[MDEV-40859] ASAN: stack-buffer-overflow in PlugSetPath when reading a CONNECT table with TABLE_TYPE=DIR and FILE_NAME pattern has a long extension - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Storage Engine - Connect
Labels:
- ASAN
- stack-buffer-overflow

Bug Category:
Can result in hang or crash

Description

INSTALL SONAME 'ha_connect';

CREATE TABLE t1 (fname VARCHAR(256) NOT NULL, ftype CHAR(4) NOT NULL) ENGINE=CONNECT CHARSET=latin1 TABLE_TYPE=DIR FILE_NAME='*.deeptest_no_such_extension_xyz';

SELECT * FROM t1;

Leads to:

CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Debug, UBASAN, Clang 18.1.3-11) Build 17/08/2026
==781375==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x73cf0afbd8b4 at pc 0x59a1da4c99d4 bp 0x73cf0bd8fcf0 sp 0x73cf0bd8f4a8
WRITE of size 32 at 0x73cf0afbd8b4 thread T11
#0 0x59a1da4c99d3 in strcpy (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd+0x39099d3) (BuildId: 869609295d3298a7)
#1 0x73cf09faf83f in PlugSetPath /test/13.1_dbg_san/storage/connect/plugutil.cpp:303:3
#2 0x73cf0a09db60 in TDBDIR::Path(_global*) /test/13.1_dbg_san/storage/connect/tabmul.cpp:684:5
#3 0x73cf0a09eeb2 in TDBDIR::OpenDB(_global*) /test/13.1_dbg_san/storage/connect/tabmul.cpp:800:3
#4 0x73cf09e3b50d in CntOpenTable(_global, TDB, MODE, char, char, bool, ha_connect*) /test/13.1_dbg_san/storage/connect/connect.cc:349:14
#5 0x73cf09de9fc4 in ha_connect::OpenTable(_global*, bool) /test/13.1_dbg_san/storage/connect/ha_connect.cc:2066:13
#6 0x73cf09e0aa00 in ha_connect::rnd_init(bool) /test/13.1_dbg_san/storage/connect/ha_connect.cc:4130:7
#7 0x59a1da6ab973 in handler::ha_rnd_init(bool) /test/13.1_dbg_san/sql/handler.h:3739:22
#8 0x59a1da65c0c9 in handler::ha_rnd_init_with_error(bool) /test/13.1_dbg_san/sql/handler.cc:4330:7
#9 0x59a1db0b6b4a in init_read_record(READ_RECORD, THD, TABLE, SQL_SELECT, SORT_INFO*, int, bool, bool) /test/13.1_dbg_san/sql/records.cc:323:9
#10 0x59a1db9f58a4 in join_init_read_record(st_join_table*) /test/13.1_dbg_san/sql/sql_select.cc:25855:9
#11 0x59a1db96fdfa in sub_select(JOIN, st_join_table, bool) /test/13.1_dbg_san/sql/sql_select.cc:24747:12
#12 0x59a1dba02136 in do_select(JOIN, Procedure) /test/13.1_dbg_san/sql/sql_select.cc:24261:14
#13 0x59a1db9feaf3 in JOIN::exec_inner() /test/13.1_dbg_san/sql/sql_select.cc:5126:50
#14 0x59a1db9fc2c6 in JOIN::exec() /test/13.1_dbg_san/sql/sql_select.cc:4914:8
#15 0x59a1db973e17 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/13.1_dbg_san/sql/sql_select.cc:5440:21
#16 0x59a1db972bbb in handle_select(THD, LEX, select_result*, unsigned long long) /test/13.1_dbg_san/sql/sql_select.cc:637:10
#17 0x59a1db824502 in execute_sqlcom_select(THD, TABLE_LIST) /test/13.1_dbg_san/sql/sql_parse.cc:6229:12
#18 0x59a1db801e5c in mysql_execute_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:3997:12
#19 0x59a1db7dfcb4 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/13.1_dbg_san/sql/sql_parse.cc:7968:18
#20 0x59a1db7d924c in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7
#21 0x59a1db7e1448 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17
#22 0x59a1dbfab24c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1514:11
#23 0x59a1dbfaab1d in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5
#24 0x59a1da4df8dc in asan_thread_start(void*) crtstuff.c
#25 0x7bcfbea9cb83 in start_thread nptl/pthread_create.c:447:8
#26 0x7bcfbeb29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x73cf0afbd8b4 is located in stack of thread T11 at offset 6324 in frame
#0 0x73cf09faf3f7 in PlugSetPath /test/13.1_dbg_san/storage/connect/plugutil.cpp:249

This frame has 7 object(s):
[32, 4128) 'newname' (line 250)
[4256, 4768) 'direc' (line 251)
[4832, 5344) 'defdir' (line 251)
[5408, 5920) 'tmpdir' (line 251)
[5984, 6237) 'fname' (line 252)
[6304, 6324) 'ftype' (line 253) <== Memory access at offset 6324 overflows this variable
[6368, 10464) 'tmp' (line 295)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
Thread T11 created by T0 here:
#0 0x59a1da4c7765 in pthread_create (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd+0x3907765) (BuildId: 869609295d3298a7)
#1 0x59a1da534b5a in create_thread_to_handle_connection(CONNECT*) /test/13.1_dbg_san/sql/mysqld.cc:6523:19
#2 0x59a1da535ad5 in handle_connections_sockets() /test/13.1_dbg_san/sql/mysqld.cc:6759:9
#3 0x59a1da533d97 in run_main_loop() /test/13.1_dbg_san/sql/mysqld.cc:5993:3
#4 0x7bcfbea2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#5 0x7bcfbea2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#6 0x59a1da446fa4 in _start (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd+0x3886fa4) (BuildId: 869609295d3298a7)

SUMMARY: AddressSanitizer: stack-buffer-overflow (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd+0x39099d3) (BuildId: 869609295d3298a7) in strcpy

CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, UBASAN, Clang 18.1.3-11) Build 17/08/2026
==781255==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x69167174a8b4 at pc 0x58281d0ed004 bp 0x69167251cd10 sp 0x69167251c4c8
WRITE of size 32 at 0x69167174a8b4 thread T12
#0 0x58281d0ed003 in strcpy (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2ee6003) (BuildId: 09e682504f1ca546)
#1 0x691690fa0ef0 in PlugSetPath /test/13.1_opt_san/storage/connect/plugutil.cpp:303:3
#2 0x691691091798 in TDBDIR::Path(_global*) /test/13.1_opt_san/storage/connect/tabmul.cpp:684:5
#3 0x691691092ae3 in TDBDIR::OpenDB(_global*) /test/13.1_opt_san/storage/connect/tabmul.cpp:800:3
#4 0x691690e2cdfd in CntOpenTable(_global, TDB, MODE, char, char, bool, ha_connect*) /test/13.1_opt_san/storage/connect/connect.cc:349:14
#5 0x691690ddd73c in ha_connect::OpenTable(_global*, bool) /test/13.1_opt_san/storage/connect/ha_connect.cc:2066:13
#6 0x691690dff62d in ha_connect::rnd_init(bool) /test/13.1_opt_san/storage/connect/ha_connect.cc:4130:7
#7 0x58281d2aea9c in handler::ha_rnd_init(bool) /test/13.1_opt_san/sql/handler.h:3739:22
#8 0x58281d2693cf in handler::ha_rnd_init_with_error(bool) /test/13.1_opt_san/sql/handler.cc:4330:7
#9 0x58281dbc59c2 in init_read_record(READ_RECORD, THD, TABLE, SQL_SELECT, SORT_INFO*, int, bool, bool) /test/13.1_opt_san/sql/records.cc:323:9
#10 0x58281e488eeb in join_init_read_record(st_join_table*) /test/13.1_opt_san/sql/sql_select.cc:25855:9
#11 0x58281e40abc4 in sub_select(JOIN, st_join_table, bool) /test/13.1_opt_san/sql/sql_select.cc:24747:12
#12 0x58281e494517 in do_select(JOIN, Procedure) /test/13.1_opt_san/sql/sql_select.cc:24261:14
#13 0x58281e4910c2 in JOIN::exec_inner() /test/13.1_opt_san/sql/sql_select.cc:5126:50
#14 0x58281e48ed30 in JOIN::exec() /test/13.1_opt_san/sql/sql_select.cc:4914:8
#15 0x58281e40ed04 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/13.1_opt_san/sql/sql_select.cc:5440:21
#16 0x58281e40d4cc in handle_select(THD, LEX, select_result*, unsigned long long) /test/13.1_opt_san/sql/sql_select.cc:637:10
#17 0x58281e2db327 in execute_sqlcom_select(THD, TABLE_LIST) /test/13.1_opt_san/sql/sql_parse.cc:6229:12
#18 0x58281e2bba84 in mysql_execute_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:3997:12
#19 0x58281e29cbd2 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/13.1_opt_san/sql/sql_parse.cc:7968:18
#20 0x58281e292efc in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/13.1_opt_san/sql/sql_parse.cc:1903:7
#21 0x58281e29e40c in do_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:1437:17
#22 0x58281e9fb23c in do_handle_one_connection(CONNECT*, bool) /test/13.1_opt_san/sql/sql_connect.cc:1514:11
#23 0x58281e9fa982 in handle_one_connection /test/13.1_opt_san/sql/sql_connect.cc:1426:5
#24 0x58281f310ae8 in pfs_spawn_thread /test/13.1_opt_san/storage/perfschema/pfs.cc:2198:3
#25 0x58281d102f0c in asan_thread_start(void*) crtstuff.c
#26 0x71173e69cb83 in start_thread nptl/pthread_create.c:447:8
#27 0x71173e729d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x69167174a8b4 is located in stack of thread T12 at offset 6324 in frame
#0 0x691690fa0957 in PlugSetPath /test/13.1_opt_san/storage/connect/plugutil.cpp:249

This frame has 7 object(s):
[32, 4128) 'newname' (line 250)
[4256, 4768) 'direc' (line 251)
[4832, 5344) 'defdir' (line 251)
[5408, 5920) 'tmpdir' (line 251)
[5984, 6237) 'fname' (line 252)
[6304, 6324) 'ftype' (line 253) <== Memory access at offset 6324 overflows this variable
[6368, 10464) 'tmp' (line 295)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
Thread T12 created by T0 here:
#0 0x58281d0ead95 in pthread_create (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2ee3d95) (BuildId: 09e682504f1ca546)
#1 0x58281f310e6d in my_thread_create(unsigned long, pthread_attr_t const, void* ()(void), void*) /test/13.1_opt_san/storage/perfschema/my_thread.h:38:10
#2 0x58281f310e6d in pfs_spawn_thread_v1 /test/13.1_opt_san/storage/perfschema/pfs.cc:2249:15
#3 0x58281d15e91c in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /test/13.1_opt_san/include/mysql/psi/mysql_thread.h:1139:11
#4 0x58281d15e91c in create_thread_to_handle_connection(CONNECT*) /test/13.1_opt_san/sql/mysqld.cc:6523:19
#5 0x58281d15ff28 in handle_connections_sockets() /test/13.1_opt_san/sql/mysqld.cc:6759:9
#6 0x58281d15e022 in run_main_loop() /test/13.1_opt_san/sql/mysqld.cc:5993:3
#7 0x58281d153183 in mysqld_main(int, char**) /test/13.1_opt_san/sql/mysqld.cc:6419:3
#8 0x71173e62a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x71173e62a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x58281d06a5d4 in _start (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2e635d4) (BuildId: 09e682504f1ca546)

SUMMARY: AddressSanitizer: stack-buffer-overflow (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2ee6003) (BuildId: 09e682504f1ca546) in strcpy

Setup:

grep: /test/UBASAN_EMD170226-mariadb-10.6.25-21-linux-x86_64-dbg/BUILD_CMD_CMAKE: No such file or directory

Compiled with a recent version of GCC (I used GCC 13.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 10.11 dbg 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 10.11 opt 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 11.4 dbg 170826 77c8f791618136002e5724ca81f365134b583a29 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 11.4 opt 170826 77c8f791618136002e5724ca81f365134b583a29 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 11.8 dbg 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 11.8 opt 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 12.3 dbg 170826 91156c3de58762196605150ab3f756fe952592d1 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 12.3 opt 170826 91156c3de58762196605150ab3f756fe952592d1 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 13.0 dbg 170826 a848493c6fe031f23606144420c1ca1e467cbd81 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 13.0 opt 170826 a848493c6fe031f23606144420c1ca1e467cbd81 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 13.1 dbg 170826 f4299f0bbf38820794295bd4cae427544681cbd1 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
CS 13.1 opt 170826 f4299f0bbf38820794295bd4cae427544681cbd1 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
ES 10.6 dbg 170226 22e626b9c17e9969925c54f14d30e39e25320b22 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
ES 10.6 opt 170226 22e626b9c17e9969925c54f14d30e39e25320b22 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
ES 11.4 dbg 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
ES 11.4 opt 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
ES 11.8 dbg 170226 405ee76b60c4ab82155f339136ed20d3b7363717 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB
ES 11.8 opt 170226 405ee76b60c4ab82155f339136ed20d3b7363717 ASAN\|stack-buffer-overflow\|storage/connect/plugutil.cpp\|strcpy\|PlugSetPath\|TDBDIR::Path\|TDBDIR::OpenDB

Attachments

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Ramesh Sivaraman

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-08-20 10:38

Updated:: 2026-08-21 23:24

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

0.5h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.