ASAN heap-buffer-overflow in binlog_chunk_reader::find_offset_in_page/ha_innodb_binlog_reader::init_legacy_pos

--source include/have_innodb_binlog.inc

--let $datadir= `SELECT @@datadir`

CREATE TABLE t1 (id INT PRIMARY KEY, val LONGBLOB) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1, REPEAT('x', 20000));

FLUSH BINARY LOGS;

INSERT INTO t1 VALUES (2, 'y');

FLUSH BINARY LOGS;

--source include/shutdown_mysqld.inc

--write_file $MYSQLTEST_VARDIR/tmp/a.py

import sys

def crc32c(data):

    poly = 0x82F63B78

    crc = 0xFFFFFFFF

    for byte in data:

        crc ^= byte

        for _ in range(8):

            crc = (crc >> 1) ^ poly if crc & 1 else crc >> 1

    return crc ^ 0xFFFFFFFF

ibb_page_size = 16384

payload_size = ibb_page_size - 4

# Chunk header: type=0x41 (COMMIT|LAST), chunk_len=0x3FFB -> advances

# in_page_offset to exactly ibb_page_size-2, one short of the page end.

page = bytearray(ibb_page_size)

page[0] = 0x41

page[1] = 0xFB

page[2] = 0x3F

crc = crc32c(bytes(page[:payload_size]))

page[payload_size:payload_size + 4] = crc.to_bytes(4, 'little')

with open(sys.argv[1], 'r+b') as f:

    f.seek(ibb_page_size)

    f.write(bytes(page))

EOF

--exec python3 -I $MYSQLTEST_VARDIR/tmp/a.py $datadir/binlog-000000.ibb

--source include/start_mysqld.inc

SHOW BINLOG EVENTS IN 'binlog-000000.ibb' FROM 32767 LIMIT 10;

MariaDB 12.3.4-MariaDB-asan-debug-log source revision a0bdd2c4ac682751ae60d82b111e1a5b7de01b9a

=================================================================

==2465122==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x52900017b200 at pc 0x63608cbd81b3 bp 0x73979bf6f4b0 sp 0x73979bf6f4a0

READ of size 1 at 0x52900017b200 thread T15

    #0 0x63608cbd81b2 in binlog_chunk_reader::find_offset_in_page(unsigned int) /12.3/src/storage/innobase/fsp/fsp_binlog.cc:2285

    #1 0x63608c582fad in ha_innodb_binlog_reader::init_legacy_pos(THD*, char const*, unsigned long long) /12.3/src/storage/innobase/handler/innodb_binlog.cc:4053

    #2 0x63608b26fa2d in show_engine_binlog_events /12.3/src/sql/sql_repl.cc:5158

    #3 0x63608b27a937 in mysql_show_binlog_events(THD*) /12.3/src/sql/sql_repl.cc:5266

    #4 0x63608b1b135e in mysql_execute_command(THD*, bool) /12.3/src/sql/sql_parse.cc:4107

    #5 0x63608b1bdf94 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /12.3/src/sql/sql_parse.cc:7932

    #6 0x63608b1c1ac3 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /12.3/src/sql/sql_parse.cc:1903

    #7 0x63608b1c633e in do_command(THD*, bool) /12.3/src/sql/sql_parse.cc:1437

    #8 0x63608b686cec in do_handle_one_connection(CONNECT*, bool) /12.3/src/sql/sql_connect.cc:1514

    #9 0x63608b6870f2 in handle_one_connection /12.3/src/sql/sql_connect.cc:1426

    #10 0x7b97b445ea41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

    #11 0x7b97b349cb83 in start_thread nptl/pthread_create.c:447

    #12 0x7b97b3529ecb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x52900017b200 is located 0 bytes after 16384-byte region [0x529000177200,0x52900017b200)

allocated by thread T15 here:

    #0 0x7b97b44fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x63608c58cc55 in ha_innodb_binlog_reader::ha_innodb_binlog_reader(bool, unsigned long, unsigned long) /12.3/src/storage/innobase/handler/innodb_binlog.cc:3472

Thread T15 created by T0 here:

    #0 0x7b97b44f51f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245

    #1 0x63608adab426 in create_thread_to_handle_connection(CONNECT*) /12.3/src/sql/mysqld.cc:6622

SUMMARY: AddressSanitizer: heap-buffer-overflow /12.3/src/storage/innobase/fsp/fsp_binlog.cc:2285 in binlog_chunk_reader::find_offset_in_page(unsigned int)

Shadow bytes around the buggy address:

  0x52900017af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x52900017b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x52900017b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x52900017b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x52900017b180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x52900017b200:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x52900017b280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x52900017b300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x52900017b380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x52900017b400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x52900017b480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2465122==ABORTING