Details
-
Bug
-
Status: In Review (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
Description
INSTALL SONAME 'ha_connect'; |
CREATE TABLE t1 (a INT) ENGINE=CONNECT; |
CREATE TABLE total (tabname CHAR(8) NOT NULL SPECIAL='TABID') ENGINE=CONNECT TABLE_TYPE=TBL TABLE_LIST='t1'; |
SELECT * FROM total WHERE tabname = REPEAT('A',500); |
Leads to:
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, Clang 18.1.3-11) Build 17/08/2026 |
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGABRT, Aborted.
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
|
|
[Current thread is 1 (LWP 2790515)]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
|
#3 0x0000780416c4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
|
#4 0x0000780416c288ff in __GI_abort () at ./stdlib/abort.c:79
|
#5 0x0000780416c297b6 in __libc_message_impl (fmt=fmt@entry=0x780416dce765 "*** %s ***: terminated\n")at ../sysdeps/posix/libc_fatal.c:134
|
#6 0x0000780416d36d49 in __GI___fortify_fail (msg=msg@entry=0x780416dce77d "stack smashing detected")at ./debug/fortify_fail.c:24
|
#7 0x0000780416d37fd4 in __stack_chk_fail () at ./debug/stack_chk_fail.c:24
|
#8 0x00007803e8146ddf in TDBTBL::TestFil (this=<optimized out>, g=<optimized out>, filp=<optimized out>, tabp=<optimized out>)at /test/13.1_opt/storage/connect/tabtbl.cpp:344
|
#9 0x4141414141414141 in ?? ()
|
[..]
|
#38 0x0000000041414141 in ?? ()
|
#39 0x0000000000000000 in ?? ()
|
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Debug, Clang 18.1.3-11) Build 17/08/2026 |
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGABRT, Aborted.
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
|
|
[Current thread is 1 (LWP 2792554)]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
|
#3 0x00007e1ee404527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
|
#4 0x00007e1ee40288ff in __GI_abort () at ./stdlib/abort.c:79
|
#5 0x00007e1ee40297b6 in __libc_message_impl (fmt=fmt@entry=0x7e1ee41ce765 "*** %s ***: terminated\n")at ../sysdeps/posix/libc_fatal.c:134
|
#6 0x00007e1ee4136d49 in __GI___fortify_fail (msg=msg@entry=0x7e1ee41ce77d "stack smashing detected")at ./debug/fortify_fail.c:24
|
#7 0x00007e1ee4137fd4 in __stack_chk_fail () at ./debug/stack_chk_fail.c:24
|
#8 0x00007e1ebc75efee in TDBTBL::TestFil (this=0x761dc3fff268, g=0x761dcc049400, filp=0x761dc3fff778, tabp=0x761dc3fff130)at /test/13.1_dbg/storage/connect/tabtbl.cpp:344
|
#9 0x4141414141414141 in ?? ()
|
[..]
|
#44 0x00007e0041414141 in ?? ()
|
#45 0x00005e18fc3173d3 in Send_field::max_char_length (this=<error reading variable: Cannot access memory at address 0x4141414141414139>, cs=<error reading variable: Cannot access memory at address 0x4141414141414131>) at /test/13.1_dbg/sql/field.h:6012
|
Backtrace stopped: Cannot access memory at address 0x4141414141414149
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 10.6 opt 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 10.11 dbg 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 10.11 opt 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 11.4 dbg 170826 77c8f791618136002e5724ca81f365134b583a29 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 11.4 opt 170826 77c8f791618136002e5724ca81f365134b583a29 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 11.8 dbg 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 11.8 opt 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 12.3 dbg 170826 91156c3de58762196605150ab3f756fe952592d1 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 12.3 opt 170826 91156c3de58762196605150ab3f756fe952592d1 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 13.0 dbg 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 13.0 opt 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 13.1 dbg 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
CS 13.1 opt 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
ES 11.4 dbg 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
ES 11.4 opt 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
ES 11.8 dbg 060526 1499789de285a8109d68d79347de0281865b28f4 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
ES 11.8 opt 060526 1499789de285a8109d68d79347de0281865b28f4 SIGABRT|__libc_message_impl|__GI___fortify_fail|__stack_chk_fail|TDBTBL::TestFil
|
SAN ID
opt: ASAN|stack-buffer-overflow|crtstuff.c|scanf_common|__isoc23_sscanf|TDBTBL::TestFil|TDBTBL::InitTableList
|
dbg: ASAN|stack-buffer-overflow|crtstuff.c|scanf_common|__isoc23_sscanf|TDBTBL::TestFil|TDBTBL::InitTableList
|
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, UBASAN, Clang 18.1.3-11) Build 17/08/2026 |
==1953384==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x74231c956100 at pc 0x582848b79dd9 bp 0x74231dc25ba0 sp 0x74231dc25330
|
WRITE of size 501 at 0x74231c956100 thread T12
|
#0 0x582848b79dd8 in scanf_common(void*, int, bool, char const*, __va_list_tag*) crtstuff.c
|
#1 0x582848b7afb9 in __isoc23_sscanf (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2e87fb9) (BuildId: 09e682504f1ca546)
|
#2 0x7423558e7d48 in TDBTBL::TestFil(_global*, CONDFIL*, XTAB*) /test/13.1_opt_san/storage/connect/tabtbl.cpp:312:9
|
#3 0x7423558e680a in TDBTBL::InitTableList(_global*) /test/13.1_opt_san/storage/connect/tabtbl.cpp:244:9
|
#4 0x7423558ea00e in TDBTBL::OpenDB(_global*) /test/13.1_opt_san/storage/connect/tabtbl.cpp:456:19
|
#5 0x74235562cdfd in CntOpenTable(_global*, TDB*, MODE, char*, char*, bool, ha_connect*) /test/13.1_opt_san/storage/connect/connect.cc:349:14
|
#6 0x7423555dd73c in ha_connect::OpenTable(_global*, bool) /test/13.1_opt_san/storage/connect/ha_connect.cc:2066:13
|
#7 0x7423555ff62d in ha_connect::rnd_init(bool) /test/13.1_opt_san/storage/connect/ha_connect.cc:4130:7
|
#8 0x582848d9aa9c in handler::ha_rnd_init(bool) /test/13.1_opt_san/sql/handler.h:3739:22
|
#9 0x582848d553cf in handler::ha_rnd_init_with_error(bool) /test/13.1_opt_san/sql/handler.cc:4330:7
|
#10 0x5828496b19c2 in init_read_record(READ_RECORD*, THD*, TABLE*, SQL_SELECT*, SORT_INFO*, int, bool, bool) /test/13.1_opt_san/sql/records.cc:323:9
|
#11 0x582849f74eeb in join_init_read_record(st_join_table*) /test/13.1_opt_san/sql/sql_select.cc:25855:9
|
#12 0x582849ef6bc4 in sub_select(JOIN*, st_join_table*, bool) /test/13.1_opt_san/sql/sql_select.cc:24747:12
|
#13 0x582849f80517 in do_select(JOIN*, Procedure*) /test/13.1_opt_san/sql/sql_select.cc:24261:14
|
#14 0x582849f7d0c2 in JOIN::exec_inner() /test/13.1_opt_san/sql/sql_select.cc:5126:50
|
#15 0x582849f7ad30 in JOIN::exec() /test/13.1_opt_san/sql/sql_select.cc:4914:8
|
#16 0x582849efad04 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.1_opt_san/sql/sql_select.cc:5440:21
|
#17 0x582849ef94cc in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.1_opt_san/sql/sql_select.cc:637:10
|
#18 0x582849dc7327 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.1_opt_san/sql/sql_parse.cc:6229:12
|
#19 0x582849da7a84 in mysql_execute_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:3997:12
|
#20 0x582849d88bd2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_opt_san/sql/sql_parse.cc:7968:18
|
#21 0x582849d7eefc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_opt_san/sql/sql_parse.cc:1903:7
|
#22 0x582849d8a40c in do_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:1437:17
|
#23 0x58284a4e723c in do_handle_one_connection(CONNECT*, bool) /test/13.1_opt_san/sql/sql_connect.cc:1514:11
|
#24 0x58284a4e6982 in handle_one_connection /test/13.1_opt_san/sql/sql_connect.cc:1426:5
|
#25 0x58284adfcae8 in pfs_spawn_thread /test/13.1_opt_san/storage/perfschema/pfs.cc:2198:3
|
#26 0x582848beef0c in asan_thread_start(void*) crtstuff.c
|
#27 0x7c23e9c9cb83 in start_thread nptl/pthread_create.c:447:8
|
#28 0x7c23e9d29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Address 0x74231c956100 is located in stack of thread T12 at offset 256 in frame
|
#0 0x7423558e789f in TDBTBL::TestFil(_global*, CONDFIL*, XTAB*) /test/13.1_opt_san/storage/connect/tabtbl.cpp:290
|
|
|
This frame has 2 object(s):
|
[32, 40) 'op' (line 291)
|
[64, 256) 'tn' (line 291) <== Memory access at offset 256 overflows this variable
|
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
|
(longjmp and C++ exceptions *are* supported)
|
Thread T12 created by T0 here:
|
#0 0x582848bd6d95 in pthread_create (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2ee3d95) (BuildId: 09e682504f1ca546)
|
#1 0x58284adfce6d in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /test/13.1_opt_san/storage/perfschema/my_thread.h:38:10
|
#2 0x58284adfce6d in pfs_spawn_thread_v1 /test/13.1_opt_san/storage/perfschema/pfs.cc:2249:15
|
#3 0x582848c4a91c in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /test/13.1_opt_san/include/mysql/psi/mysql_thread.h:1139:11
|
#4 0x582848c4a91c in create_thread_to_handle_connection(CONNECT*) /test/13.1_opt_san/sql/mysqld.cc:6523:19
|
#5 0x582848c4bf28 in handle_connections_sockets() /test/13.1_opt_san/sql/mysqld.cc:6759:9
|
#6 0x582848c4a022 in run_main_loop() /test/13.1_opt_san/sql/mysqld.cc:5993:3
|
#7 0x582848c3f183 in mysqld_main(int, char**) /test/13.1_opt_san/sql/mysqld.cc:6419:3
|
#8 0x7c23e9c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
|
#9 0x7c23e9c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
|
#10 0x582848b565d4 in _start (/test/UBASAN_MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x2e635d4) (BuildId: 09e682504f1ca546)
|
|
|
SUMMARY: AddressSanitizer: stack-buffer-overflow crtstuff.c in scanf_common(void*, int, bool, char const*, __va_list_tag*)
|
