ASAN stack-buffer-overflow mrn::DatabaseManager::ensure_database_directory/mrn::DatabaseManager::open

INSTALL SONAME 'ha_mroonga';

# 6999 bytes of '/', far exceeding MRN_MAX_PATH_SIZE (PATH_MAX=4096).

SET GLOBAL mroonga_database_path_prefix = REPEAT('/', 6999);

CREATE TABLE t1 (id INT PRIMARY KEY, c TEXT) ENGINE=Mroonga;

DROP TABLE t1;

SET GLOBAL mroonga_database_path_prefix = DEFAULT;

UNINSTALL SONAME 'ha_mroonga';

MariaDB 10.11.19-MariaDB-asan-debug-log source revision def4f092af8dd6838ae4a3d0258f149a49f530dd 

Version: '10.11.19-MariaDB-asan-debug-log' 

=================================================================

==2769065==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x79f9ae2cd4e0 at pc 0x79f9be0f7d48 bp 0x79f9af0da9c0 sp 0x79f9af0da168

WRITE of size 6998 at 0x79f9ae2cd4e0 thread T6

    #0 0x79f9be0f7d47 in strncpy ../../../../src/libsanitizer/asan/asan_interceptors.cpp:614

    #1 0x79f9acbb8f3d in mrn::DatabaseManager::ensure_database_directory() /10.11/src/storage/mroonga/lib/mrn_database_manager.cpp:334

    #2 0x79f9acbb9a44 in mrn::DatabaseManager::open(char const*, mrn::Database**) /10.11/src/storage/mroonga/lib/mrn_database_manager.cpp:110

    #3 0x79f9acae2b7d in ha_mroonga::ensure_database_open(char const*, mrn::Database**) /10.11/src/storage/mroonga/ha_mroonga.cpp:4226

    #4 0x79f9acafd17f in ha_mroonga::generic_delete_table(char const*, char const*) /10.11/src/storage/mroonga/ha_mroonga.cpp:5109

    #5 0x79f9acafe23a in ha_mroonga::delete_table(char const*) /10.11/src/storage/mroonga/ha_mroonga.cpp:5208

    #6 0x62a9f7f986e3 in hton_drop_table /10.11/src/sql/handler.cc:577

    #7 0x62a9f7faf87c in ha_delete_table(THD*, handlerton*, char const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, bool) /10.11/src/sql/handler.cc:3346

    #8 0x62a9f7fb0549 in delete_table_force /10.11/src/sql/handler.cc:5658

    #9 0x62a9f7805c53 in plugin_foreach_with_mask(THD*, char (*)(THD*, st_plugin_int**, void*), int, unsigned int, void*) /10.11/src/sql/sql_plugin.cc:2583

    #10 0x62a9f7faa5b7 in ha_delete_table_force(THD*, char const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /10.11/src/sql/handler.cc:5704

    #11 0x62a9f79f85c9 in mysql_rm_table_no_locks(THD*, TABLE_LIST*, st_mysql_const_lex_string const*, st_ddl_log_state*, bool, bool, bool, bool, bool, bool) /10.11/src/sql/sql_table.cc:1813

    #12 0x62a9f79fb7ef in mysql_rm_table(THD*, TABLE_LIST*, bool, bool, bool, bool) /10.11/src/sql/sql_table.cc:1302

    #13 0x62a9f77ae2d3 in mysql_execute_command(THD*, bool) /10.11/src/sql/sql_parse.cc:5120

    #14 0x62a9f77b5e65 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.11/src/sql/sql_parse.cc:8210

    #15 0x62a9f77b9d0a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.11/src/sql/sql_parse.cc:1924

    #16 0x62a9f77be782 in do_command(THD*, bool) /10.11/src/sql/sql_parse.cc:1434

    #17 0x62a9f7bbabbb in do_handle_one_connection(CONNECT*, bool) /10.11/src/sql/sql_connect.cc:1486

    #18 0x62a9f7bbb094 in handle_one_connection /10.11/src/sql/sql_connect.cc:1398

    #19 0x62a9f861c9c0 in pfs_spawn_thread /10.11/src/storage/perfschema/pfs.cc:2201

    #20 0x79f9be05ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #21 0x79f9bd09cb83 in start_thread nptl/pthread_create.c:447

    #22 0x79f9bd129ecb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x79f9ae2cd4e0 is located in stack of thread T6 at offset 5344 in frame

    #0 0x79f9acbb8d41 in mrn::DatabaseManager::ensure_database_directory() /10.11/src/storage/mroonga/lib/mrn_database_manager.cpp:314

  This frame has 3 object(s):

    [32, 64) '_db_stack_frame_' (line 315)

    [96, 1120) 'method_name' (line 315)

    [1248, 5344) 'database_directory' (line 332) <== Memory access at offset 5344 overflows this variable

HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork

      (longjmp and C++ exceptions *are* supported)

Thread T6 created by T0 here:

    #0 0x79f9be0f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x62a9f861cc2f in my_thread_create /10.11/src/storage/perfschema/my_thread.h:52

    #2 0x62a9f861cc2f in pfs_spawn_thread_v1 /10.11/src/storage/perfschema/pfs.cc:2252

SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/asan/asan_interceptors.cpp:614 in strncpy

Shadow bytes around the buggy address:

  0x79f9ae2cd200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x79f9ae2cd280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x79f9ae2cd300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x79f9ae2cd380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x79f9ae2cd400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x79f9ae2cd480: 00 00 00 00 00 00 00 00 00 00 00 00[f3]f3 f3 f3

  0x79f9ae2cd500: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f5 f5 f5 f5

  0x79f9ae2cd580: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x79f9ae2cd600: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x79f9ae2cd680: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

  0x79f9ae2cd700: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2769065==ABORTING