ASAN heap-use-after-free upon using a view through a trigger in ORACLE mode

SET sql_mode = ORACLE;

CREATE TABLE t1 (f INT);

CREATE TABLE t2 (a INT);

CREATE VIEW v AS SELECT 'x' UNION SELECT 'x' UNION SELECT 'x';

CREATE TRIGGER tr BEFORE INSERT ON t1 FOR EACH ROW DELETE FROM v;

--error ER_NON_UPDATABLE_TABLE

INSERT INTO t1 VALUES (1);

DROP VIEW v;

CREATE VIEW v AS SELECT * FROM t2;

INSERT INTO t1 VALUES (2);

DROP VIEW v;

DROP TABLE t1, t2;

==3645696==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000266508 at pc 0x560d5809ea81 bp 0x7f854b6f9c60 sp 0x7f854b6f9c58

READ of size 8 at 0x625000266508 thread T5

    #0 0x560d5809ea80 in mysql_derived_prepare /data/bld/11.4-asan-ubsan/sql/sql_derived.cc:927

    #1 0x560d5809f9d3 in mysql_derived_merge_for_insert /data/bld/11.4-asan-ubsan/sql/sql_derived.cc:517

    #2 0x560d58093146 in mysql_handle_derived(LEX*, unsigned int) /data/bld/11.4-asan-ubsan/sql/sql_derived.cc:126

    #3 0x560d5806cf4f in Sql_cmd_delete::prepare_inner(THD*) /data/bld/11.4-asan-ubsan/sql/sql_delete.cc:1687

    #4 0x560d5843c99a in Sql_cmd_dml::prepare(THD*) /data/bld/11.4-asan-ubsan/sql/sql_select.cc:34487

    #5 0x560d584462cf in Sql_cmd_dml::execute(THD*) /data/bld/11.4-asan-ubsan/sql/sql_select.cc:34541

    #6 0x560d582b65b5 in mysql_execute_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:4461

    #7 0x560d58ef60e1 in sp_instr_stmt::exec_core(THD*, unsigned int*) /data/bld/11.4-asan-ubsan/sql/sp_instr.cc:1157

    #8 0x560d58f0afac in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*, bool) /data/bld/11.4-asan-ubsan/sql/sp_instr.cc:333

    #9 0x560d58f17e1d in sp_lex_keeper::validate_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /data/bld/11.4-asan-ubsan/sql/sp_instr.cc:512

    #10 0x560d58f1a8a3 in sp_instr_stmt::execute(THD*, unsigned int*) /data/bld/11.4-asan-ubsan/sql/sp_instr.cc:1060

    #11 0x560d57ddc022 in sp_head::execute(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sp_head.cc:1286

    #12 0x560d57de2017 in sp_head::execute_trigger(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_grant_info*) /data/bld/11.4-asan-ubsan/sql/sp_head.cc:1799

    #13 0x560d5884de94 in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/bld/11.4-asan-ubsan/sql/sql_trigger.cc:2534

    #14 0x560d57f2a190 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/bld/11.4-asan-ubsan/sql/sql_base.cc:9516

    #15 0x560d5812261c in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/11.4-asan-ubsan/sql/sql_insert.cc:1177

    #16 0x560d582b82bb in mysql_execute_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:4517

    #17 0x560d582cfe5a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:7945

    #18 0x560d582d924a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:1925

    #19 0x560d582e60f2 in do_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:1433

    #20 0x560d58b1157f in do_handle_one_connection(CONNECT*, bool) /data/bld/11.4-asan-ubsan/sql/sql_connect.cc:1497

    #21 0x560d58b126dc in handle_one_connection /data/bld/11.4-asan-ubsan/sql/sql_connect.cc:1409

    #22 0x560d5a566f74 in pfs_spawn_thread /data/bld/11.4-asan-ubsan/storage/perfschema/pfs.cc:2201

    #23 0x7f85576a81c3 in start_thread nptl/pthread_create.c:442

    #24 0x7f855772885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x625000266508 is located 7176 bytes inside of 8184-byte region [0x625000264900,0x6250002668f8)

freed by thread T5 here:

    #0 0x7f8557eb76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52

    #1 0x560d5b821e27 in my_free /data/bld/11.4-asan-ubsan/mysys/my_malloc.c:218

    #2 0x560d5b7f51a8 in root_free /data/bld/11.4-asan-ubsan/mysys/my_alloc.c:77

    #3 0x560d5b7f71ae in free_root /data/bld/11.4-asan-ubsan/mysys/my_alloc.c:511

    #4 0x560d57ddd56f in sp_head::execute(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sp_head.cc:1380

    #5 0x560d57de2017 in sp_head::execute_trigger(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_grant_info*) /data/bld/11.4-asan-ubsan/sql/sp_head.cc:1799

    #6 0x560d5884de94 in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/bld/11.4-asan-ubsan/sql/sql_trigger.cc:2534

    #7 0x560d57f2a190 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/bld/11.4-asan-ubsan/sql/sql_base.cc:9516

    #8 0x560d5812261c in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/11.4-asan-ubsan/sql/sql_insert.cc:1177

    #9 0x560d582b82bb in mysql_execute_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:4517

    #10 0x560d582cfe5a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:7945

    #11 0x560d582d924a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:1925

    #12 0x560d582e60f2 in do_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:1433

    #13 0x560d58b1157f in do_handle_one_connection(CONNECT*, bool) /data/bld/11.4-asan-ubsan/sql/sql_connect.cc:1497

    #14 0x560d58b126dc in handle_one_connection /data/bld/11.4-asan-ubsan/sql/sql_connect.cc:1409

    #15 0x560d5a566f74 in pfs_spawn_thread /data/bld/11.4-asan-ubsan/storage/perfschema/pfs.cc:2201

    #16 0x7f85576a81c3 in start_thread nptl/pthread_create.c:442

previously allocated by thread T5 here:

    #0 0x7f8557eb89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x560d5b8216cd in my_malloc /data/bld/11.4-asan-ubsan/mysys/my_malloc.c:93

    #2 0x560d5b7f5034 in root_alloc /data/bld/11.4-asan-ubsan/mysys/my_alloc.c:66

    #3 0x560d5b7f6632 in alloc_root /data/bld/11.4-asan-ubsan/mysys/my_alloc.c:335

    #4 0x560d582e9bee in Query_arena::memdup_w_gap(void const*, unsigned long, unsigned long) const /data/bld/11.4-asan-ubsan/sql/sql_class.h:1307

    #5 0x560d5827296b in alloc_query(THD*, char const*, unsigned long) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:2797

    #6 0x560d58f1a223 in sp_instr_stmt::execute(THD*, unsigned int*) /data/bld/11.4-asan-ubsan/sql/sp_instr.cc:1047

    #7 0x560d57ddc022 in sp_head::execute(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sp_head.cc:1286

    #8 0x560d57de2017 in sp_head::execute_trigger(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_grant_info*) /data/bld/11.4-asan-ubsan/sql/sp_head.cc:1799

    #9 0x560d5884de94 in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/bld/11.4-asan-ubsan/sql/sql_trigger.cc:2534

    #10 0x560d57f2a190 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/bld/11.4-asan-ubsan/sql/sql_base.cc:9516

    #11 0x560d5812261c in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/11.4-asan-ubsan/sql/sql_insert.cc:1177

    #12 0x560d582b82bb in mysql_execute_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:4517

    #13 0x560d582cfe5a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:7945

    #14 0x560d582d924a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:1925

    #15 0x560d582e60f2 in do_command(THD*, bool) /data/bld/11.4-asan-ubsan/sql/sql_parse.cc:1433

    #16 0x560d58b1157f in do_handle_one_connection(CONNECT*, bool) /data/bld/11.4-asan-ubsan/sql/sql_connect.cc:1497

    #17 0x560d58b126dc in handle_one_connection /data/bld/11.4-asan-ubsan/sql/sql_connect.cc:1409

    #18 0x560d5a566f74 in pfs_spawn_thread /data/bld/11.4-asan-ubsan/storage/perfschema/pfs.cc:2201

    #19 0x7f85576a81c3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f8557e49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x560d5a55c840 in my_thread_create /data/bld/11.4-asan-ubsan/storage/perfschema/my_thread.h:52

    #2 0x560d5a564168 in pfs_spawn_thread_v1 /data/bld/11.4-asan-ubsan/storage/perfschema/pfs.cc:2252

    #3 0x560d57b49980 in inline_mysql_thread_create /data/bld/11.4-asan-ubsan/include/mysql/psi/mysql_thread.h:1139

    #4 0x560d57b49980 in create_thread_to_handle_connection(CONNECT*) /data/bld/11.4-asan-ubsan/sql/mysqld.cc:6177

    #5 0x560d57b5ba87 in create_new_thread(CONNECT*) /data/bld/11.4-asan-ubsan/sql/mysqld.cc:6239

    #6 0x560d57b5bca5 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/11.4-asan-ubsan/sql/mysqld.cc:6301

    #7 0x560d57b5c8e6 in handle_connections_sockets() /data/bld/11.4-asan-ubsan/sql/mysqld.cc:6413

    #8 0x560d57b5cd92 in run_main_loop /data/bld/11.4-asan-ubsan/sql/mysqld.cc:5656

    #9 0x560d57b5e335 in mysqld_main(int, char**) /data/bld/11.4-asan-ubsan/sql/mysqld.cc:6078

    #10 0x560d57b30ad1 in main /data/bld/11.4-asan-ubsan/sql/main.cc:34

    #11 0x7f8557646249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/11.4-asan-ubsan/sql/sql_derived.cc:927 in mysql_derived_prepare

Shadow bytes around the buggy address:

  0x0c4a80044c50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044c60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c4a80044ca0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044ce0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044cf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==3645696==ABORTING

commit f55deca2b2fd3a864e46e210a793084d301180bd

Merge: d046c6aae2a 8d15311b90e

Author: Marko Mäkelä

Date:   Thu Feb 19 11:19:00 2026 +0200

    Merge 10.11 into 11.4

commit 9aa8cf3420fdb019ecf68fbda5cee0367727d300

Author: Aleksey Midenkov

Date:   Wed Feb 11 19:09:08 2026 +0300

    MDEV-38799 Some views are broken in Oracle mode after upgrade to Q1 2026

mysqltest: At line 8: query 'INSERT INTO t1 VALUES (1)' failed with wrong errno ER_VIEW_INVALID (1356): 'View 'test.v' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them', instead of ER_NON_UPDATABLE_TABLE (1288)...