Details
-
Bug
-
Status: In Review (View Workflow)
-
Blocker
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3
-
Can result in hang or crash
-
Q4/2026 Server Development
Description
mariadb-binlog crashes on the attached binlog in ASAN builds:
==28408==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cc93e3e03f0 at pc 0x564ad498bba4 bp 0x7ffde3f0a900 sp 0x7ffde3f0a8f0
|
at pc 0x564ad498bba4 bp 0x7ffde3f0a900 sp 0x7ffde3f0a8f0
|
READ of size 4 at 0x7cc93e3e03f0 thread T0
|
#0 0x564ad498bba3 in uint4korr include/my_byteorder.h:121
|
#1 0x564ad4a81132 in table_def::calc_field_size(unsigned int, unsigned char*) const sql/rpl_utility.cc:158
|
#2 0x564ad4a45995 in Rows_log_event::print_verbose_one_row(st_io_cache*, table_def*, st_print_event_info*, st_bitmap*, unsigned char const*, unsigned char const*, char) sql/log_event_client.cc:994
|
#3 0x564ad4a4b159 in Rows_log_event::print_verbose(st_io_cache*, st_print_event_info*) sql/log_event_client.cc:1546
|
#4 0x564ad4a4d999 in Log_event::print_base64(st_io_cache*, st_print_event_info*, bool) sql/log_event_client.cc:1790
|
#5 0x564ad4a67a6a in Rows_log_event::print_helper(_IO_FILE*, st_print_event_info*, char const*) sql/log_event_client.cc:3073
|
#6 0x564ad4a72ad3 in Write_rows_log_event::print(_IO_FILE*, st_print_event_info*) sql/log_event_client.cc:3702
|
#7 0x564ad4992608 in print_base64 client/mysqlbinlog.cc:885
|
#8 0x564ad4992f77 in print_row_event client/mysqlbinlog.cc:973
|
#9 0x564ad4999d59 in process_event(st_print_event_info*, Log_event*, unsigned long long, char const*) client/mysqlbinlog.cc:1588
|
#10 0x564ad49a8282 in dump_local_log_entries client/mysqlbinlog.cc:3551
|
#11 0x564ad499f708 in dump_log_entries client/mysqlbinlog.cc:2713
|
#12 0x564ad49a8e96 in main client/mysqlbinlog.cc:3722
|
#13 0x7f893f874de7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
|
#14 0x7f893f874f06 in __libc_start_main_impl ../csu/libc-start.c:360
|
#15 0x564ad498b340 in _start (client/mariadb-binlog+0x791340) (BuildId: 363d05d5acfa17213002be422b05928582d97f48)
|
because calc_field_size first reads the data then verifies whether it was beyond the buffer end.
MySQL BUG#39784720 fixed in mysql/mysql-server@6a2627a82d91
Attachments
Issue Links
- links to