[MDEV-14926] AddressSanitizer: heap-use-after-free in make_date_time on weird combination of functions Created: 2018-01-11  Updated: 2019-04-03  Resolved: 2019-03-14

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.0, 10.1, 10.2, 10.3, 10.4
Fix Version/s: 10.2.23, 10.1.39, 10.3.14, 10.4.4

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Duplicate
is duplicated by MDEV-18667 ASAN heap-use-after-free in make_date... Closed
Relates
relates to MDEV-18667 ASAN heap-use-after-free in make_date... Closed
relates to MDEV-19164 Assertion `fixed' failed in Item_func... Closed

 Description    

SELECT INET_ATON( FROM_UNIXTIME( @@timestamp, ( TRIM( UNHEX(HEX('%m.%d.%Y') ) ) ) ) );

10.0 4b8cd4536a2c ASAN

 
==5964==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00000d590 at pc 0xd87a68 bp 0x7ff274465450 sp 0x7ff274465448
 
READ of size 1 at 0x60d00000d590 thread T5
 
    #0 0xd87a67 in make_date_time /data/src/10.0/sql/item_timefunc.cc:471
 
    #1 0xd87a67 in Item_func_date_format::val_str(String*) /data/src/10.0/sql/item_timefunc.cc:1975
 
    #2 0xb91f5b in Item::val_str_ascii(String*) /data/src/10.0/sql/item.cc:278
 
    #3 0xf7ffe6 in Item_func_inet_aton::val_int() /data/src/10.0/sql/item_inetfunc.cc:43
 
    #4 0xb91822 in Item::send(Protocol*, String*) /data/src/10.0/sql/item.cc:6651
 
    #5 0x547221 in Protocol::send_result_set_row(List<Item>*) /data/src/10.0/sql/protocol.cc:912
 
    #6 0x64407a in select_send::send_data(List<Item>&) /data/src/10.0/sql/sql_class.cc:2572
 
    #7 0x7d454f in JOIN::exec_inner() /data/src/10.0/sql/sql_select.cc:2465
 
    #8 0x7dd343 in JOIN::exec() /data/src/10.0/sql/sql_select.cc:2379
 
    #9 0x7d24a6 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.0/sql/sql_select.cc:3318
 
    #10 0x7d2ad6 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.0/sql/sql_select.cc:373
 
    #11 0x6b566c in execute_sqlcom_select /data/src/10.0/sql/sql_parse.cc:5293
 
    #12 0x6ccea8 in mysql_execute_command(THD*) /data/src/10.0/sql/sql_parse.cc:2553
 
    #13 0x6e19f7 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.0/sql/sql_parse.cc:6569
 
    #14 0x6e5616 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.0/sql/sql_parse.cc:1296
 
    #15 0x6e9f0f in do_command(THD*) /data/src/10.0/sql/sql_parse.cc:999
 
    #16 0x975c3b in do_handle_one_connection(THD*) /data/src/10.0/sql/sql_connect.cc:1377
 
    #17 0x975ea2 in handle_one_connection /data/src/10.0/sql/sql_connect.cc:1292
 
    #18 0x11a95d4 in pfs_spawn_thread /data/src/10.0/storage/perfschema/pfs.cc:1861
 
    #19 0x7ff27ea78493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #20 0x7ff27ce3193e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x60d00000d590 is located 112 bytes inside of 132-byte region [0x60d00000d520,0x60d00000d5a4)
 
freed by thread T5 here:
 
    #0 0x7ff27ece2527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x18e68b3 in free_memory /data/src/10.0/mysys/safemalloc.c:276
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7ff27ece273f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x18e6986 in sf_malloc /data/src/10.0/mysys/safemalloc.c:115
 
    #2 0x19c964a (/data/bld/10.0-asan/bin/mysqld+0x19c964a)
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7ff27ecb1bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x11b4e2b in spawn_thread_v1 /data/src/10.0/storage/perfschema/pfs.cc:1911
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.0/sql/item_timefunc.cc:471 make_date_time
 
Shadow bytes around the buggy address:
 
  0x0c1a7fff9a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fff9a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fff9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fff9a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fff9aa0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c1a7fff9ab0: fd fd[fd]fd fd fa fa fa fa fa fa fa fa fa 00 00
 
  0x0c1a7fff9ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
 
  0x0c1a7fff9ae0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
 
  0x0c1a7fff9af0: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c1a7fff9b00: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==5964==ABORTING



 Comments   
Comment by Elena Stepanova [ 2019-02-21 ]

A variation of the failure on a different test case:

CREATE TABLE t1 (d DATE);
 
INSERT INTO t1 VALUES ('1989-03-10');
 
 
 
SELECT TIME_FORMAT('23:59:43', BINARY d) AS f FROM t1 GROUP BY 'foo';
 
 
 
# Cleanup
 
DROP TABLE t1;

10.1 ASAN d9f7b6be

 
==16500==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000032440 at pc 0x55cdddeb4586 bp 0x7fcf11089c00 sp 0x7fcf11089bf8
 
READ of size 1 at 0x60d000032440 thread T6
 
    #0 0x55cdddeb4585 in make_date_time /data/src/10.1/sql/item_timefunc.cc:475
 
    #1 0x55cdddeb4585 in Item_func_date_format::val_str(String*) /data/src/10.1/sql/item_timefunc.cc:1986
 
    #2 0x55cdddcb3641 in Item_copy_string::copy() /data/src/10.1/sql/item.cc:4063
 
    #3 0x55cddd83efdb in copy_fields(TMP_TABLE_PARAM*) /data/src/10.1/sql/sql_select.cc:23163
 
    #4 0x55cddd84d115 in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.1/sql/sql_select.cc:19816
 
    #5 0x55cddd83755d in do_select /data/src/10.1/sql/sql_select.cc:18091
 
    #6 0x55cddd87c54e in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:3275
 
    #7 0x55cddd87d836 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2562
 
    #8 0x55cddd872089 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3499
 
    #9 0x55cddd872877 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:388
 
    #10 0x55cddd741a59 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5950
 
    #11 0x55cddd75bc69 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:2995
 
    #12 0x55cddd773e7a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7468
 
    #13 0x55cddd77ac5e in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1496
 
    #14 0x55cddd7813ea in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1124
 
    #15 0x55cddda298bf in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1330
 
    #16 0x55cddda29dd0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
 
    #17 0x55cdde2f8ccc in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861
 
    #18 0x7fcf1d7bb493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #19 0x7fcf1bb7493e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x60d000032440 is located 112 bytes inside of 132-byte region [0x60d0000323d0,0x60d000032454)
 
freed by thread T6 here:
 
    #0 0x7fcf1da25527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x55cddeac4b57 in free_memory /data/src/10.1/mysys/safemalloc.c:276
 
 
 
previously allocated by thread T6 here:
 
    #0 0x7fcf1da2573f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x55cddeac4c28 in sf_malloc /data/src/10.1/mysys/safemalloc.c:115
 
    #2 0x55cddebbd69a (/data/bld/10.1-asan/bin/mysqld+0x1d9e69a)
 
 
 
Thread T6 created by T0 here:
 
    #0 0x7fcf1d9f4bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55cdde304523 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/sql/item_timefunc.cc:475 make_date_time
 
Shadow bytes around the buggy address:
 
  0x0c1a7fffe430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fffe440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fffe450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fffe460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1a7fffe470: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
 
=>0x0c1a7fffe480: fd fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa fa
 
  0x0c1a7fffe490: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c1a7fffe4a0: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 00 00
 
  0x0c1a7fffe4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
 
  0x0c1a7fffe4c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c1a7fffe4d0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==16500==ABORTING

Comment by Elena Stepanova [ 2019-02-22 ]

More variations, more stack traces.

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (d DATE) ENGINE=InnoDB;
 
INSERT INTO t1 VALUES ('1900-01-01');
 
SELECT LENGTH( DATE_FORMAT( d, BINARY DATABASE() ) ) AS f FROM t1 GROUP BY d;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.4 ASAN 5b4d6595

 
==19984==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000452f0 at pc 0x563d32e6f726 bp 0x7f5d3e1e0a50 sp 0x7f5d3e1e0a48
 
READ of size 1 at 0x60c0000452f0 thread T27
 
    #0 0x563d32e6f725 in make_date_time /data/src/10.4/sql/item_timefunc.cc:498
 
    #1 0x563d32e7dfa0 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1913
 
    #2 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
 
    #3 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492
 
    #4 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /data/src/10.4/sql/sql_type.cc:3587
 
    #5 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502
 
    #6 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167
 
    #7 0x563d325c907a in copy_funcs(Item**, THD const*) /data/src/10.4/sql/sql_select.cc:24998
 
    #8 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419
 
    #9 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133
 
    #10 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a)
 
    #11 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19719
 
    #12 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219
 
    #13 0x563d325a5b32 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19999
 
    #14 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537
 
    #15 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
 
    #16 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
 
    #17 0x563d3253e62c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574
 
    #18 0x563d32514d0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
 
    #19 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
 
    #20 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
 
    #21 0x563d3249e33c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
 
    #22 0x563d32476545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #23 0x563d32473346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
 
    #24 0x563d328022e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
 
    #25 0x563d32801ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
 
    #26 0x563d333ca714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #27 0x7f5d49b8c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #28 0x7f5d47f7293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x60c0000452f0 is located 112 bytes inside of 124-byte region [0x60c000045280,0x60c0000452fc)
 
freed by thread T27 here:
 
    #0 0x7f5d49df6527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x563d33d7b371 in free_memory /data/src/10.4/mysys/safemalloc.c:279
 
    #2 0x563d33d7a977 in sf_free /data/src/10.4/mysys/safemalloc.c:197
 
    #3 0x563d33d4b3c0 in my_free /data/src/10.4/mysys/my_malloc.c:222
 
    #4 0x563d321e56e5 in Binary_string::free() /data/src/10.4/sql/sql_string.h:604
 
    #5 0x563d32679124 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43
 
    #6 0x563d32204ce9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613
 
    #7 0x563d32e7de9e in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1901
 
    #8 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
 
    #9 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492
 
    #10 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /data/src/10.4/sql/sql_type.cc:3587
 
    #11 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502
 
    #12 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167
 
    #13 0x563d325c907a in copy_funcs(Item**, THD const*) /data/src/10.4/sql/sql_select.cc:24998
 
    #14 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419
 
    #15 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133
 
    #16 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a)
 
    #17 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19719
 
    #18 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219
 
    #19 0x563d325a5b32 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19999
 
    #20 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537
 
    #21 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
 
    #22 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
 
    #23 0x563d3253e62c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574
 
    #24 0x563d32514d0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
 
    #25 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
 
    #26 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
 
    #27 0x563d3249e33c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
 
    #28 0x563d32476545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #29 0x563d32473346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f5d49df673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x563d33d7a0e7 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118
 
    #2 0x563d33d4a9e2 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
 
    #3 0x563d32679183 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:46
 
    #4 0x563d32204ce9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613
 
    #5 0x563d3267a62b in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:238
 
    #6 0x563d321e5899 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:821
 
    #7 0x563d32dd1c80 in Item_func_database::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:2333
 
    #8 0x563d32e828b6 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2338
 
    #9 0x563d32e7dc22 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1885
 
    #10 0x563d32d5dbe8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
 
    #11 0x563d32c8146c in Item::save_int_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6492
 
    #12 0x563d3293eed7 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /data/src/10.4/sql/sql_type.cc:3587
 
    #13 0x563d32c8164e in Item::save_in_field(Field*, bool) /data/src/10.4/sql/item.cc:6502
 
    #14 0x563d3233d08b in Item_result_field::save_in_result_field(bool) /data/src/10.4/sql/item.h:3167
 
    #15 0x563d325c907a in copy_funcs(Item**, THD const*) /data/src/10.4/sql/sql_select.cc:24998
 
    #16 0x563d325b1073 in end_write /data/src/10.4/sql/sql_select.cc:21419
 
    #17 0x563d325e056d in AGGR_OP::put_record(bool) /data/src/10.4/sql/sql_select.cc:28133
 
    #18 0x563d325ed85a in AGGR_OP::put_record() (/data/bld/10.4-asan/bin/mysqld+0x115b85a)
 
    #19 0x563d325a4d41 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19719
 
    #20 0x563d325a6f58 in evaluate_join_record /data/src/10.4/sql/sql_select.cc:20219
 
    #21 0x563d325a5b32 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:19999
 
    #22 0x563d325a3e3d in do_select /data/src/10.4/sql/sql_select.cc:19537
 
    #23 0x563d3253d254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
 
    #24 0x563d3253ab4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
 
    #25 0x563d3253e62c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574
 
    #26 0x563d32514d0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
 
    #27 0x563d32495a49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
 
    #28 0x563d324825d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
 
    #29 0x563d3249e33c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f5d49dc5bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x563d333cacdc in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
 
    #2 0x563d321c2866 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x563d321d8090 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6194
 
    #4 0x563d321d8795 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6264
 
    #5 0x563d321d8b25 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6362
 
    #6 0x563d321d9771 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6520
 
    #7 0x563d321d78cb in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5852
 
    #8 0x563d321c06ef in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f5d47eaa2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/item_timefunc.cc:498 make_date_time
 
Shadow bytes around the buggy address:
 
  0x0c1880000a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1880000a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1880000a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1880000a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1880000a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
=>0x0c1880000a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
 
  0x0c1880000a60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c1880000a70: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
 
  0x0c1880000a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
 
  0x0c1880000a90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c1880000aa0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==19984==ABORTING


CREATE TABLE t1 (d DATE) ENGINE=MyISAM;
 
INSERT INTO t1 VALUES ('1900-01-01');
 
SELECT LENGTH( DATE_FORMAT( d, BINARY DATABASE() ) ) AS f FROM t1 GROUP BY d;
 
 
 
# Cleanup
 
DROP TABLE t1;


==20270==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000028af0 at pc 0x56474ee05726 bp 0x7f1aebdcad40 sp 0x7f1aebdcad38
 
READ of size 1 at 0x60c000028af0 thread T5
 
    #0 0x56474ee05725 in make_date_time /data/src/10.4/sql/item_timefunc.cc:498
 
    #1 0x56474ee13fa0 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1913
 
    #2 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
 
    #3 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753
 
    #4 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789
 
    #5 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592
 
    #6 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391
 
    #7 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494
 
    #8 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
 
    #9 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
 
    #10 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574
 
    #11 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
 
    #12 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
 
    #13 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
 
    #14 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
 
    #15 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #16 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
 
    #17 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
 
    #18 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
 
    #19 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #20 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #21 0x7f1af553293e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x60c000028af0 is located 112 bytes inside of 124-byte region [0x60c000028a80,0x60c000028afc)
 
freed by thread T5 here:
 
    #0 0x7f1af73b6527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x56474fd11371 in free_memory /data/src/10.4/mysys/safemalloc.c:279
 
    #2 0x56474fd10977 in sf_free /data/src/10.4/mysys/safemalloc.c:197
 
    #3 0x56474fce13c0 in my_free /data/src/10.4/mysys/my_malloc.c:222
 
    #4 0x56474e17b6e5 in Binary_string::free() /data/src/10.4/sql/sql_string.h:604
 
    #5 0x56474e60f124 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:43
 
    #6 0x56474e19ace9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613
 
    #7 0x56474ee13e9e in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1901
 
    #8 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
 
    #9 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753
 
    #10 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789
 
    #11 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592
 
    #12 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391
 
    #13 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494
 
    #14 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
 
    #15 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
 
    #16 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574
 
    #17 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
 
    #18 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
 
    #19 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
 
    #20 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
 
    #21 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #22 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
 
    #23 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
 
    #24 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
 
    #25 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #26 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f1af73b673f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x56474fd100e7 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118
 
    #2 0x56474fce09e2 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
 
    #3 0x56474e60f183 in Binary_string::real_alloc(unsigned long) /data/src/10.4/sql/sql_string.cc:46
 
    #4 0x56474e19ace9 in Binary_string::alloc(unsigned long) /data/src/10.4/sql/sql_string.h:613
 
    #5 0x56474e61062b in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:238
 
    #6 0x56474e17b899 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:821
 
    #7 0x56474ed67c80 in Item_func_database::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:2333
 
    #8 0x56474ee188b6 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2338
 
    #9 0x56474ee13c22 in Item_func_date_format::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:1885
 
    #10 0x56474ecf3be8 in Item_func_octet_length::val_int() /data/src/10.4/sql/item_func.cc:2760
 
    #11 0x56474ecdabfb in Item_int_func::val_str(String*) /data/src/10.4/sql/item_func.cc:753
 
    #12 0x56474ec0ab0a in Item_copy_string::copy() /data/src/10.4/sql/item.cc:4789
 
    #13 0x56474e55c54d in copy_fields(TMP_TABLE_PARAM*) /data/src/10.4/sql/sql_select.cc:24592
 
    #14 0x56474e546b0b in end_send_group(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:21391
 
    #15 0x56474e5397eb in do_select /data/src/10.4/sql/sql_select.cc:19494
 
    #16 0x56474e4d3254 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4360
 
    #17 0x56474e4d0b4f in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4142
 
    #18 0x56474e4d462c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4574
 
    #19 0x56474e4aad0e in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:423
 
    #20 0x56474e42ba49 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6604
 
    #21 0x56474e4185d2 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3841
 
    #22 0x56474e43433c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
 
    #23 0x56474e40c545 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #24 0x56474e409346 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
 
    #25 0x56474e7982e9 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
 
    #26 0x56474e797ce2 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
 
    #27 0x56474f360714 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #28 0x7f1af714c493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f1af7385bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x56474f360cdc in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
 
    #2 0x56474e158866 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x56474e16e090 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6194
 
    #4 0x56474e16e795 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6264
 
    #5 0x56474e16eb25 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6362
 
    #6 0x56474e16f771 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6520
 
    #7 0x56474e16d8cb in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5852
 
    #8 0x56474e1566ef in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f1af546a2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/item_timefunc.cc:498 make_date_time
 
Shadow bytes around the buggy address:
 
  0x0c187fffd100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c187fffd110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c187fffd120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c187fffd130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c187fffd140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
=>0x0c187fffd150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
 
  0x0c187fffd160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c187fffd170: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
 
  0x0c187fffd180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c187fffd190: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c187fffd1a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==20270==ABORTING

Generated at Thu Feb 08 08:17:20 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.