ASAN global-buffer-overflow in reconstruct_create_trigger_stmt

SET SESSION sql_mode='';

CREATE TRIGGER d1 AFTER STARTUP SET @x=1;

UPDATE mysql.event SET `when`=0 WHERE name='d1';

SHOW CREATE TRIGGER d1;

DROP TRIGGER d1;

2026-06-16 16:44:56 0 [Note] Starting MariaDB 13.1.0-MariaDB-asan-debug-log source revision a51f81628b0cc9b74d0b436405fb42c3d6e104dc 

=================================================================

==1626231==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56a4e5b12938 at pc 0x56a4e47e3d70 bp 0x7b6415a31b30 sp 0x7b6415a31b20

READ of size 8 at 0x56a4e5b12938 thread T6

    #0 0x56a4e47e3d6f in reconstruct_create_trigger_stmt /13.1/sql/sql_sys_or_ddl_trigger.cc:891

    #1 0x56a4e47ea04a in show_create_sys_trigger(THD*, sp_name const*) /13.1/sql/sql_sys_or_ddl_trigger.cc:1557

    #2 0x56a4e41335e1 in show_create_trigger(THD*, sp_name const*) /13.1/sql/sql_show.cc:11507

    #3 0x56a4e3f3b7f1 in mysql_execute_command(THD*, bool) /13.1/sql/sql_parse.cc:5700

    #4 0x56a4e3f3eaab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /13.1/sql/sql_parse.cc:7980

    #5 0x56a4e3f42860 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /13.1/sql/sql_parse.cc:1904

    #6 0x56a4e3f475fa in do_command(THD*, bool) /13.1/sql/sql_parse.cc:1438

    #7 0x56a4e442e348 in do_handle_one_connection(CONNECT*, bool) /13.1/sql/sql_connect.cc:1503

    #8 0x56a4e442e82e in handle_one_connection /13.1/sql/sql_connect.cc:1415

    #9 0x56a4e4a417c7 in pfs_spawn_thread /13.1/storage/perfschema/pfs.cc:2198

    #10 0x7b642665ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #11 0x7b642589caa3 in start_thread nptl/pthread_create.c:447

    #12 0x7b6425929c6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x56a4e5b12938 is located 8 bytes before global variable 'base_event_time' defined in '/13.1/sql/sql_sys_or_ddl_trigger.cc:839:30' (0x56a4e5b12940) of size 32

0x56a4e5b12938 is located 40 bytes after global variable 'base_event_names' defined in '/13.1/sql/sql_sys_or_ddl_trigger.cc:844:30' (0x56a4e5b128c0) of size 80

SUMMARY: AddressSanitizer: global-buffer-overflow /13.1/sql/sql_sys_or_ddl_trigger.cc:891 in reconstruct_create_trigger_stmt

Shadow bytes around the buggy address:

  0x56a4e5b12680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12880: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00

=>0x56a4e5b12900: 00 00 f9 f9 f9 f9 f9[f9]00 00 00 00 f9 f9 f9 f9

  0x56a4e5b12980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12b80: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

Thread T6 created by T0 here:

    #0 0x7b64266f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x56a4e4a41a24 in my_thread_create /13.1/storage/perfschema/my_thread.h:38

    #2 0x56a4e4a41a24 in pfs_spawn_thread_v1 /13.1/storage/perfschema/pfs.cc:2249

==1626231==ABORTING