ASAN heap-buffer-overflow mrn_get_string_between_quote/mrn_parse_table_param

INSTALL SONAME 'ha_mroonga';

CREATE TABLE t1 (c INT) ENGINE=Mroonga COMMENT='engine "InnoDB\\x"';

DROP TABLE t1;

UNINSTALL SONAME 'ha_mroonga';

MariaDB 10.11.19-MariaDB-asan-debug-log source revision def4f092af8dd6838ae4a3d0258f149a49f530dd 

Version: '10.11.19-MariaDB-asan-debug-log'  

=================================================================

==2770826==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50400001a9b8 at pc 0x72824cd87c54 bp 0x72824f2e2d60 sp 0x72824f2e2d50

WRITE of size 1 at 0x50400001a9b8 thread T6

    #0 0x72824cd87c53 in mrn_get_string_between_quote /10.11/src/storage/mroonga/mrn_table.cpp:187

    #1 0x72824cd8981e in mrn_parse_table_param /10.11/src/storage/mroonga/mrn_table.cpp:447

    #2 0x72824ccdce0e in ha_mroonga::create_share_for_create() const /10.11/src/storage/mroonga/ha_mroonga.cpp:3080

    #3 0x72824ccde3a8 in ha_mroonga::table_flags() const /10.11/src/storage/mroonga/ha_mroonga.cpp:2931

    #4 0x570d5a15a748 in handler::init() /10.11/src/sql/handler.h:3398

    #5 0x570d5a15a748 in get_new_handler(TABLE_SHARE*, st_mem_root*, handlerton*) /10.11/src/sql/handler.cc:389

    #6 0x570d59be7482 in mysql_create_frm_image(THD*, HA_CREATE_INFO*, Alter_info*, int, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /10.11/src/sql/sql_table.cc:4367

    #7 0x570d59beb200 in create_table_impl /10.11/src/sql/sql_table.cc:4909

    #8 0x570d59bebd58 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /10.11/src/sql/sql_table.cc:5034

    #9 0x570d59beca85 in mysql_create_table /10.11/src/sql/sql_table.cc:5281

    #10 0x570d59bfd636 in Sql_cmd_create_table_like::execute(THD*) /10.11/src/sql/sql_table.cc:13319

    #11 0x570d5997f209 in mysql_execute_command(THD*, bool) /10.11/src/sql/sql_parse.cc:6190

    #12 0x570d59980e65 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.11/src/sql/sql_parse.cc:8210

    #13 0x570d59984d0a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.11/src/sql/sql_parse.cc:1924

    #14 0x570d59989782 in do_command(THD*, bool) /10.11/src/sql/sql_parse.cc:1434

    #15 0x570d59d85bbb in do_handle_one_connection(CONNECT*, bool) /10.11/src/sql/sql_connect.cc:1486

    #16 0x570d59d86094 in handle_one_connection /10.11/src/sql/sql_connect.cc:1398

    #17 0x570d5a7e79c0 in pfs_spawn_thread /10.11/src/storage/perfschema/pfs.cc:2201

    #18 0x72825e25ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #19 0x72825d29cb83 in start_thread nptl/pthread_create.c:447

    #20 0x72825d329ecb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x50400001a9b8 is located 0 bytes after 40-byte region [0x50400001a990,0x50400001a9b8)

allocated by thread T6 here:

    #0 0x72825e2fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x570d5b2da1db in my_malloc /10.11/src/mysys/my_malloc.c:92

Thread T6 created by T0 here:

    #0 0x72825e2f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x570d5a7e7c2f in my_thread_create /10.11/src/storage/perfschema/my_thread.h:52

    #2 0x570d5a7e7c2f in pfs_spawn_thread_v1 /10.11/src/storage/perfschema/pfs.cc:2252

SUMMARY: AddressSanitizer: heap-buffer-overflow /10.11/src/storage/mroonga/mrn_table.cpp:187 in mrn_get_string_between_quote

Shadow bytes around the buggy address:

  0x50400001a700: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00

  0x50400001a780: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fd

  0x50400001a800: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd

  0x50400001a880: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd

  0x50400001a900: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00

=>0x50400001a980: fa fa 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa

  0x50400001aa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x50400001aa80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x50400001ab00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x50400001ab80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x50400001ac00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2770826==ABORTING