ASAN: stack-buffer-overflow in strcpy/mrn::DatabaseRepairer::detect_paths/mrn::DatabaseRepairer::each_database

INSTALL SONAME 'ha_mroonga';

CREATE TABLE t1 ( id INT PRIMARY KEY, body TEXT, fulltext INDEX (body))

  ENGINE=Mroonga DEFAULT CHARSET=utf8mb4;

INSERT INTO t1 VALUES (1, 'hello mroonga world');

SET GLOBAL mroonga_database_path_prefix = REPEAT('A', 8300);

CHECK TABLE t1;

REPAIR TABLE t1;

DROP TABLE t1;

UNINSTALL SONAME 'ha_mroonga';

MariaDB 10.11.19-MariaDB-asan-debug-log source revision def4f092af8dd6838ae4a3d0258f149a49f530dd 

=================================================================

==2774158==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x735e429070a0 at pc 0x735e524a7923 bp 0x735e4361e800 sp 0x735e4361dfa8

WRITE of size 8301 at 0x735e429070a0 thread T6

    #0 0x735e524a7922 in strcpy ../../../../src/libsanitizer/asan/asan_interceptors.cpp:563

    #1 0x735e411bc1f5 in mrn::DatabaseRepairer::detect_paths() /10.11/src/storage/mroonga/lib/mrn_database_repairer.cpp:188

    #2 0x735e411bc66a in mrn::DatabaseRepairer::each_database(void (mrn::DatabaseRepairer::*)(_grn_ctx*, _grn_obj*, char const*, void*), void*) /10.11/src/storage/mroonga/lib/mrn_database_repairer.cpp:93

    #3 0x735e411bcd6b in mrn::DatabaseRepairer::is_corrupt() /10.11/src/storage/mroonga/lib/mrn_database_repairer.cpp:75

    #4 0x735e41139431 in ha_mroonga::storage_check(THD*, st_ha_check_opt*) /10.11/src/storage/mroonga/ha_mroonga.cpp:13972

    #5 0x735e4113981d in ha_mroonga::check(THD*, st_ha_check_opt*) /10.11/src/storage/mroonga/ha_mroonga.cpp:13987

    #6 0x5f1f4b54d47f in handler::ha_check(THD*, st_ha_check_opt*) /10.11/src/sql/handler.cc:5225

    #7 0x5f1f4b192c31 in mysql_admin_table /10.11/src/sql/sql_admin.cc:918

    #8 0x5f1f4b1980e9 in Sql_cmd_check_table::execute(THD*) /10.11/src/sql/sql_admin.cc:1619

    #9 0x5f1f4ad59209 in mysql_execute_command(THD*, bool) /10.11/src/sql/sql_parse.cc:6190

    #10 0x5f1f4ad5ae65 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.11/src/sql/sql_parse.cc:8210

    #11 0x5f1f4ad5ed0a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.11/src/sql/sql_parse.cc:1924

    #12 0x5f1f4ad63782 in do_command(THD*, bool) /10.11/src/sql/sql_parse.cc:1434

    #13 0x5f1f4b15fbbb in do_handle_one_connection(CONNECT*, bool) /10.11/src/sql/sql_connect.cc:1486

    #14 0x5f1f4b160094 in handle_one_connection /10.11/src/sql/sql_connect.cc:1398

    #15 0x5f1f4bbc19c0 in pfs_spawn_thread /10.11/src/storage/perfschema/pfs.cc:2201

    #16 0x735e5245ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #17 0x735e5149cb83 in start_thread nptl/pthread_create.c:447

    #18 0x735e51529ecb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x735e429070a0 is located in stack of thread T6 at offset 8352 in frame

    #0 0x735e4113920b in ha_mroonga::storage_check(THD*, st_ha_check_opt*) /10.11/src/storage/mroonga/ha_mroonga.cpp:13969

  This frame has 3 object(s):

    [48, 80) '_db_stack_frame_' (line 13970)

    [112, 8352) 'repairer' (line 13971)

    [8608, 9632) 'method_name' (line 13970) <== Memory access at offset 8352 partially underflows this variable

HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork

      (longjmp and C++ exceptions *are* supported)

Thread T6 created by T0 here:

    #0 0x735e524f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x5f1f4bbc1c2f in my_thread_create /10.11/src/storage/perfschema/my_thread.h:52

    #2 0x5f1f4bbc1c2f in pfs_spawn_thread_v1 /10.11/src/storage/perfschema/pfs.cc:2252

SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/asan/asan_interceptors.cpp:563 in strcpy

Shadow bytes around the buggy address:

  0x735e42906e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42906e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42906f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42906f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42907000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x735e42907080: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2

  0x735e42907100: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2

  0x735e42907180: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42907200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42907280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x735e42907300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2774158==ABORTING