Server crashes in find_type2 / Field_enum::store upon returning ENUM from function

--delimiter $

CREATE FUNCTION f() RETURNS ENUM('YES','NO')

BEGIN

  DECLARE v_enabled ENUM('YES', 'NO');

  SET v_enabled = 'YES';

  RETURN v_enabled;

END $

--delimiter ;

CREATE TABLE t (a INT);

CREATE TRIGGER tr AFTER INSERT ON t FOR EACH ROW 

  CREATE OR REPLACE TEMPORARY TABLE tmp AS SELECT f();

INSERT INTO t VALUES (1);

INSERT INTO t VALUES (2);

DROP TABLE t;

DROP FUNCTION f;

==800758==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000267fa8 at pc 0x55ceeb955047 bp 0x7f6ac82b86e0 sp 0x7f6ac82b86d8

READ of size 4 at 0x625000267fa8 thread T5

    #0 0x55ceeb955046 in find_type2(st_typelib const*, char const*, unsigned long, charset_info_st const*) /data/bld/10.11-asan-ubsan/sql/strfunc.cc:169

    #1 0x55ceec4d4c99 in Field_enum::store(char const*, unsigned long, charset_info_st const*) /data/bld/10.11-asan-ubsan/sql/field.cc:9450

    #2 0x55ceebabb73a in Field::save_in_field_str(Field*) /data/bld/10.11-asan-ubsan/sql/field.h:770

    #3 0x55ceec52feae in Field_enum::save_in_field(Field*) /data/bld/10.11-asan-ubsan/sql/field.h:4837

    #4 0x55ceec53a2d3 in Field_enum::store_field(Field*) /data/bld/10.11-asan-ubsan/sql/field.h:4831

    #5 0x55ceec5401b9 in field_conv_incompatible /data/bld/10.11-asan-ubsan/sql/field_conv.cc:901

    #6 0x55ceec54f0d4 in field_conv(Field*, Field*) /data/bld/10.11-asan-ubsan/sql/field_conv.cc:914

    #7 0x55ceec6651d0 in save_field_in_field /data/bld/10.11-asan-ubsan/sql/item.cc:6973

    #8 0x55ceec665936 in Item_field::save_in_field(Field*, bool) /data/bld/10.11-asan-ubsan/sql/item.cc:7023

    #9 0x55ceec4688b3 in Field::sp_prepare_and_store_item(THD*, Item**) /data/bld/10.11-asan-ubsan/sql/field.cc:1511

    #10 0x55ceeadec838 in THD::sp_eval_expr(Field*, Item**) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:453

    #11 0x55ceeae65d3c in sp_rcontext::set_return_value(THD*, Item**) /data/bld/10.11-asan-ubsan/sql/sp_rcontext.cc:440

    #12 0x55ceeadd7f11 in sp_instr_freturn::exec_core(THD*, unsigned int*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:4373

    #13 0x55ceeae10548 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3661

    #14 0x55ceeae157d7 in sp_instr_freturn::execute(THD*, unsigned int*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:4330

    #15 0x55ceeae24888 in sp_head::execute(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:1464

    #16 0x55ceeae325d5 in sp_head::execute_function(THD*, Item**, unsigned int, Field*, sp_rcontext**, Query_arena*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:2228

    #17 0x55ceec6a33cc in Item_sp::execute_impl(THD*, Item**, unsigned int) /data/bld/10.11-asan-ubsan/sql/item.cc:3003

    #18 0x55ceec6a45b1 in Item_sp::execute(THD*, bool*, Item**, unsigned int) /data/bld/10.11-asan-ubsan/sql/item.cc:2917

    #19 0x55ceec9aea8f in Item_func_sp::execute() /data/bld/10.11-asan-ubsan/sql/item_func.cc:6726

    #20 0x55ceeca009c1 in Item_func_sp::val_str(String*) (/share8t/bld/10.11-asan-ubsan/sql/mariadbd+0x979a9c1)

    #21 0x55ceec6cf851 in Item::save_str_in_field(Field*, bool) /data/bld/10.11-asan-ubsan/sql/item.cc:7078

    #22 0x55ceebeb29a5 in Type_handler_string_result::Item_save_in_field(Item*, Field*, bool) const /data/bld/10.11-asan-ubsan/sql/sql_type.cc:4412

    #23 0x55ceec659ba9 in Item::save_in_field(Field*, bool) /data/bld/10.11-asan-ubsan/sql/item.cc:7136

    #24 0x55ceeaf7e8fd in fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool, bool) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9403

    #25 0x55ceeaf7f638 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9458

    #26 0x55ceeb110b7b in select_create::store_values(List<Item>&) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:5326

    #27 0x55ceeb136443 in select_insert::send_data(List<Item>&) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:4432

    #28 0x55ceeb64f616 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /data/bld/10.11-asan-ubsan/sql/sql_class.h:6065

    #29 0x55ceeb63440e in JOIN::exec_inner() /data/bld/10.11-asan-ubsan/sql/sql_select.cc:4890

    #30 0x55ceeb636cd8 in JOIN::exec() /data/bld/10.11-asan-ubsan/sql/sql_select.cc:4807

    #31 0x55ceeb62dd26 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:5285

    #32 0x55ceeb62ecc3 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/10.11-asan-ubsan/sql/sql_select.cc:601

    #33 0x55ceeb82e92c in Sql_cmd_create_table_like::execute(THD*) /data/bld/10.11-asan-ubsan/sql/sql_table.cc:13105

    #34 0x55ceeb31eb20 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:6201

    #35 0x55ceeadd6ed1 in sp_instr_stmt::exec_core(THD*, unsigned int*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3950

    #36 0x55ceeae10548 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3661

    #37 0x55ceeae13ae5 in sp_instr_stmt::execute(THD*, unsigned int*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3853

    #38 0x55ceeae24888 in sp_head::execute(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:1464

    #39 0x55ceeae2a87d in sp_head::execute_trigger(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_grant_info*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:1977

    #40 0x55ceeb87730a in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/bld/10.11-asan-ubsan/sql/sql_trigger.cc:2496

    #41 0x55ceeb17ea8d in Write_record::after_ins_trg() /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:2479

    #42 0x55ceeb17f14d in Write_record::after_insert(unsigned long long*) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:2471

    #43 0x55ceeb132bd8 in Write_record::single_insert(unsigned long long*) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:2332

    #44 0x55ceeb135ee8 in Write_record::write_record() /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:2362

    #45 0x55ceeb174c9f in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:1216

    #46 0x55ceeb30858c in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4662

    #47 0x55ceeb32336b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223

    #48 0x55ceeb32c718 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924

    #49 0x55ceeb33941d in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434

    #50 0x55ceebb35db7 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475

    #51 0x55ceebb36f14 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387

    #52 0x55ceed4bc326 in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

    #53 0x7f6ad2ea81c3 in start_thread nptl/pthread_create.c:442

    #54 0x7f6ad2f2885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x625000267fa8 is located 3752 bytes inside of 8184-byte region [0x625000267100,0x6250002690f8)

freed by thread T5 here:

    #0 0x7f6ad38b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52

    #1 0x55ceee778314 in my_free /data/bld/10.11-asan-ubsan/mysys/my_malloc.c:217

    #2 0x55ceee74bc3d in root_free /data/bld/10.11-asan-ubsan/mysys/my_alloc.c:77

    #3 0x55ceee74dd19 in free_root /data/bld/10.11-asan-ubsan/mysys/my_alloc.c:517

    #4 0x55ceeaded26c in sp_head::destroy(sp_head*) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:543

    #5 0x55ceeadd2ae6 in hash_free_sp_head /data/bld/10.11-asan-ubsan/sql/sp_cache.cc:284

    #6 0x55ceee70a271 in my_hash_free_elements /data/bld/10.11-asan-ubsan/mysys/hash.c:135

    #7 0x55ceee70b0cb in my_hash_reset /data/bld/10.11-asan-ubsan/mysys/hash.c:178

    #8 0x55ceeadd40fa in sp_cache::clear() /data/bld/10.11-asan-ubsan/sql/sp_cache.cc:316

    #9 0x55ceeadd425a in Sp_caches::sp_caches_empty() /data/bld/10.11-asan-ubsan/sql/sp_cache.cc:332

    #10 0x55ceeb33485a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:2458

    #11 0x55ceeb33941d in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434

    #12 0x55ceebb35db7 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475

    #13 0x55ceebb36f14 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387

    #14 0x55ceed4bc326 in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

    #15 0x7f6ad2ea81c3 in start_thread nptl/pthread_create.c:442

previously allocated by thread T5 here:

    #0 0x7f6ad38b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55ceee777bba in my_malloc /data/bld/10.11-asan-ubsan/mysys/my_malloc.c:92

    #2 0x55ceee74bac9 in root_alloc /data/bld/10.11-asan-ubsan/mysys/my_alloc.c:66

    #3 0x55ceee74c07c in init_alloc_root /data/bld/10.11-asan-ubsan/mysys/my_alloc.c:178

    #4 0x55ceeb9fa1e6 in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /data/bld/10.11-asan-ubsan/sql/thr_malloc.cc:64

    #5 0x55ceeadf063b in sp_head::create(sp_package*, Sp_handler const*, enum_sp_aggregate_type) /data/bld/10.11-asan-ubsan/sql/sp_head.cc:522

    #6 0x55ceeb2104dc in LEX::make_sp_head(THD*, sp_name const*, Sp_handler const*, enum_sp_aggregate_type) /data/bld/10.11-asan-ubsan/sql/sql_lex.cc:7547

    #7 0x55ceeb2119c6 in LEX::make_sp_head_no_recursive(THD*, sp_name const*, Sp_handler const*, enum_sp_aggregate_type) /data/bld/10.11-asan-ubsan/sql/sql_lex.cc:7590

    #8 0x55ceeb23cbeb in LEX::stmt_create_stored_function_start(DDL_options_st const&, enum_sp_aggregate_type, sp_name const*) /data/bld/10.11-asan-ubsan/sql/sql_lex.cc:11874

    #9 0x55ceec24bb30 in MYSQLparse(THD*) /data/bld/10.11-asan-ubsan/sql/sql_yacc.yy:18353

    #10 0x55ceeb2f5d68 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:10624

    #11 0x55ceecfd6a43 in sp_compile /data/bld/10.11-asan-ubsan/sql/sp.cc:875

    #12 0x55ceecfdc5fc in Sp_handler::db_load_routine(THD*, Database_qualified_name const*, sp_head**, unsigned long long, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_sp_chistics const&, AUTHID const&, long long, long long, sp_package*, Stored_program_creation_ctx*) const /data/bld/10.11-asan-ubsan/sql/sp.cc:1002

    #13 0x55ceecfdff13 in Sp_handler::db_find_routine(THD*, Database_qualified_name const*, sp_head**) const /data/bld/10.11-asan-ubsan/sql/sp.cc:765

    #14 0x55ceecfe047c in Sp_handler::db_find_and_cache_routine(THD*, Database_qualified_name const*, sp_head**) const /data/bld/10.11-asan-ubsan/sql/sp.cc:788

    #15 0x55ceecfe0d53 in Sp_handler::sp_cache_routine(THD*, Database_qualified_name const*, sp_head**) const /data/bld/10.11-asan-ubsan/sql/sp.cc:2831

    #16 0x55ceecff9f27 in Sroutine_hash_entry::sp_cache_routine(THD*, sp_head**) const /data/bld/10.11-asan-ubsan/sql/sp.cc:2789

    #17 0x55ceeaf4bffc in open_and_process_routine /data/bld/10.11-asan-ubsan/sql/sql_base.cc:3865

    #18 0x55ceeafa3f0f in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:4787

    #19 0x55ceeafa70ba in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:5718

    #20 0x55ceeae51e0d in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/bld/10.11-asan-ubsan/sql/sql_base.h:519

    #21 0x55ceeb16e8a4 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:801

    #22 0x55ceeb30858c in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4662

    #23 0x55ceeb32336b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223

    #24 0x55ceeb32c718 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924

    #25 0x55ceeb33941d in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434

    #26 0x55ceebb35db7 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475

    #27 0x55ceebb36f14 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387

    #28 0x55ceed4bc326 in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

    #29 0x7f6ad2ea81c3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f6ad3849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55ceed4b1bf2 in my_thread_create /data/bld/10.11-asan-ubsan/storage/perfschema/my_thread.h:52

    #2 0x55ceed4b951a in pfs_spawn_thread_v1 /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2252

    #3 0x55ceeab83118 in inline_mysql_thread_create /data/bld/10.11-asan-ubsan/include/mysql/psi/mysql_thread.h:1139

    #4 0x55ceeab83118 in create_thread_to_handle_connection(CONNECT*) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6152

    #5 0x55ceeab94fa2 in create_new_thread(CONNECT*) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6211

    #6 0x55ceeab951c0 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6273

    #7 0x55ceeab95e01 in handle_connections_sockets() /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6396

    #8 0x55ceeab962ad in run_main_loop /data/bld/10.11-asan-ubsan/sql/mysqld.cc:5646

    #9 0x55ceeab976a2 in mysqld_main(int, char**) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6053

    #10 0x55ceeab6a931 in main /data/bld/10.11-asan-ubsan/sql/main.cc:34

    #11 0x7f6ad2e46249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/10.11-asan-ubsan/sql/strfunc.cc:169 in find_type2(st_typelib const*, char const*, unsigned long, charset_info_st const*)

Shadow bytes around the buggy address:

  0x0c4a80044fa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044fb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044fc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044fd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80044fe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c4a80044ff0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd

  0x0c4a80045000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80045010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80045020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80045030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4a80045040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==800758==ABORTING

commit 852e4510fa662c571a42f550278d4abd09e3c5cf

Author: Dmitry Shulga

Date:   Wed Jul 23 09:34:47 2025 +0700

    MDEV-26115: Crash when calling stored function in FOR loop argument