[MDEV-40546] ASAN : stack-use-after-return in strings/ctype-latin1.c | my_mb_wc_latin1 | json_escape - Jira

CREATE TABLE t1 ( c1 set('') , c2 decimal , c3 int(11) , c4 smallint(6) , KEY idx1 (c2));

INSERT INTO t1 (c1,c2) VALUES (+ 1,1),(+ 1,2);

SELECT JSON_OBJECTAGG(CAST(c2 AS CHAR),JSON_OBJECT('',c4)) j FROM t1;

CS 10.11.19 cea98ec09dd9a226047b09bc1f8516003b416e1c (Optimized, UBASAN, Clang 18.1.3-11) Build 27/07/2026
==1235075==ERROR: AddressSanitizer: stack-use-after-return on address 0x6cbf8089d43e at pc 0x629a1c1ddeca bp 0x6cbf81a1be10 sp 0x6cbf81a1be08
READ of size 1 at 0x6cbf8089d43e thread T12
#0 0x629a1c1ddec9 in my_mb_wc_latin1 /test/10.11_opt_san/strings/ctype-latin1.c:376:18
#1 0x629a1c2df319 in json_escape /test/10.11_opt_san/strings/json_lib.c:1735:17
#2 0x629a1af2fc4a in st_append_escaped(String, String const) /test/10.11_opt_san/sql/item_jsonfunc.cc:148:10
#3 0x629a1af69eee in Item_func_json_objectagg::add() /test/10.11_opt_san/sql/item_jsonfunc.cc:4585:3
#4 0x629a1a8d65b3 in init_sum_functions(Item_sum, Item_sum) /test/10.11_opt_san/sql/sql_select.cc:28672:22
#5 0x629a1a8c7e48 in end_send_group(JOIN, st_join_table, bool) /test/10.11_opt_san/sql/sql_select.cc:24629:11
#6 0x629a1a8cbe7e in evaluate_join_record(JOIN, st_join_table, int) /test/10.11_opt_san/sql/sql_select.cc:23326:11
#7 0x629a1a7b8c97 in sub_select(JOIN, st_join_table, bool) /test/10.11_opt_san/sql/sql_select.cc:23096:9
#8 0x629a1a83e50c in do_select(JOIN, Procedure) /test/10.11_opt_san/sql/sql_select.cc:22619:14
#9 0x629a1a83b0fc in JOIN::exec_inner() /test/10.11_opt_san/sql/sql_select.cc:5023:50
#10 0x629a1a838dcd in JOIN::exec() /test/10.11_opt_san/sql/sql_select.cc:4807:3
#11 0x629a1a7bc58b in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.11_opt_san/sql/sql_select.cc:5285:9
#12 0x629a1a7bb1b6 in handle_select(THD, LEX, select_result*, unsigned long long) /test/10.11_opt_san/sql/sql_select.cc:601:10
#13 0x629a1a6a1538 in execute_sqlcom_select(THD, TABLE_LIST) /test/10.11_opt_san/sql/sql_parse.cc:6461:12
#14 0x629a1a67f333 in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:4040:12
#15 0x629a1a660312 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8219:18
#16 0x629a1a6568ce in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1924:7
#17 0x629a1a661b4c in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1434:17
#18 0x629a1ad4c1ac in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1486:11
#19 0x629a1ad4b8e6 in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1398:5
#20 0x629a1b54653c in pfs_spawn_thread /test/10.11_opt_san/storage/perfschema/pfs.cc:2201:3
#21 0x629a1964633c in asan_thread_start(void*) crtstuff.c
#22 0x74c04d09cb83 in start_thread nptl/pthread_create.c:447:8
#23 0x74c04d129d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x6cbf8089d43e is located in stack of thread T12 at offset 62 in frame
#0 0x629a1b00703f in Type_handler_string_result::Item_update_null_value(Item*) const /test/10.11_opt_san/sql/sql_type.cc:4349

This frame has 1 object(s):
[32, 832) 'tmp' (line 4350) <== Memory access at offset 62 is inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
Thread T12 created by T0 here:
#0 0x629a1962e1c5 in pthread_create (/test/UBASAN_MD270726-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd+0x28661c5) (BuildId: ea9c3e8e35018593)
#1 0x629a1b5468a0 in my_thread_create(unsigned long, pthread_attr_t const, void* ()(void), void*) /test/10.11_opt_san/storage/perfschema/my_thread.h:52:10
#2 0x629a1b5468a0 in pfs_spawn_thread_v1 /test/10.11_opt_san/storage/perfschema/pfs.cc:2252:15
#3 0x629a196a09ec in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /test/10.11_opt_san/include/mysql/psi/mysql_thread.h:1139:11
#4 0x629a196a09ec in create_thread_to_handle_connection(CONNECT*) /test/10.11_opt_san/sql/mysqld.cc:6214:19
#5 0x629a196a1ff8 in handle_connections_sockets() /test/10.11_opt_san/sql/mysqld.cc:6458:9
#6 0x629a196a0142 in run_main_loop() /test/10.11_opt_san/sql/mysqld.cc:5706:3
#7 0x629a196960ea in mysqld_main(int, char**) /test/10.11_opt_san/sql/mysqld.cc:6110:3
#8 0x74c04d02a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x74c04d02a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x629a195ada04 in _start (/test/UBASAN_MD270726-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd+0x27e5a04) (BuildId: ea9c3e8e35018593)

SUMMARY: AddressSanitizer: stack-use-after-return /test/10.11_opt_san/strings/ctype-latin1.c:376:18 in my_mb_wc_latin1
Shadow bytes around the buggy address:
0x6cbf8089d180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x6cbf8089d400: f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d580: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d600: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6cbf8089d680: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1235075==ABORTING

CS 10.11.19 cea98ec09dd9a226047b09bc1f8516003b416e1c (Debug, UBASAN, Clang 18.1.3-11) Build 27/07/2026
==1235219==ERROR: AddressSanitizer: stack-use-after-return on address 0x6a95317cec3e at pc 0x607bf578b233 bp 0x6a9532932d60 sp 0x6a9532932d58
READ of size 1 at 0x6a95317cec3e thread T11
#0 0x607bf578b232 in my_mb_wc_latin1 /test/10.11_dbg_san/strings/ctype-latin1.c:376:18
#1 0x607bf5899f98 in json_escape /test/10.11_dbg_san/strings/json_lib.c:1735:17
#2 0x607bf4413d95 in st_append_escaped(String, String const) /test/10.11_dbg_san/sql/item_jsonfunc.cc:148:10
#3 0x607bf4450e4f in Item_func_json_objectagg::add() /test/10.11_dbg_san/sql/item_jsonfunc.cc:4585:3
#4 0x607bf3d66ca1 in init_sum_functions(Item_sum, Item_sum) /test/10.11_dbg_san/sql/sql_select.cc:28672:22
#5 0x607bf3d57a2b in end_send_group(JOIN, st_join_table, bool) /test/10.11_dbg_san/sql/sql_select.cc:24629:11
#6 0x607bf3d5b388 in evaluate_join_record(JOIN, st_join_table, int) /test/10.11_dbg_san/sql/sql_select.cc:23326:11
#7 0x607bf3c37aff in sub_select(JOIN, st_join_table, bool) /test/10.11_dbg_san/sql/sql_select.cc:23096:9
#8 0x607bf3cc5616 in do_select(JOIN, Procedure) /test/10.11_dbg_san/sql/sql_select.cc:22619:14
#9 0x607bf3cc1f9a in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:5023:50
#10 0x607bf3cbfa92 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4807:3
#11 0x607bf3c3b5af in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.11_dbg_san/sql/sql_select.cc:5285:9
#12 0x607bf3c3a0c1 in handle_select(THD, LEX, select_result*, unsigned long long) /test/10.11_dbg_san/sql/sql_select.cc:601:10
#13 0x607bf3b058f7 in execute_sqlcom_select(THD, TABLE_LIST) /test/10.11_dbg_san/sql/sql_parse.cc:6461:12
#14 0x607bf3aecbcf in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:4040:12
#15 0x607bf3abdf44 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8219:18
#16 0x607bf3ab745d in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1924:7
#17 0x607bf3abf6d8 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1434:17
#18 0x607bf420e1ac in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1486:11
#19 0x607bf420da81 in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1398:5
#20 0x607bf297328c in asan_thread_start(void*) crtstuff.c
#21 0x7295e4c9cb83 in start_thread nptl/pthread_create.c:447:8
#22 0x7295e4d29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x6a95317cec3e is located in stack of thread T11 at offset 62 in frame
#0 0x607bf44fee1f in Type_handler_string_result::Item_update_null_value(Item*) const /test/10.11_dbg_san/sql/sql_type.cc:4349

This frame has 1 object(s):
[32, 832) 'tmp' (line 4350) <== Memory access at offset 62 is inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
Thread T11 created by T0 here:
#0 0x607bf295b115 in pthread_create (/test/UBASAN_MD270726-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0x3150115) (BuildId: 2be77054e3aa77a3)
#1 0x607bf29c719a in create_thread_to_handle_connection(CONNECT*) /test/10.11_dbg_san/sql/mysqld.cc:6214:19
#2 0x607bf29c8115 in handle_connections_sockets() /test/10.11_dbg_san/sql/mysqld.cc:6458:9
#3 0x607bf29c6407 in run_main_loop() /test/10.11_dbg_san/sql/mysqld.cc:5706:3
#4 0x7295e4c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#5 0x7295e4c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#6 0x607bf28da954 in _start (/test/UBASAN_MD270726-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0x30cf954) (BuildId: 2be77054e3aa77a3)

SUMMARY: AddressSanitizer: stack-use-after-return /test/10.11_dbg_san/strings/ctype-latin1.c:376:18 in my_mb_wc_latin1
Shadow bytes around the buggy address:
0x6a95317ce980: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317cea00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317cea80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317ceb00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317ceb80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x6a95317cec00: f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317cec80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317ced00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317ced80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317cee00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x6a95317cee80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1235219==ABORTING

grep: /test/UBASAN_EMD170226-mariadb-10.6.25-21-linux-x86_64-dbg/BUILD_CMD_CMAKE: No such file or directory

Compiled with a recent version of GCC (I used GCC 13.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.11 dbg 270726 cea98ec09dd9a226047b09bc1f8516003b416e1c ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
CS 10.11 opt 270726 cea98ec09dd9a226047b09bc1f8516003b416e1c ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
CS 11.4 dbg 100726 1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913 ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
CS 11.4 opt 100726 1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913 ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
CS 11.8 dbg 100726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
CS 11.8 opt 100726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
CS 12.3 dbg 100726 27df5668c2e3eef406a5357672d3d8e89d25ff48 No bug found
CS 12.3 opt 100726 27df5668c2e3eef406a5357672d3d8e89d25ff48 No bug found
CS 13.0 dbg 100726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
CS 13.0 opt 100726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
CS 13.1 dbg 100726 fd8cec54af7a9d79749df25ea70dac695b371641 No bug found
CS 13.1 dbg 230726 7b89d04911b8a618da9ed76536313a351977d41d No bug found
CS 13.1 opt 100726 fd8cec54af7a9d79749df25ea70dac695b371641 No bug found
CS 13.1 opt 230726 7b89d04911b8a618da9ed76536313a351977d41d No bug found
ES 10.6 dbg 170226 22e626b9c17e9969925c54f14d30e39e25320b22 ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
ES 10.6 opt 170226 22e626b9c17e9969925c54f14d30e39e25320b22 ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
ES 11.4 dbg 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
ES 11.4 opt 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 ASAN\|stack-use-after-return\|strings/ctype-latin1.c\|my_mb_wc_latin1\|json_escape\|st_append_escaped\|Item_func_json_objectagg::add
ES 11.8 dbg 170226 405ee76b60c4ab82155f339136ed20d3b7363717 No bug found
ES 11.8 opt 170226 405ee76b60c4ab82155f339136ed20d3b7363717 No bug found

ASAN : stack-use-after-return in strings/ctype-latin1.c | my_mb_wc_latin1 | json_escape

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration