Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.6, 10.11, 11.4, 11.8, 12.2
-
None
Description
CREATE TEMPORARY TABLE tmp (a INT); |
--delimiter $
|
CREATE FUNCTION f() RETURNS INT |
BEGIN
|
INSERT INTO tmp VALUES (1); |
RETURN 0; |
END $ |
--delimiter ;
|
--error ER_CANT_REOPEN_TABLE
|
CREATE OR REPLACE TEMPORARY TABLE tmp SELECT f() AS x; |
CREATE OR REPLACE TEMPORARY TABLE tmp SELECT f() AS f1 FROM (SELECT 1) sq; |
|
|
# Cleanup
|
DROP FUNCTION f; |
|
10.11 c69ea9b286aceee1e72ffe3713db543633115cbe |
=================================================================
|
==2009030==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000059ba0 at pc 0x55cdaad50655 bp 0x7fb5904c0380 sp 0x7fb5904c0378
|
READ of size 8 at 0x619000059ba0 thread T5
|
#0 0x55cdaad50654 in find_select_handler(THD*, st_select_lex*) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:5146
|
#1 0x55cdaaec2e2e in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:5269
|
#2 0x55cdaaec40e5 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:601
|
#3 0x55cdab0c3130 in Sql_cmd_create_table_like::execute(THD*) /data/bld/10.11-asan-ubsan/sql/sql_table.cc:13097
|
#4 0x55cdaabb4264 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:6201
|
#5 0x55cdaabb8aaf in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223
|
#6 0x55cdaabc1e5c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924
|
#7 0x55cdaabceb61 in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434
|
#8 0x55cdab3c9f05 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475
|
#9 0x55cdab3cb062 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387
|
#10 0x55cdacd4cde6 in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201
|
#11 0x7fb59a4a81c3 in start_thread nptl/pthread_create.c:442
|
#12 0x7fb59a52885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
|
|
0x619000059ba0 is located 32 bytes inside of 1016-byte region [0x619000059b80,0x619000059f78)
|
freed by thread T5 here:
|
#0 0x7fb59b8b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
|
#1 0x55cdae0069b9 in my_free /data/bld/10.11-asan-ubsan/mysys/my_malloc.c:217
|
#2 0x55cdab947dc5 in THD::close_temporary_table(TABLE*) /data/bld/10.11-asan-ubsan/sql/temporary_tables.cc:1269
|
#3 0x55cdab948777 in THD::free_temporary_table(TABLE*) /data/bld/10.11-asan-ubsan/sql/temporary_tables.cc:1519
|
#4 0x55cdab953488 in THD::drop_temporary_table(TABLE*, bool*, bool) /data/bld/10.11-asan-ubsan/sql/temporary_tables.cc:677
|
#5 0x55cdab09558c in create_table_impl /data/bld/10.11-asan-ubsan/sql/sql_table.cc:4638
|
#6 0x55cdab098710 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/bld/10.11-asan-ubsan/sql/sql_table.cc:4955
|
#7 0x55cdaa9f7513 in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:4910
|
#8 0x55cdaa9fa2af in select_create::prepare(List<Item>&, st_select_lex_unit*) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:5091
|
#9 0x55cdaae1e312 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:1837
|
#10 0x55cdaaec29b5 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:5256
|
#11 0x55cdaaec40e5 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:601
|
#12 0x55cdab0c3130 in Sql_cmd_create_table_like::execute(THD*) /data/bld/10.11-asan-ubsan/sql/sql_table.cc:13097
|
#13 0x55cdaabb4264 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:6201
|
#14 0x55cdaabb8aaf in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223
|
#15 0x55cdaabc1e5c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924
|
#16 0x55cdaabceb61 in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434
|
#17 0x55cdab3c9f05 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475
|
#18 0x55cdab3cb062 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387
|
#19 0x55cdacd4cde6 in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201
|
#20 0x7fb59a4a81c3 in start_thread nptl/pthread_create.c:442
|
|
|
previously allocated by thread T5 here:
|
#0 0x7fb59b8b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
|
#1 0x55cdae00625f in my_malloc /data/bld/10.11-asan-ubsan/mysys/my_malloc.c:92
|
#2 0x55cdab94705a in THD::open_temporary_table(TMP_TABLE_SHARE*, char const*) /data/bld/10.11-asan-ubsan/sql/temporary_tables.cc:1137
|
#3 0x55cdab953de7 in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool) /data/bld/10.11-asan-ubsan/sql/temporary_tables.cc:74
|
#4 0x55cdab097a4a in create_table_impl /data/bld/10.11-asan-ubsan/sql/sql_table.cc:4867
|
#5 0x55cdab098710 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/bld/10.11-asan-ubsan/sql/sql_table.cc:4955
|
#6 0x55cdab09a19c in mysql_create_table /data/bld/10.11-asan-ubsan/sql/sql_table.cc:5202
|
#7 0x55cdab0c3773 in Sql_cmd_create_table_like::execute(THD*) /data/bld/10.11-asan-ubsan/sql/sql_table.cc:13159
|
#8 0x55cdaabb4264 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:6201
|
#9 0x55cdaabb8aaf in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223
|
#10 0x55cdaabc1e5c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924
|
#11 0x55cdaabceb61 in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434
|
#12 0x55cdab3c9f05 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475
|
#13 0x55cdab3cb062 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387
|
#14 0x55cdacd4cde6 in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201
|
#15 0x7fb59a4a81c3 in start_thread nptl/pthread_create.c:442
|
|
|
Thread T5 created by T0 here:
|
#0 0x7fb59b849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x55cdacd426b2 in my_thread_create /data/bld/10.11-asan-ubsan/storage/perfschema/my_thread.h:52
|
#2 0x55cdacd49fda in pfs_spawn_thread_v1 /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2252
|
#3 0x55cdaa41a0ac in inline_mysql_thread_create /data/bld/10.11-asan-ubsan/include/mysql/psi/mysql_thread.h:1139
|
#4 0x55cdaa41a0ac in create_thread_to_handle_connection(CONNECT*) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6146
|
#5 0x55cdaa42bf36 in create_new_thread(CONNECT*) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6205
|
#6 0x55cdaa42c154 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6267
|
#7 0x55cdaa42cd95 in handle_connections_sockets() /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6390
|
#8 0x55cdaa42d241 in run_main_loop /data/bld/10.11-asan-ubsan/sql/mysqld.cc:5646
|
#9 0x55cdaa42e607 in mysqld_main(int, char**) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6047
|
#10 0x55cdaa401931 in main /data/bld/10.11-asan-ubsan/sql/main.cc:34
|
#11 0x7fb59a446249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/10.11-asan-ubsan/sql/sql_select.cc:5146 in find_select_handler(THD*, st_select_lex*)
|
Shadow bytes around the buggy address:
|
0x0c3280003320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3280003330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3280003340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
|
0x0c3280003350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3280003360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
=>0x0c3280003370: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3280003380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3280003390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c32800033a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c32800033b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c32800033c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==2009030==ABORTING
|
|
main ab82a782347601ca00ee9d723043db43152fa838 |
==2009242==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000059ba0 at pc 0x558f0a900eb9 bp 0x7f278b28fd40 sp 0x7f278b28fd38
|
READ of size 8 at 0x619000059ba0 thread T5
|
#0 0x558f0a900eb8 in find_select_handler_inner /data/bld/main-asan-ubsan/sql/sql_select.cc:5264
|
#1 0x558f0a9367db in find_single_select_handler(THD*, st_select_lex*) /data/bld/main-asan-ubsan/sql/sql_select.cc:5283
|
#2 0x558f0aaba5a2 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/main-asan-ubsan/sql/sql_select.cc:5423
|
#3 0x558f0aabba03 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/main-asan-ubsan/sql/sql_select.cc:636
|
#4 0x558f0accf673 in Sql_cmd_create_table_like::execute(THD*) /data/bld/main-asan-ubsan/sql/sql_table.cc:13732
|
#5 0x558f0a7907e8 in mysql_execute_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:5900
|
#6 0x558f0a79555e in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/main-asan-ubsan/sql/sql_parse.cc:7939
|
#7 0x558f0a79e674 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1896
|
#8 0x558f0a7ab628 in do_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1432
|
#9 0x558f0b000a97 in do_handle_one_connection(CONNECT*, bool) /data/bld/main-asan-ubsan/sql/sql_connect.cc:1503
|
#10 0x558f0b001c00 in handle_one_connection /data/bld/main-asan-ubsan/sql/sql_connect.cc:1415
|
#11 0x558f0cc3e222 in pfs_spawn_thread /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2198
|
#12 0x7f27972a81c3 in start_thread nptl/pthread_create.c:442
|
#13 0x7f279732885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
|
|
0x619000059ba0 is located 32 bytes inside of 1040-byte region [0x619000059b80,0x619000059f90)
|
freed by thread T5 here:
|
#0 0x7f27986b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
|
#1 0x558f0df14c35 in my_free /data/bld/main-asan-ubsan/mysys/my_malloc.c:218
|
#2 0x558f0b67a4e9 in THD::close_temporary_table(TABLE*) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:1352
|
#3 0x558f0b67bd6b in THD::free_temporary_table(TABLE*) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:1660
|
#4 0x558f0b686e61 in THD::drop_temporary_table(TABLE*, bool*, bool) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:727
|
#5 0x558f0acc1897 in create_table_impl /data/bld/main-asan-ubsan/sql/sql_table.cc:4736
|
#6 0x558f0acc4e27 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/bld/main-asan-ubsan/sql/sql_table.cc:5053
|
#7 0x558f0a5a6efb in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**) /data/bld/main-asan-ubsan/sql/sql_insert.cc:4988
|
#8 0x558f0a5a9b6f in select_create::prepare(List<Item>&, st_select_lex_unit*) /data/bld/main-asan-ubsan/sql/sql_insert.cc:5171
|
#9 0x558f0aa08b48 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/bld/main-asan-ubsan/sql/sql_select.cc:1879
|
#10 0x558f0aaba33b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/main-asan-ubsan/sql/sql_select.cc:5410
|
#11 0x558f0aabba03 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/main-asan-ubsan/sql/sql_select.cc:636
|
#12 0x558f0accf673 in Sql_cmd_create_table_like::execute(THD*) /data/bld/main-asan-ubsan/sql/sql_table.cc:13732
|
#13 0x558f0a7907e8 in mysql_execute_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:5900
|
#14 0x558f0a79555e in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/main-asan-ubsan/sql/sql_parse.cc:7939
|
#15 0x558f0a79e674 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1896
|
#16 0x558f0a7ab628 in do_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1432
|
#17 0x558f0b000a97 in do_handle_one_connection(CONNECT*, bool) /data/bld/main-asan-ubsan/sql/sql_connect.cc:1503
|
#18 0x558f0b001c00 in handle_one_connection /data/bld/main-asan-ubsan/sql/sql_connect.cc:1415
|
#19 0x558f0cc3e222 in pfs_spawn_thread /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2198
|
#20 0x7f27972a81c3 in start_thread nptl/pthread_create.c:442
|
|
|
previously allocated by thread T5 here:
|
#0 0x7f27986b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
|
#1 0x558f0df144db in my_malloc /data/bld/main-asan-ubsan/mysys/my_malloc.c:93
|
#2 0x558f0b679757 in THD::open_temporary_table(TMP_TABLE_SHARE*, Lex_ident_table const&) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:1220
|
#3 0x558f0b687835 in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, Lex_ident_db const&, Lex_ident_table const&, bool) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:124
|
#4 0x558f0acc411f in create_table_impl /data/bld/main-asan-ubsan/sql/sql_table.cc:4965
|
#5 0x558f0acc4e27 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/bld/main-asan-ubsan/sql/sql_table.cc:5053
|
#6 0x558f0accaab6 in mysql_create_table /data/bld/main-asan-ubsan/sql/sql_table.cc:5299
|
#7 0x558f0accfce2 in Sql_cmd_create_table_like::execute(THD*) /data/bld/main-asan-ubsan/sql/sql_table.cc:13794
|
#8 0x558f0a7907e8 in mysql_execute_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:5900
|
#9 0x558f0a79555e in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/main-asan-ubsan/sql/sql_parse.cc:7939
|
#10 0x558f0a79e674 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1896
|
#11 0x558f0a7ab628 in do_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1432
|
#12 0x558f0b000a97 in do_handle_one_connection(CONNECT*, bool) /data/bld/main-asan-ubsan/sql/sql_connect.cc:1503
|
#13 0x558f0b001c00 in handle_one_connection /data/bld/main-asan-ubsan/sql/sql_connect.cc:1415
|
#14 0x558f0cc3e222 in pfs_spawn_thread /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2198
|
#15 0x7f27972a81c3 in start_thread nptl/pthread_create.c:442
|
|
|
Thread T5 created by T0 here:
|
#0 0x7f2798649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x558f0cc3a1de in my_thread_create /data/bld/main-asan-ubsan/storage/perfschema/my_thread.h:38
|
#2 0x558f0cc3e69f in pfs_spawn_thread_v1 /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2249
|
#3 0x558f09f9e037 in inline_mysql_thread_create /data/bld/main-asan-ubsan/include/mysql/psi/mysql_thread.h:1139
|
#4 0x558f09f9e037 in create_thread_to_handle_connection(CONNECT*) /data/bld/main-asan-ubsan/sql/mysqld.cc:6280
|
#5 0x558f09fb0cb9 in create_new_thread(CONNECT*) /data/bld/main-asan-ubsan/sql/mysqld.cc:6342
|
#6 0x558f09fb0ee1 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/main-asan-ubsan/sql/mysqld.cc:6404
|
#7 0x558f09fb1b22 in handle_connections_sockets() /data/bld/main-asan-ubsan/sql/mysqld.cc:6516
|
#8 0x558f09fb1fce in run_main_loop /data/bld/main-asan-ubsan/sql/mysqld.cc:5758
|
#9 0x558f09fb3582 in mysqld_main(int, char**) /data/bld/main-asan-ubsan/sql/mysqld.cc:6181
|
#10 0x558f09f83d41 in main /data/bld/main-asan-ubsan/sql/main.cc:34
|
#11 0x7f2797246249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/main-asan-ubsan/sql/sql_select.cc:5264 in find_select_handler_inner
|
Shadow bytes around the buggy address:
|
0x0c3280003320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3280003330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3280003340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3280003350: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3280003360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
=>0x0c3280003370: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3280003380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3280003390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c32800033a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c32800033b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c32800033c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==2009242==ABORTING
|
Reproducible on all existing versions, including older releases (not a recent regression)