline_mysql_thread_create /11.4/src/include/mysql/psi/mysql_thread.h:1139

    #4 0x5990e6f8b2bd in create_thread_to_handle_connection(CONNECT*) /11.4/src/sql/mysqld.cc:6177

    #5 0x5990e6f8b928 in create_new_thread(CONNECT*) /11.4/src/sql/mysqld.cc:6239

    #6 0x5990e6f8bc55 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.4/src/sql/mysqld.cc:6301

    #7 0x5990e6f8c966 in handle_connections_sockets() /11.4/src/sql/mysqld.cc:6413

    #8 0x5990e6f892ec in run_main_loop /11.4/src/sql/mysqld.cc:5656

    #9 0x5990e6f8aaf3 in mysqld_main(int, char**) /11.4/src/sql/mysqld.cc:6078

    #10 0x5990e6f7161c in main /11.4/src/sql/main.cc:34

    #11 0x7ed1b8e2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    #12 0x7ed1b8e2a28a in __libc_start_main_impl ../csu/libc-start.c:360

    #13 0x5990e6f71534 in _start (/11.4-bld/sql/mariadbd+0x1a57534) (BuildId: 715b092f16e0103b4f6076d1b81a1278ced98fc1)

SUMMARY: AddressSanitizer: heap-use-after-free /11.4/src/sql/sql_class.cc:4080 in Query_arena::free_items()

Shadow bytes around the buggy address:

  0x525000485b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000485c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000485c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000485d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000485d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x525000485e00: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd

  0x525000485e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000485f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000485f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000486000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x525000486080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==4192045==ABORTING

Attachments

Issue Links

relates to

MDEV-36462 Crash on `DECLARE spvar1 ROW TYPE OF cursor1` after a table recreation

Closed

Activity

People

Assignee:: Dmitry Shulga

Reporter:: Alice Sherepa

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-01-15 08:24

Updated:: Yesterday 10:40

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.