ASAN global-buffer-overflow in reconstruct_create_trigger_stmt

SET sql_mode='';

CREATE TRIGGER d1 AFTER STARTUP SET @x=1;

UPDATE mysql.event SET `when`=0 WHERE name='d1';

SHOW CREATE TRIGGER d1;

DROP TRIGGER d1;

2026-06-16 16:44:56 0 [Note] Starting MariaDB 13.1.0-MariaDB-asan-debug-log source revision a51f81628b0cc9b74d0b436405fb42c3d6e104dc 

=================================================================

==1626231==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56a4e5b12938 at pc 0x56a4e47e3d70 bp 0x7b6415a31b30 sp 0x7b6415a31b20

READ of size 8 at 0x56a4e5b12938 thread T6

    #0 0x56a4e47e3d6f in reconstruct_create_trigger_stmt /13.1/sql/sql_sys_or_ddl_trigger.cc:891

    #1 0x56a4e47ea04a in show_create_sys_trigger(THD*, sp_name const*) /13.1/sql/sql_sys_or_ddl_trigger.cc:1557

    #2 0x56a4e41335e1 in show_create_trigger(THD*, sp_name const*) /13.1/sql/sql_show.cc:11507

    #3 0x56a4e3f3b7f1 in mysql_execute_command(THD*, bool) /13.1/sql/sql_parse.cc:5700

    #4 0x56a4e3f3eaab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /13.1/sql/sql_parse.cc:7980

    #5 0x56a4e3f42860 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /13.1/sql/sql_parse.cc:1904

    #6 0x56a4e3f475fa in do_command(THD*, bool) /13.1/sql/sql_parse.cc:1438

    #7 0x56a4e442e348 in do_handle_one_connection(CONNECT*, bool) /13.1/sql/sql_connect.cc:1503

    #8 0x56a4e442e82e in handle_one_connection /13.1/sql/sql_connect.cc:1415

    #9 0x56a4e4a417c7 in pfs_spawn_thread /13.1/storage/perfschema/pfs.cc:2198

    #10 0x7b642665ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #11 0x7b642589caa3 in start_thread nptl/pthread_create.c:447

    #12 0x7b6425929c6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x56a4e5b12938 is located 8 bytes before global variable 'base_event_time' defined in '/13.1/sql/sql_sys_or_ddl_trigger.cc:839:30' (0x56a4e5b12940) of size 32

0x56a4e5b12938 is located 40 bytes after global variable 'base_event_names' defined in '/13.1/sql/sql_sys_or_ddl_trigger.cc:844:30' (0x56a4e5b128c0) of size 80

SUMMARY: AddressSanitizer: global-buffer-overflow /13.1/sql/sql_sys_or_ddl_trigger.cc:891 in reconstruct_create_trigger_stmt

Shadow bytes around the buggy address:

  0x56a4e5b12680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12880: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00

=>0x56a4e5b12900: 00 00 f9 f9 f9 f9 f9[f9]00 00 00 00 f9 f9 f9 f9

  0x56a4e5b12980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x56a4e5b12b80: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

Thread T6 created by T0 here:

    #0 0x7b64266f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x56a4e4a41a24 in my_thread_create /13.1/storage/perfschema/my_thread.h:38

    #2 0x56a4e4a41a24 in pfs_spawn_thread_v1 /13.1/storage/perfschema/pfs.cc:2249

==1626231==ABORTING

SET sql_mode='';

CREATE TRIGGER d1 AFTER STARTUP SET @x=1;

UPDATE mysql.event SET kind='DDL' WHERE name='d1';

SHOW CREATE TRIGGER d1;

DROP TRIGGER d1;

=================================================================

==1757863==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5ae2d0e4e550 at pc 0x5ae2ce40fa22 bp 0x6a2f5f7f2b00 sp 0x6a2f5f7f2af0

READ of size 8 at 0x5ae2d0e4e550 thread T13

    #0 0x5ae2ce40fa21 in events_to_string /13.1/src/sql/sql_sys_or_ddl_trigger.cc:828

    #1 0x5ae2ce410313 in reconstruct_create_trigger_stmt /13.1/src/sql/sql_sys_or_ddl_trigger.cc:910

    #2 0x5ae2ce41677e in show_create_sys_trigger(THD*, sp_name const*) /13.1/src/sql/sql_sys_or_ddl_trigger.cc:1557

    #3 0x5ae2cdd93327 in show_create_trigger(THD*, sp_name const*) /13.1/src/sql/sql_show.cc:11507

    #4 0x5ae2cdb944dd in mysql_execute_command(THD*, bool) /13.1/src/sql/sql_parse.cc:5700

    #5 0x5ae2cdb97797 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /13.1/src/sql/sql_parse.cc:7980

    #6 0x5ae2cdb9b54c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /13.1/src/sql/sql_parse.cc:1904

    #7 0x5ae2cdba02e6 in do_command(THD*, bool) /13.1/src/sql/sql_parse.cc:1438

    #8 0x5ae2ce06919c in do_handle_one_connection(CONNECT*, bool) /13.1/src/sql/sql_connect.cc:1503

    #9 0x5ae2ce069682 in handle_one_connection /13.1/src/sql/sql_connect.cc:1415

    #10 0x5ae2ced5b8f3 in pfs_spawn_thread /13.1/src/storage/perfschema/pfs.cc:2198

    #11 0x722f7a05ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #12 0x722f7909caa3 in start_thread nptl/pthread_create.c:447

    #13 0x722f79129c6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x5ae2d0e4e550 is located 48 bytes before global variable 'base_event_time' defined in '/13.1/src/sql/sql_sys_or_ddl_trigger.cc:839:30' (0x5ae2d0e4e580) of size 32

0x5ae2d0e4e550 is located 0 bytes after global variable 'base_event_names' defined in '/13.1/src/sql/sql_sys_or_ddl_trigger.cc:844:30' (0x5ae2d0e4e500) of size 80

SUMMARY: AddressSanitizer: global-buffer-overflow /13.1/src/sql/sql_sys_or_ddl_trigger.cc:828 in events_to_string

Shadow bytes around the buggy address:

  0x5ae2d0e4e280: 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9

  0x5ae2d0e4e300: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9

  0x5ae2d0e4e380: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9

  0x5ae2d0e4e400: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

  0x5ae2d0e4e480: 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9

=>0x5ae2d0e4e500: 00 00 00 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9

  0x5ae2d0e4e580: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00

  0x5ae2d0e4e600: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00

  0x5ae2d0e4e680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x5ae2d0e4e700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x5ae2d0e4e780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

Thread T13 created by T0 here:

    #0 0x722f7a0f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x5ae2ced5bb50 in my_thread_create /13.1/src/storage/perfschema/my_thread.h:38

    #2 0x5ae2ced5bb50 in pfs_spawn_thread_v1 /13.1/src/storage/perfschema/pfs.cc:2249

==1757863==ABORTING