ASAN global-buffer-overflow in events_to_string/reconstruct_create_trigger_stmt

CREATE TABLE t (a INT);

CREATE TRIGGER x1 AFTER STARTUP INSERT INTO test.t VALUES (1);

UPDATE mysql.event SET kind='DDL' WHERE name='x1';

SHOW CREATE TRIGGER x1;

DROP TRIGGER x1;

DROP TABLE t;

Starting MariaDB 13.1.0-MariaDB-asan-debug-log source revision 99cd491db83b86d45d34daab154df033fc8e32f2

Version: '13.1.0-MariaDB-asan-debug-log'

=================================================================

==415560==ERROR: AddressSanitizer: global-buffer-overflow on address 0x64b8397aaf90 at pc 0x64b8386c3494 bp 0x76de5776ab60 sp 0x76de5776ab50

READ of size 8 at 0x64b8397aaf90 thread T13

    #0 0x64b8386c3493 in events_to_string /13/sql/sql_sys_or_ddl_trigger.cc:953

    #1 0x64b8386c3d85 in reconstruct_create_trigger_stmt /13/sql/sql_sys_or_ddl_trigger.cc:1014

    #2 0x64b8386ca340 in show_create_sys_trigger(THD*, sp_name const*) /13/sql/sql_sys_or_ddl_trigger.cc:1832

    #3 0x64b838025e9a in show_create_trigger(THD*, sp_name const*) /13/sql/sql_show.cc:11507

    #4 0x64b837e3100e in mysql_execute_command(THD*, bool) /13/sql/sql_parse.cc:5700

    #5 0x64b837e3417c in mysql_parse(THD*, char*, unsigned int, Parser_state*) /13/sql/sql_parse.cc:7980

    #6 0x64b837e37cb0 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /13/sql/sql_parse.cc:1904

    #7 0x64b837e3c5cc in do_command(THD*, bool) /13/sql/sql_parse.cc:1438

    #8 0x64b8383183b3 in do_handle_one_connection(CONNECT*, bool) /13/sql/sql_connect.cc:1503

    #9 0x64b8383187b8 in handle_one_connection /13/sql/sql_connect.cc:1415

    #10 0x7ede6d05ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #11 0x7ede6c09cb83 in start_thread nptl/pthread_create.c:447

    #12 0x7ede6c129d6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x64b8397aaf90 is located 48 bytes before global variable 'base_event_time' defined in '/13/sql/sql_sys_or_ddl_trigger.cc:892:30' (0x64b8397aafc0) of size 32

0x64b8397aaf90 is located 0 bytes after global variable 'base_event_names' defined in '/13/sql/sql_sys_or_ddl_trigger.cc:897:30' (0x64b8397aaf40) of size 80

SUMMARY: AddressSanitizer: global-buffer-overflow /13/sql/sql_sys_or_ddl_trigger.cc:953 in events_to_string

Shadow bytes around the buggy address:

  0x64b8397aad00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397aad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397aae00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397aae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397aaf00: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00

=>0x64b8397aaf80: 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9

  0x64b8397ab000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397ab080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397ab100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397ab180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x64b8397ab200: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

Thread T13 created by T0 here:

    #0 0x7ede6d0f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x64b8379bb535 in create_thread_to_handle_connection(CONNECT*) /13/sql/mysqld.cc:6538

==415560==ABORTING

Starting MariaDB 13.1.0-MariaDB-asan-debug source revision 99cd491db83b86d45d34daab154df033fc8e32f2

Version: '13.1.0-MariaDB-asan-debug' 

=================================================================

==413669==ERROR: AddressSanitizer: global-buffer-overflow on address 0x624733c35530 at pc 0x6247311f80fa bp 0x6da55ee506f0 sp 0x6da55ee506e0

READ of size 8 at 0x624733c35530 thread T15

    #0 0x6247311f80f9 in events_to_string /13/src/sql/sql_sys_or_ddl_trigger.cc:953

    #1 0x6247312012a6 in fill_schema_triggers_from_mysql_events(THD*, TABLE_LIST*) /13/src/sql/sql_sys_or_ddl_trigger.cc:2163

    #2 0x624730b92e33 in fill_schema_triggers /13/src/sql/sql_show.cc:7445

    #3 0x624730b78dda in get_schema_tables_result(JOIN*, enum_schema_table_state) /13/src/sql/sql_show.cc:9966

    #4 0x624730b24d46 in JOIN::exec_inner() /13/src/sql/sql_select.cc:5086

    #5 0x624730b2568b in JOIN::exec() /13/src/sql/sql_select.cc:4913

    #6 0x624730b2100e in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /13/src/sql/sql_select.cc:5439

    #7 0x624730b2181a in handle_select(THD*, LEX*, select_result*, unsigned long long) /13/src/sql/sql_select.cc:636

    #8 0x6247309531de in execute_sqlcom_select /13/src/sql/sql_parse.cc:6252

    #9 0x624730971f03 in mysql_execute_command(THD*, bool) /13/src/sql/sql_parse.cc:3992

    #10 0x62473097f837 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /13/src/sql/sql_parse.cc:7980

    #11 0x6247309835ec in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /13/src/sql/sql_parse.cc:1904

    #12 0x624730988386 in do_command(THD*, bool) /13/src/sql/sql_parse.cc:1438

    #13 0x624730e5123c in do_handle_one_connection(CONNECT*, bool) /13/src/sql/sql_connect.cc:1503

    #14 0x624730e51722 in handle_one_connection /13/src/sql/sql_connect.cc:1415

    #15 0x624731b443cb in pfs_spawn_thread /13/src/storage/perfschema/pfs.cc:2198

    #16 0x75a58665ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #17 0x75a58569cb83 in start_thread nptl/pthread_create.c:447

    #18 0x75a585729d6b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x624733c35530 is located 48 bytes before global variable 'base_event_time' defined in '/13/src/sql/sql_sys_or_ddl_trigger.cc:892:30' (0x624733c35560) of size 32

0x624733c35530 is located 0 bytes after global variable 'base_event_names' defined in '/13/src/sql/sql_sys_or_ddl_trigger.cc:897:30' (0x624733c354e0) of size 80

SUMMARY: AddressSanitizer: global-buffer-overflow /13/src/sql/sql_sys_or_ddl_trigger.cc:953 in events_to_string

Shadow bytes around the buggy address:

  0x624733c35280: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9

  0x624733c35300: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

  0x624733c35380: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9

  0x624733c35400: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9

  0x624733c35480: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

=>0x624733c35500: 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00

  0x624733c35580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 f9 f9

  0x624733c35600: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00

  0x624733c35680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x624733c35700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x624733c35780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

Thread T15 created by T0 here:

    #0 0x75a5866f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x624731b44628 in my_thread_create /13/src/storage/perfschema/my_thread.h:38

    #2 0x624731b44628 in pfs_spawn_thread_v1 /13/src/storage/perfschema/pfs.cc:2249

==413669==ABORTING

Version: '13.1.0-MariaDB-asan-debug'  socket: '/13/dt/my.sock'  port: 3314  Source distribution

=================================================================

==419583==ERROR: AddressSanitizer: global-buffer-overflow on address 0x597ab92ed530 at pc 0x597ab68b00fa bp 0x7fff73be0b00 sp 0x7fff73be0af0

READ of size 8 at 0x597ab92ed530 thread T0

    #0 0x597ab68b00f9 in events_to_string /13/src/sql/sql_sys_or_ddl_trigger.cc:953

    #1 0x597ab68b09eb in reconstruct_create_trigger_stmt /13/src/sql/sql_sys_or_ddl_trigger.cc:1014

    #2 0x597ab68b42b4 in instantiate_sys_trigger /13/src/sql/sql_sys_or_ddl_trigger.cc:1148

    #3 0x597ab68b4dff in load_system_triggers /13/src/sql/sql_sys_or_ddl_trigger.cc:1476

    #4 0x597ab68b6135 in run_after_startup_triggers(bool) /13/src/sql/sql_sys_or_ddl_trigger.cc:1568

    #5 0x597ab5c2863e in mysqld_main(int, char**) /13/src/sql/mysqld.cc:6427

    #6 0x597ab5c06575 in main /13/src/sql/main.cc:34

    #7 0x7fca8662a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    #8 0x7fca8662a28a in __libc_start_main_impl ../csu/libc-start.c:360

    #9 0x597ab5c064a4 in _start (/bld/sql/mariadbd+0x11814a4) (BuildId: a4310243190a3d3042429e78c2f08d437b187d4d)

0x597ab92ed530 is located 48 bytes before global variable 'base_event_time' defined in '/13/src/sql/sql_sys_or_ddl_trigger.cc:892:30' (0x597ab92ed560) of size 32

0x597ab92ed530 is located 0 bytes after global variable 'base_event_names' defined in '/13/src/sql/sql_sys_or_ddl_trigger.cc:897:30' (0x597ab92ed4e0) of size 80

SUMMARY: AddressSanitizer: global-buffer-overflow /13/src/sql/sql_sys_or_ddl_trigger.cc:953 in events_to_string

Shadow bytes around the buggy address:

  0x597ab92ed280: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9

  0x597ab92ed300: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

  0x597ab92ed380: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9

  0x597ab92ed400: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9

  0x597ab92ed480: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00

=>0x597ab92ed500: 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00

  0x597ab92ed580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 f9 f9

  0x597ab92ed600: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00

  0x597ab92ed680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x597ab92ed700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x597ab92ed780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==419583==ABORTING

CREATE TABLE t (a INT);

CREATE TRIGGER trg1 AFTER STARTUP INSERT INTO test.t VALUES (1);

CREATE TRIGGER trg2 AFTER STARTUP INSERT INTO test.t VALUES (2);

UPDATE mysql.event SET kind=0 WHERE name='trg2';

--source include/restart_mysqld.inc

SELECT a FROM t;

DROP TRIGGER trg1,trg2;

DROP TABLE t;

Version: '13.1.0-MariaDB-asan-debug-log'  

=================================================================

==421538==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x731e1a820cf8 at pc 0x731e1d67d96f bp 0x7ffdf64ad100 sp 0x7ffdf64ac8a8

READ of size 41 at 0x731e1a820cf8 thread T0

    #0 0x731e1d67d96e in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391

    #1 0x59e3fab43f38 in String::append(st_mysql_const_lex_string const*) /13/sql/sql_string.h:1033

    #2 0x59e3fbd3fda5 in String::append(st_mysql_const_lex_string const&) /13/sql/sql_string.h:1040

    #3 0x59e3fbd3fda5 in reconstruct_create_trigger_stmt /13/sql/sql_sys_or_ddl_trigger.cc:1014

    #4 0x59e3fbd4364e in instantiate_sys_trigger /13/sql/sql_sys_or_ddl_trigger.cc:1148

    #5 0x59e3fbd44199 in load_system_triggers /13/sql/sql_sys_or_ddl_trigger.cc:1476

    #6 0x59e3fbd454cd in run_after_startup_triggers(bool) /13/sql/sql_sys_or_ddl_trigger.cc:1568

    #7 0x59e3fb0472db in mysqld_main(int, char**) /13/sql/mysqld.cc:6427

    #8 0x59e3fa9c9b85 in main /13/sql/main.cc:34

    #9 0x731e1c62a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

    #10 0x731e1c62a28a in __libc_start_main_impl ../csu/libc-start.c:360

    #11 0x59e3fa9c9ab4 in _start (/13/sql/mariadbd+0x217aab4) (BuildId: dc15016676e2a8334c989f8fdadc3cf2cba92592)

Address 0x731e1a820cf8 is located in stack of thread T0 at offset 248 in frame

    #0 0x59e3fbd3f923 in reconstruct_create_trigger_stmt /13/sql/sql_sys_or_ddl_trigger.cc:987

  This frame has 8 object(s):

    [32, 33) 'chr' (line 980)

    [48, 49) 'chr' (line 980)

    [64, 65) 'chr' (line 980)

    [80, 96) '<unknown>'

    [112, 128) '<unknown>'

    [144, 160) '<unknown>'

    [176, 192) '<unknown>'

    [208, 248) 'event_names_buf' (line 1013) <== Memory access at offset 248 overflows this variable

HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork

      (longjmp and C++ exceptions *are* supported)

SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391 in strlen

Shadow bytes around the buggy address:

  0x731e1a820a00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x731e1a820a80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x731e1a820b00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 00 00 00 00

  0x731e1a820b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x731e1a820c00: f1 f1 f1 f1 01 f2 01 f2 01 f2 f8 f8 f2 f2 f8 f8

=>0x731e1a820c80: f2 f2 00 00 f2 f2 00 00 f2 f2 00 00 00 00 00[f3]

  0x731e1a820d00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00

  0x731e1a820d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x731e1a820e00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x731e1a820e80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x731e1a820f00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==421538==ABORTING