Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41822

mariadb-binlog ASAN crash on corrupted binlog

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q4/2026 Server Development

    Description

      mariadb-binlog crashes on the attached binlog in ASAN builds:

      ==28408==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cc93e3e03f0 at pc 0x564ad498bba4 bp 0x7ffde3f0a900 sp 0x7ffde3f0a8f0
       at pc 0x564ad498bba4 bp 0x7ffde3f0a900 sp 0x7ffde3f0a8f0
      READ of size 4 at 0x7cc93e3e03f0 thread T0
          #0 0x564ad498bba3 in uint4korr include/my_byteorder.h:121
          #1 0x564ad4a81132 in table_def::calc_field_size(unsigned int, unsigned char*) const sql/rpl_utility.cc:158
          #2 0x564ad4a45995 in Rows_log_event::print_verbose_one_row(st_io_cache*, table_def*, st_print_event_info*, st_bitmap*, unsigned char const*, unsigned char const*, char) sql/log_event_client.cc:994
          #3 0x564ad4a4b159 in Rows_log_event::print_verbose(st_io_cache*, st_print_event_info*) sql/log_event_client.cc:1546
          #4 0x564ad4a4d999 in Log_event::print_base64(st_io_cache*, st_print_event_info*, bool) sql/log_event_client.cc:1790
          #5 0x564ad4a67a6a in Rows_log_event::print_helper(_IO_FILE*, st_print_event_info*, char const*) sql/log_event_client.cc:3073
          #6 0x564ad4a72ad3 in Write_rows_log_event::print(_IO_FILE*, st_print_event_info*) sql/log_event_client.cc:3702
          #7 0x564ad4992608 in print_base64 client/mysqlbinlog.cc:885
          #8 0x564ad4992f77 in print_row_event client/mysqlbinlog.cc:973
          #9 0x564ad4999d59 in process_event(st_print_event_info*, Log_event*, unsigned long long, char const*) client/mysqlbinlog.cc:1588
          #10 0x564ad49a8282 in dump_local_log_entries client/mysqlbinlog.cc:3551
          #11 0x564ad499f708 in dump_log_entries client/mysqlbinlog.cc:2713
          #12 0x564ad49a8e96 in main client/mysqlbinlog.cc:3722
          #13 0x7f893f874de7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
          #14 0x7f893f874f06 in __libc_start_main_impl ../csu/libc-start.c:360
          #15 0x564ad498b340 in _start (client/mariadb-binlog+0x791340) (BuildId: 363d05d5acfa17213002be422b05928582d97f48)
      

      because calc_field_size first reads the data then verifies whether it was beyond the buffer end.

      MySQL BUG#39784720 fixed in mysql/mysql-server@6a2627a82d91

      Attachments

        Issue Links

          Activity

            People

              bnestere Brandon Nesterenko
              serg Sergei Golubchik
              Sergei Golubchik Sergei Golubchik
              Kristian Nielsen Kristian Nielsen
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1h
                  1h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.