SIGSEGV / heap-use-after-free on INFORMATION_SCHEMA.TABLES with an exact TABLE_NAME lookup and a materialised subquery in WHERE

CREATE DATABASE db1;

CREATE TABLE db1.t1(a INT);

SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='db1' AND TABLE_NAME='t1' AND TABLE_NAME IN (SELECT 't1' UNION SELECT 'x');

Core was generated by `/test/mtest/MDEV-31342/MD180926-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  SQL_SELECT::cleanup (this=0x8f8f8f8f8f8f8f8f)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/opt_range.cc:1254

[Current thread is 1 (LWP 2470301)]

(gdb) bt

#0  SQL_SELECT::cleanup (this=0x8f8f8f8f8f8f8f8f)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/opt_range.cc:1254

#1  0x000056fa3bb22b55 in SQL_SELECT::~SQL_SELECT (this=0x8f8f8f8f8f8f8f8f)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/opt_range.cc:1268

#2  0x000056fa3bd99fd8 in st_join_table::cleanup (this=0x72c498058d30)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_select.cc:16718

#3  0x000056fa3bd85b39 in JOIN::cleanup (this=0x72c498021160, full=true)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_select.cc:17290

#4  0x000056fa3bd858af in JOIN::destroy (this=0x72c498021160)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_select.cc:5172

#5  0x000056fa3be5cd50 in st_select_lex::cleanup (this=0x72c49801d4d0)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_union.cc:3020

#6  0x000056fa3be581a2 in st_select_lex_unit::cleanup (this=0x72c49801c670)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_union.cc:2810

#7  0x000056fa3be5ce37 in st_select_lex::cleanup (this=0x72c49801a740)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_union.cc:3031

#8  0x000056fa3bd5e0fd in mysql_select (thd=0x72c498000d60, tables=0x72c49801ae30, fields=@0x72c49801a9f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x72c49801ad90, last = 0x72c49801ad90, elements = 1}, <No data fields>}, conds=0x72c49801be20, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2701396736, result=0x72c49801f170, unit=0x72c4980052f0, select_lex=0x72c49801a740)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_select.cc:5369

#9  0x000056fa3bd5daf5 in handle_select (thd=0x72c498000d60, lex=0x72c498005210, result=0x72c49801f170, setup_tables_done_option=0)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_select.cc:638

#10 0x000056fa3bcf9ba3 in execute_sqlcom_select (thd=0x72c498000d60, all_tables=0x72c49801ae30)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_parse.cc:6266

#11 0x000056fa3bcee6c6 in mysql_execute_command (thd=0x72c498000d60, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_parse.cc:4038

#12 0x000056fa3bce6724 in mysql_parse (thd=0x72c498000d60, rawbuf=0x72c49801a5b0 "SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES\n    WHERE TABLE_SCHEMA='db1' AND TABLE_NAME='t1'\n      AND TABLE_NAME IN (SELECT 't1' UNION SELECT 'x')", length=152, parser_state=0x7ac5882b6a80)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_parse.cc:8005

#13 0x000056fa3bce3aed in dispatch_command (command=COM_QUERY, thd=0x72c498000d60, packet=0x72c49800b7e1 "", packet_length=152, blocking=true)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_parse.cc:1903

#14 0x000056fa3bce72d3 in do_command (thd=0x72c498000d60, blocking=true)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_parse.cc:1437

#15 0x000056fa3bef3af9 in do_handle_one_connection (connect=0x56fa762f0300, put_in_cache=true)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_connect.cc:1514

#16 0x000056fa3bef389e in handle_one_connection (arg=0x56fa763dd400)at /test/mtest/MDEV-31342/preview-13.2-preview_dbg/sql/sql_connect.cc:1426

#17 0x00007ac5ae89cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#18 0x00007ac5ae929ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==2353222==ERROR: AddressSanitizer: heap-use-after-free on address 0x52d0001a5998 at pc 0x57d07aa7fcb1 bp 0x7550ca4682c0 sp 0x7550ca4682b8

READ of size 8 at 0x52d0001a5998 thread T14

    #0 0x57d07aa7fcb0 in st_join_table::cleanup() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:16718:10

    #1 0x57d07aa351d7 in JOIN::cleanup(bool) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:17290:16

    #2 0x57d07aa34bc2 in JOIN::destroy() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:5172:3

    #3 0x57d07ada5759 in st_select_lex::cleanup() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_union.cc:3020:25

    #4 0x57d07ad88c07 in st_select_lex_unit::cleanup() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_union.cc:2810:30

    #5 0x57d07ada58eb in st_select_lex::cleanup() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_union.cc:3031:52

    #6 0x57d07a9a3a8d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:5369:29

    #7 0x57d07a9a2e0b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:638:10

    #8 0x57d07a850fd4 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_parse.cc:6266:12

    #9 0x57d07a82ecaa in mysql_execute_command(THD*, bool) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_parse.cc:4038:12

    #10 0x57d07a80c864 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_parse.cc:8005:18

    #11 0x57d07a805dc4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_parse.cc:1903:7

    #12 0x57d07a80dff8 in do_command(THD*, bool) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_parse.cc:1437:17

    #13 0x57d07aff4f3c in do_handle_one_connection(CONNECT*, bool) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_connect.cc:1514:11

    #14 0x57d07aff480d in handle_one_connection /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_connect.cc:1426:5

    #15 0x57d0794e686c in asan_thread_start(void*) crtstuff.c

    #16 0x7d51c889cb83 in start_thread nptl/pthread_create.c:447:8

    #17 0x7d51c8929ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x52d0001a5998 is located 5528 bytes inside of 32768-byte region [0x52d0001a4400,0x52d0001ac400)

freed by thread T14 here:

    #0 0x57d0794e8aea in free (/test/mtest/MDEV-31342/UBASAN_MD180926-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd+0x398baea) (BuildId: c14f2fb7ecfa221d)

    #1 0x57d07c6752c7 in root_free /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/mysys/my_alloc.c:75:5

    #2 0x57d07c6752c7 in free_root /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/mysys/my_alloc.c:515:7

previously allocated by thread T14 here:

    #0 0x57d0794e8d83 in malloc (/test/mtest/MDEV-31342/UBASAN_MD180926-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd+0x398bd83) (BuildId: c14f2fb7ecfa221d)

    #1 0x57d07c6a7a8b in my_malloc /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/mysys/my_malloc.c:93:29

    #2 0x57d07abbdc56 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_show.cc:5750:3

    #3 0x57d07abf5259 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_show.cc:10202:11

    #4 0x57d07aa2e054 in JOIN::exec_inner() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:5103:7

    #5 0x57d07aa2ced6 in JOIN::exec() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:4924:8

Thread T14 created by T0 here:

    #0 0x57d0794ce6f5 in pthread_create (/test/mtest/MDEV-31342/UBASAN_MD180926-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd+0x39716f5) (BuildId: c14f2fb7ecfa221d)

    #1 0x57d07953bc6a in create_thread_to_handle_connection(CONNECT*) /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/mysqld.cc:6643:19

    #2 0x57d07953cbe5 in handle_connections_sockets() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/mysqld.cc:6879:9

    #3 0x57d07953acf7 in run_main_loop() /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/mysqld.cc:6107:3

    #4 0x7d51c882a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

    #5 0x7d51c882a28a in __libc_start_main csu/../csu/libc-start.c:360:3

    #6 0x57d07944df34 in _start (/test/mtest/MDEV-31342/UBASAN_MD180926-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd+0x38f0f34) (BuildId: c14f2fb7ecfa221d)

SUMMARY: AddressSanitizer: heap-use-after-free /test/mtest/MDEV-31342/preview-13.2-preview_dbg_san/sql/sql_select.cc:16718:10 in st_join_table::cleanup()