Heap-use-after-free in stored procedure when LEFT(CONCAT(...)) result is reused by LOCATE()

POC：

DROP TABLE IF EXISTS t0;

DROP PROCEDURE IF EXISTS poc_left_uaf;

DELIMITER $$

CREATE PROCEDURE poc_left_uaf()

BEGIN

  DECLARE c INT;

  SELECT LOCATE(a, 'data1-data2', a) INTO c

  FROM (SELECT LEFT(CONCAT(CAST(i AS CHAR), '-test'), 5) AS a FROM t0) dt;

END$$

DELIMITER ;

-- Setup

CREATE TABLE t0 (i DOUBLE);

INSERT INTO t0 VALUES (1);

CALL poc_left_uaf();

-- Cleanup

DROP TABLE IF EXISTS t0;

DROP PROCEDURE IF EXISTS poc_left_uaf;

asan report：

Version: '13.1.0-MariaDB-asan' socket: '/run/mysqld/mysqld.sock' port: 3401 Source distribution
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x5130000411a0 at pc 0x559b7c82be9e bp 0x77c5d496b1e0 sp 0x77c5d496b1d8
READ of size 1 at 0x5130000411a0 thread T11
#0 0x559b7c82be9d (/opt/mariadb-asan/bin/mariadbd+0x1ef2e9d) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#1 0x559b7c832303 (/opt/mariadb-asan/bin/mariadbd+0x1ef9303) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#2 0x559b7c812518 (/opt/mariadb-asan/bin/mariadbd+0x1ed9518) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#3 0x559b7c7ef814 (/opt/mariadb-asan/bin/mariadbd+0x1eb6814) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#4 0x559b7b936582 (/opt/mariadb-asan/bin/mariadbd+0xffd582) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#5 0x559b7b808217 (/opt/mariadb-asan/bin/mariadbd+0xecf217) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#6 0x559b7b808578 (/opt/mariadb-asan/bin/mariadbd+0xecf578) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#7 0x559b7b6edf66 (/opt/mariadb-asan/bin/mariadbd+0xdb4f66) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#8 0x559b7ad5cac2 (/opt/mariadb-asan/bin/mariadbd+0x423ac2) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#9 0x559b7ad87602 (/opt/mariadb-asan/bin/mariadbd+0x44e602) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#10 0x559b7ae61aba (/opt/mariadb-asan/bin/mariadbd+0x528aba) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#11 0x559b7ae62035 (/opt/mariadb-asan/bin/mariadbd+0x529035) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#12 0x559b7ae56007 (/opt/mariadb-asan/bin/mariadbd+0x51d007) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#13 0x559b7b08f918 (/opt/mariadb-asan/bin/mariadbd+0x756918) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#14 0x559b7b0fd809 (/opt/mariadb-asan/bin/mariadbd+0x7c4809) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#15 0x559b7b03aaf0 (/opt/mariadb-asan/bin/mariadbd+0x701af0) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#16 0x559b7b09e58c (/opt/mariadb-asan/bin/mariadbd+0x76558c) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#17 0x559b7b09cc1b (/opt/mariadb-asan/bin/mariadbd+0x763c1b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#18 0x559b7b03c68a (/opt/mariadb-asan/bin/mariadbd+0x70368a) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#19 0x559b7b03bd60 (/opt/mariadb-asan/bin/mariadbd+0x702d60) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#20 0x559b7af95ae9 (/opt/mariadb-asan/bin/mariadbd+0x65cae9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#21 0x559b7af8a737 (/opt/mariadb-asan/bin/mariadbd+0x651737) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#22 0x559b7b5209d4 (/opt/mariadb-asan/bin/mariadbd+0xbe79d4) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#23 0x559b7b519ead (/opt/mariadb-asan/bin/mariadbd+0xbe0ead) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#24 0x559b7b51b59b (/opt/mariadb-asan/bin/mariadbd+0xbe259b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#25 0x559b7b51f227 (/opt/mariadb-asan/bin/mariadbd+0xbe6227) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#26 0x559b7ad63314 (/opt/mariadb-asan/bin/mariadbd+0x42a314) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#27 0x559b7ad675d8 (/opt/mariadb-asan/bin/mariadbd+0x42e5d8) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#28 0x559b7af874af (/opt/mariadb-asan/bin/mariadbd+0x64e4af) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#29 0x559b7af86cb9 (/opt/mariadb-asan/bin/mariadbd+0x64dcb9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#30 0x559b7af8a6da (/opt/mariadb-asan/bin/mariadbd+0x6516da) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#31 0x559b7af807db (/opt/mariadb-asan/bin/mariadbd+0x6477db) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#32 0x559b7af7a834 (/opt/mariadb-asan/bin/mariadbd+0x641834) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#33 0x559b7af81455 (/opt/mariadb-asan/bin/mariadbd+0x648455) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#34 0x559b7b37757c (/opt/mariadb-asan/bin/mariadbd+0xa3e57c) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#35 0x559b7b3770f7 (/opt/mariadb-asan/bin/mariadbd+0xa3e0f7) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#36 0x559b7bfc372b (/opt/mariadb-asan/bin/mariadbd+0x168a72b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#37 0x559b7ab17130 (/opt/mariadb-asan/bin/mariadbd+0x1de130) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#38 0x7fc5f7b9faa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#39 0x7fc5f7c2ca63 (/lib/x86_64-linux-gnu/libc.so.6+0x129a63) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)

0x5130000411a0 is located 32 bytes inside of 384-byte region [0x513000041180,0x513000041300)
freed by thread T11 here:
#0 0x559b7abe30e8 (/opt/mariadb-asan/bin/mariadbd+0x2aa0e8) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#1 0x559b7b9d09f3 (/opt/mariadb-asan/bin/mariadbd+0x10979f3) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#2 0x559b7b843f73 (/opt/mariadb-asan/bin/mariadbd+0xf0af73) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#3 0x559b7b9363b9 (/opt/mariadb-asan/bin/mariadbd+0xffd3b9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#4 0x559b7b808217 (/opt/mariadb-asan/bin/mariadbd+0xecf217) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#5 0x559b7b808578 (/opt/mariadb-asan/bin/mariadbd+0xecf578) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#6 0x559b7b6edf66 (/opt/mariadb-asan/bin/mariadbd+0xdb4f66) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#7 0x559b7ad5cac2 (/opt/mariadb-asan/bin/mariadbd+0x423ac2) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#8 0x559b7ad87602 (/opt/mariadb-asan/bin/mariadbd+0x44e602) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#9 0x559b7ae61aba (/opt/mariadb-asan/bin/mariadbd+0x528aba) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#10 0x559b7ae62035 (/opt/mariadb-asan/bin/mariadbd+0x529035) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#11 0x559b7ae56007 (/opt/mariadb-asan/bin/mariadbd+0x51d007) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#12 0x559b7b08f918 (/opt/mariadb-asan/bin/mariadbd+0x756918) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#13 0x559b7b0fd809 (/opt/mariadb-asan/bin/mariadbd+0x7c4809) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#14 0x559b7b03aaf0 (/opt/mariadb-asan/bin/mariadbd+0x701af0) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#15 0x559b7b09e58c (/opt/mariadb-asan/bin/mariadbd+0x76558c) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#16 0x559b7b09cc1b (/opt/mariadb-asan/bin/mariadbd+0x763c1b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#17 0x559b7b03c68a (/opt/mariadb-asan/bin/mariadbd+0x70368a) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#18 0x559b7b03bd60 (/opt/mariadb-asan/bin/mariadbd+0x702d60) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#19 0x559b7af95ae9 (/opt/mariadb-asan/bin/mariadbd+0x65cae9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#20 0x559b7af8a737 (/opt/mariadb-asan/bin/mariadbd+0x651737) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#21 0x559b7b5209d4 (/opt/mariadb-asan/bin/mariadbd+0xbe79d4) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#22 0x559b7b519ead (/opt/mariadb-asan/bin/mariadbd+0xbe0ead) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#23 0x559b7b51b59b (/opt/mariadb-asan/bin/mariadbd+0xbe259b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#24 0x559b7b51f227 (/opt/mariadb-asan/bin/mariadbd+0xbe6227) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#25 0x559b7ad63314 (/opt/mariadb-asan/bin/mariadbd+0x42a314) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#26 0x559b7ad675d8 (/opt/mariadb-asan/bin/mariadbd+0x42e5d8) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#27 0x559b7af874af (/opt/mariadb-asan/bin/mariadbd+0x64e4af) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#28 0x559b7af86cb9 (/opt/mariadb-asan/bin/mariadbd+0x64dcb9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#29 0x559b7af8a6da (/opt/mariadb-asan/bin/mariadbd+0x6516da) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)

previously allocated by thread T11 here:
#0 0x559b7abe40b7 (/opt/mariadb-asan/bin/mariadbd+0x2ab0b7) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#1 0x559b7c77cd66 (/opt/mariadb-asan/bin/mariadbd+0x1e43d66) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#2 0x559b7b1ca48e (/opt/mariadb-asan/bin/mariadbd+0x89148e) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#3 0x559b7b70da4d (/opt/mariadb-asan/bin/mariadbd+0xdd4a4d) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#4 0x559b7bb35a3a (/opt/mariadb-asan/bin/mariadbd+0x11fca3a) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#5 0x559b7b9d80cc (/opt/mariadb-asan/bin/mariadbd+0x109f0cc) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#6 0x559b7b9e47fc (/opt/mariadb-asan/bin/mariadbd+0x10ab7fc) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#7 0x559b7b9d07be (/opt/mariadb-asan/bin/mariadbd+0x10977be) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#8 0x559b7b843f73 (/opt/mariadb-asan/bin/mariadbd+0xf0af73) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#9 0x559b7b9363b9 (/opt/mariadb-asan/bin/mariadbd+0xffd3b9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#10 0x559b7b808217 (/opt/mariadb-asan/bin/mariadbd+0xecf217) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#11 0x559b7b808578 (/opt/mariadb-asan/bin/mariadbd+0xecf578) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#12 0x559b7b6edf66 (/opt/mariadb-asan/bin/mariadbd+0xdb4f66) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#13 0x559b7ad5cac2 (/opt/mariadb-asan/bin/mariadbd+0x423ac2) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#14 0x559b7ad87602 (/opt/mariadb-asan/bin/mariadbd+0x44e602) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#15 0x559b7ae61aba (/opt/mariadb-asan/bin/mariadbd+0x528aba) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#16 0x559b7ae62035 (/opt/mariadb-asan/bin/mariadbd+0x529035) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#17 0x559b7ae56007 (/opt/mariadb-asan/bin/mariadbd+0x51d007) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#18 0x559b7b08f918 (/opt/mariadb-asan/bin/mariadbd+0x756918) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#19 0x559b7b0fd809 (/opt/mariadb-asan/bin/mariadbd+0x7c4809) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#20 0x559b7b03aaf0 (/opt/mariadb-asan/bin/mariadbd+0x701af0) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#21 0x559b7b09e58c (/opt/mariadb-asan/bin/mariadbd+0x76558c) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#22 0x559b7b09cc1b (/opt/mariadb-asan/bin/mariadbd+0x763c1b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#23 0x559b7b03c68a (/opt/mariadb-asan/bin/mariadbd+0x70368a) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#24 0x559b7b03bd60 (/opt/mariadb-asan/bin/mariadbd+0x702d60) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#25 0x559b7af95ae9 (/opt/mariadb-asan/bin/mariadbd+0x65cae9) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#26 0x559b7af8a737 (/opt/mariadb-asan/bin/mariadbd+0x651737) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#27 0x559b7b5209d4 (/opt/mariadb-asan/bin/mariadbd+0xbe79d4) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#28 0x559b7b519ead (/opt/mariadb-asan/bin/mariadbd+0xbe0ead) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#29 0x559b7b51b59b (/opt/mariadb-asan/bin/mariadbd+0xbe259b) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)

Thread T11 created by T0 here:
#0 0x559b7abdb366 (/opt/mariadb-asan/bin/mariadbd+0x2a2366) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#1 0x559b7bfc3a10 (/opt/mariadb-asan/bin/mariadbd+0x168aa10) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#2 0x559b7ac3e8e8 (/opt/mariadb-asan/bin/mariadbd+0x3058e8) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#3 0x559b7ac3ef50 (/opt/mariadb-asan/bin/mariadbd+0x305f50) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#4 0x559b7ac3fa78 (/opt/mariadb-asan/bin/mariadbd+0x306a78) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#5 0x559b7ac3d38c (/opt/mariadb-asan/bin/mariadbd+0x30438c) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#6 0x559b7ac33e66 (/opt/mariadb-asan/bin/mariadbd+0x2fae66) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
#7 0x7fc5f7b2d1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#8 0x7fc5f7b2d28a (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#9 0x559b7aaeda64 (/opt/mariadb-asan/bin/mariadbd+0x1b4a64) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)

SUMMARY: AddressSanitizer: heap-use-after-free (/opt/mariadb-asan/bin/mariadbd+0x1ef2e9d) (BuildId: f4bdaab765abe5b5dcd1848f97735c9d8363ff36)
Shadow bytes around the buggy address:
0x513000040f00: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
0x513000040f80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x513000041000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x513000041080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x513000041100: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
=>0x513000041180: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x513000041200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x513000041280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x513000041300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x513000041380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x513000041400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1==ABORTING
260628 10:47:48 [ERROR] /opt/mariadb-asan/bin/mariadbd got signal 6 ;
Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.
To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
a bug on https://jira.mariadb.org/.

Please include the information from the server start above, to the end of the
information below.

Server version: 13.1.0-MariaDB-asan source revision: f40ea8f4e6084dcda6ae621928e4e966f54348f6

The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
contains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.

Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)

Thread pointer: 0x52b00016c220
stack_bottom = 0x77c5d4971000 thread_stack 0xb00000
Printing to addr2line failed
/opt/mariadb-asan/bin/mariadbd(+0x20a2aa)[0x559b7ab432aa]
/opt/mariadb-asan/bin/mariadbd(my_print_stacktrace+0x10a)[0x559b7c78768a]
/opt/mariadb-asan/bin/mariadbd(handle_fatal_signal+0x3b5)[0x559b7b78a5d5]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x7fc5f7b48330]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x11c)[0x7fc5f7ba1b2c]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x1e)[0x7fc5f7b4827e]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xdf)[0x7fc5f7b2b8ff]
/opt/mariadb-asan/bin/mariadbd(+0x2d5c5f)[0x559b7ac0ec5f]
/opt/mariadb-asan/bin/mariadbd(+0x2d3b01)[0x559b7ac0cb01]
/opt/mariadb-asan/bin/mariadbd(+0x2b55c9)[0x559b7abee5c9]
/opt/mariadb-asan/bin/mariadbd(+0x2b4db7)[0x559b7abeddb7]
/opt/mariadb-asan/bin/mariadbd(__asan_report_load1+0x2c)[0x559b7abeedbc]
/opt/mariadb-asan/bin/mariadbd(+0x1ef2e9e)[0x559b7c82be9e]
/opt/mariadb-asan/bin/mariadbd(+0x1ef9304)[0x559b7c832304]
/opt/mariadb-asan/bin/mariadbd(+0x1ed9519)[0x559b7c812519]
/opt/mariadb-asan/bin/mariadbd(my_instr_mb+0xc5)[0x559b7c7ef815]
/opt/mariadb-asan/bin/mariadbd(_ZN16Item_func_locate7val_intEv+0x403)[0x559b7b936583]
/opt/mariadb-asan/bin/mariadbd(_ZN4Item17save_int_in_fieldEP5Fieldb+0x48)[0x559b7b808218]
/opt/mariadb-asan/bin/mariadbd(_ZN4Item13save_in_fieldEP5Fieldb+0x89)[0x559b7b808579]
/opt/mariadb-asan/bin/mariadbd(_ZN5Field25sp_prepare_and_store_itemEP3THDPP4Item+0x97)[0x559b7b6edf67]
/opt/mariadb-asan/bin/mariadbd(_ZN3THD12sp_eval_exprEP5FieldPP4Item+0x143)[0x559b7ad5cac3]
/opt/mariadb-asan/bin/mariadbd(_ZN11sp_rcontext12set_variableEP3THDjPP4Item+0x123)[0x559b7ad87603]
/opt/mariadb-asan/bin/mariadbd(_ZN9my_var_sp3setEP3THDP4Item+0x14b)[0x559b7ae61abb]
/opt/mariadb-asan/bin/mariadbd(_ZN14select_dumpvar9send_dataER4ListI4ItemE+0x216)[0x559b7ae62036]
/opt/mariadb-asan/bin/mariadbd(_ZN18select_result_sink20send_data_with_checkER4ListI4ItemEP18st_select_lex_unity+0xa8)[0x559b7ae56008]
/opt/mariadb-asan/bin/mariadbd(+0x756919)[0x559b7b08f919]
/opt/mariadb-asan/bin/mariadbd(+0x7c480a)[0x559b7b0fd80a]
/opt/mariadb-asan/bin/mariadbd(_Z10sub_selectP4JOINP13st_join_tableb+0x6c1)[0x559b7b03aaf1]
/opt/mariadb-asan/bin/mariadbd(+0x76558d)[0x559b7b09e58d]
/opt/mariadb-asan/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x1dac)[0x559b7b09cc1c]
/opt/mariadb-asan/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x79b)[0x559b7b03c68b]
/opt/mariadb-asan/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x441)[0x559b7b03bd61]
/opt/mariadb-asan/bin/mariadbd(+0x65caea)[0x559b7af95aea]
/opt/mariadb-asan/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0x1188)[0x559b7af8a738]
/opt/mariadb-asan/bin/mariadbd(_ZN13sp_instr_stmt9exec_coreEP3THDPj+0xe5)[0x559b7b5209d5]
/opt/mariadb-asan/bin/mariadbd(_ZN13sp_lex_keeper23reset_lex_and_exec_coreEP3THDPjbP8sp_instrb+0x80e)[0x559b7b519eae]
/opt/mariadb-asan/bin/mariadbd(_ZN13sp_lex_keeper26validate_lex_and_exec_coreEP3THDPjbP12sp_lex_instr+0x6ac)[0x559b7b51b59c]
/opt/mariadb-asan/bin/mariadbd(_ZN13sp_instr_stmt7executeEP3THDPj+0xd08)[0x559b7b51f228]
/opt/mariadb-asan/bin/mariadbd(_ZN7sp_head7executeEP3THDb+0x1565)[0x559b7ad63315]
/opt/mariadb-asan/bin/mariadbd(_ZN7sp_head17execute_procedureEP3THDP4ListI4ItemE+0xea9)[0x559b7ad675d9]
/opt/mariadb-asan/bin/mariadbd(+0x64e4b0)[0x559b7af874b0]
/opt/mariadb-asan/bin/mariadbd(_ZN12Sql_cmd_call7executeEP3THD+0x43a)[0x559b7af86cba]
/opt/mariadb-asan/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0x112b)[0x559b7af8a6db]
/opt/mariadb-asan/bin/mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x4dc)[0x559b7af807dc]
/opt/mariadb-asan/bin/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x1735)[0x559b7af7a835]
/opt/mariadb-asan/bin/mariadbd(_Z10do_commandP3THDb+0x426)[0x559b7af81456]
/opt/mariadb-asan/bin/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x36d)[0x559b7b37757d]
/opt/mariadb-asan/bin/mariadbd(handle_one_connection+0xf8)[0x559b7b3770f8]
/opt/mariadb-asan/bin/mariadbd(+0x168a72c)[0x559b7bfc372c]
/opt/mariadb-asan/bin/mariadbd(+0x1de131)[0x559b7ab17131]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4)[0x7fc5f7b9faa4]
/lib/x86_64-linux-gnu/libc.so.6(__clone+0x44)[0x7fc5f7c2ca64]

Connection ID (thread ID): 5
Status: NOT_KILLED
Query (0x5250004d0948): SELECT LOCATE(a, 'data1-data2', a) INTO c
FROM (SELECT LEFT(CONCAT(CAST(i AS CHAR), '-test'), 5) AS a FROM t0) dt

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,duplicateweedout=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on,reorder_outer_joins=off

Writing a core file...
Working directory at /var/lib/mysql
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max core file size 0 unlimited bytes
Max open files 1048576 1048576 files
Max locked memory 8388608 8388608 bytes
Max pending signals 125162 125162 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: |/bin/false