ASAN memcpy-param-overlap in hp_write_run_data with blob in HEAP table

CREATE TABLE t (

  pk INT PRIMARY KEY,

  b TEXT,

  c VARCHAR(8),

  UNIQUE(c)

) ENGINE=HEAP CHARACTER SET latin1;

INSERT INTO t VALUES (1,REPEAT('x',561),'foo');

REPLACE INTO t SELECT * FROM t;

DROP TABLE t;

==2902552==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x62d00026c438,0x62d00026c658) and [0x62d00026c466, 0x62d00026c686) overlap

    #0 0x7fd8ea247f4f in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827

    #1 0x55ef555e0b97 in hp_write_run_data /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_blob.c:269

    #2 0x55ef555e0f72 in hp_unlink_and_write_run /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_blob.c:317

    #3 0x55ef555e2158 in hp_write_one_blob /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_blob.c:454

    #4 0x55ef555e2e8a in hp_write_blobs /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_blob.c:645

    #5 0x55ef555deeaf in heap_write /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:59

    #6 0x55ef555c72eb in ha_heap::write_row(unsigned char const*) /data/bld/testing/bb-blob-monty-asan/storage/heap/ha_heap.cc:241

    #7 0x55ef54ddfc2d in handler::ha_write_row(unsigned char const*) /data/bld/testing/bb-blob-monty-asan/sql/handler.cc:7808

    #8 0x55ef5452f84f in Write_record::replace_row(unsigned long long*, unsigned long long*) /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:2110

    #9 0x55ef545314f7 in Write_record::write_record() /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:2368

    #10 0x55ef54531a14 in select_insert::send_data(List<Item>&) /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:4451

    #11 0x55ef54771fa9 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /data/bld/testing/bb-blob-monty-asan/sql/sql_class.h:6065

    #12 0x55ef546ee62b in end_send /data/bld/testing/bb-blob-monty-asan/sql/sql_select.cc:24546

    #13 0x55ef5470db90 in do_select /data/bld/testing/bb-blob-monty-asan/sql/sql_select.cc:22717

    #14 0x55ef5476a1ba in JOIN::exec_inner() /data/bld/testing/bb-blob-monty-asan/sql/sql_select.cc:5023

    #15 0x55ef5476a4ea in JOIN::exec() /data/bld/testing/bb-blob-monty-asan/sql/sql_select.cc:4807

    #16 0x55ef547663e8 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/testing/bb-blob-monty-asan/sql/sql_select.cc:5285

    #17 0x55ef54766a5b in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/testing/bb-blob-monty-asan/sql/sql_select.cc:601

    #18 0x55ef545edb82 in mysql_execute_command(THD*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:4858

    #19 0x55ef545f735a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:8221

    #20 0x55ef545fb117 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:1924

    #21 0x55ef545ffd36 in do_command(THD*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:1434

    #22 0x55ef549e51f3 in do_handle_one_connection(CONNECT*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_connect.cc:1475

    #23 0x55ef549e56dd in handle_one_connection /data/bld/testing/bb-blob-monty-asan/sql/sql_connect.cc:1387

    #24 0x55ef5543016d in pfs_spawn_thread /data/bld/testing/bb-blob-monty-asan/storage/perfschema/pfs.cc:2201

    #25 0x7fd8e96a81c3 in start_thread nptl/pthread_create.c:442

    #26 0x7fd8e972885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62d00026c438 is located 56 bytes inside of 32760-byte region [0x62d00026c400,0x62d0002743f8)

allocated by thread T6 here:

    #0 0x7fd8ea2b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55ef55f043e4 in my_malloc /data/bld/testing/bb-blob-monty-asan/mysys/my_malloc.c:92

    #2 0x55ef555e0318 in hp_get_new_block /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_block.c:83

    #3 0x55ef555de405 in hp_alloc_from_tail /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:213

    #4 0x55ef555de85f in next_free_record_pos /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:262

    #5 0x55ef555de9ad in heap_write /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:45

    #6 0x55ef555c72eb in ha_heap::write_row(unsigned char const*) /data/bld/testing/bb-blob-monty-asan/storage/heap/ha_heap.cc:241

    #7 0x55ef54ddfc2d in handler::ha_write_row(unsigned char const*) /data/bld/testing/bb-blob-monty-asan/sql/handler.cc:7808

    #8 0x55ef5452fe35 in Write_record::single_insert(unsigned long long*) /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:2319

    #9 0x55ef54531466 in Write_record::write_record() /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:2361

    #10 0x55ef545475c0 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:1216

    #11 0x55ef545ebea8 in mysql_execute_command(THD*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:4660

    #12 0x55ef545f735a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:8221

    #13 0x55ef545fb117 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:1924

    #14 0x55ef545ffd36 in do_command(THD*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:1434

    #15 0x55ef549e51f3 in do_handle_one_connection(CONNECT*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_connect.cc:1475

    #16 0x55ef549e56dd in handle_one_connection /data/bld/testing/bb-blob-monty-asan/sql/sql_connect.cc:1387

    #17 0x55ef5543016d in pfs_spawn_thread /data/bld/testing/bb-blob-monty-asan/storage/perfschema/pfs.cc:2201

    #18 0x7fd8e96a81c3 in start_thread nptl/pthread_create.c:442

Thread T6 created by T0 here:

    #0 0x7fd8ea249726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55ef554303e6 in my_thread_create /data/bld/testing/bb-blob-monty-asan/storage/perfschema/my_thread.h:52

    #2 0x55ef554303e6 in pfs_spawn_thread_v1 /data/bld/testing/bb-blob-monty-asan/storage/perfschema/pfs.cc:2252

    #3 0x55ef542acf66 in inline_mysql_thread_create /data/bld/testing/bb-blob-monty-asan/include/mysql/psi/mysql_thread.h:1139

    #4 0x55ef542acf66 in create_thread_to_handle_connection(CONNECT*) /data/bld/testing/bb-blob-monty-asan/sql/mysqld.cc:6214

    #5 0x55ef542b9461 in create_new_thread(CONNECT*) /data/bld/testing/bb-blob-monty-asan/sql/mysqld.cc:6273

    #6 0x55ef542b9626 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/testing/bb-blob-monty-asan/sql/mysqld.cc:6335

    #7 0x55ef542ba022 in handle_connections_sockets() /data/bld/testing/bb-blob-monty-asan/sql/mysqld.cc:6458

    #8 0x55ef542ba434 in run_main_loop /data/bld/testing/bb-blob-monty-asan/sql/mysqld.cc:5712

    #9 0x55ef542bb4e3 in mysqld_main(int, char**) /data/bld/testing/bb-blob-monty-asan/sql/mysqld.cc:6119

    #10 0x55ef5429d851 in main /data/bld/testing/bb-blob-monty-asan/sql/main.cc:34

    #11 0x7fd8e9646249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

0x62d00026c466 is located 102 bytes inside of 32760-byte region [0x62d00026c400,0x62d0002743f8)

allocated by thread T6 here:

    #0 0x7fd8ea2b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55ef55f043e4 in my_malloc /data/bld/testing/bb-blob-monty-asan/mysys/my_malloc.c:92

    #2 0x55ef555e0318 in hp_get_new_block /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_block.c:83

    #3 0x55ef555de405 in hp_alloc_from_tail /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:213

    #4 0x55ef555de85f in next_free_record_pos /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:262

    #5 0x55ef555de9ad in heap_write /data/bld/testing/bb-blob-monty-asan/storage/heap/hp_write.c:45

    #6 0x55ef555c72eb in ha_heap::write_row(unsigned char const*) /data/bld/testing/bb-blob-monty-asan/storage/heap/ha_heap.cc:241

    #7 0x55ef54ddfc2d in handler::ha_write_row(unsigned char const*) /data/bld/testing/bb-blob-monty-asan/sql/handler.cc:7808

    #8 0x55ef5452fe35 in Write_record::single_insert(unsigned long long*) /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:2319

    #9 0x55ef54531466 in Write_record::write_record() /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:2361

    #10 0x55ef545475c0 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/testing/bb-blob-monty-asan/sql/sql_insert.cc:1216

    #11 0x55ef545ebea8 in mysql_execute_command(THD*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:4660

    #12 0x55ef545f735a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:8221

    #13 0x55ef545fb117 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:1924

    #14 0x55ef545ffd36 in do_command(THD*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_parse.cc:1434

    #15 0x55ef549e51f3 in do_handle_one_connection(CONNECT*, bool) /data/bld/testing/bb-blob-monty-asan/sql/sql_connect.cc:1475

    #16 0x55ef549e56dd in handle_one_connection /data/bld/testing/bb-blob-monty-asan/sql/sql_connect.cc:1387

    #17 0x55ef5543016d in pfs_spawn_thread /data/bld/testing/bb-blob-monty-asan/storage/perfschema/pfs.cc:2201

    #18 0x7fd8e96a81c3 in start_thread nptl/pthread_create.c:442

SUMMARY: AddressSanitizer: memcpy-param-overlap ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy