[MDEV-16905] ASAN heap-use-after-free in __interceptor_strnlen / ... / TABLE::verify_constraints upon INSERT into temporary table with CHECK constraint Created: 2018-08-05  Updated: 2019-02-05  Resolved: 2019-02-05

Status: Closed
Project: MariaDB Server
Component/s: Data Definition - Temporary, Data Manipulation - Insert
Affects Version/s: 10.2, 10.3, 10.4
Fix Version/s: 10.4.3, 10.2.22, 10.3.13

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-16903 Assertion `!auto_increment_field_not_... Closed

 Description   

Note: MDEV-16903 is closed now, but the problem described here still exists, so I don't consider it to be a duplicate anymore.

CREATE TEMPORARY TABLE t1 (a INT DEFAULT 0, CHECK (a > 0));
 
ALTER TABLE t1 DROP CONSTRAINT IF EXISTS non_existing_constraint;
 
INSERT INTO t1 () VALUES ();

10.3 ASAN 3570ea918

 
==3627==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00005d981 at pc 0x7fefcf4695fa bp 0x7fefc2c521d0 sp 0x7fefc2c521a8
 
READ of size 20 at 0x61b00005d981 thread T5
 
    #0 0x7fefcf4695f9 in __interceptor_strnlen (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2a5f9)
 
    #1 0x55a75a2e5284 in process_str_arg /data/src/10.3/strings/my_vsnprintf.c:205
 
    #2 0x55a75a2e965d in my_vsnprintf_ex /data/src/10.3/strings/my_vsnprintf.c:626
 
    #3 0x55a75a1db7f8 in my_error /data/src/10.3/mysys/my_error.c:121
 
    #4 0x55a758ca466b in TABLE::verify_constraints(bool) /data/src/10.3/sql/table.cc:5260
 
    #5 0x55a758ca3f02 in TABLE_LIST::view_check_option(THD*, bool) /data/src/10.3/sql/table.cc:5220
 
    #6 0x55a75895a7b0 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:1040
 
    #7 0x55a7589f4600 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4726
 
    #8 0x55a758a0a35e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
 
    #9 0x55a7589e45f5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
 
    #10 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
 
    #11 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #12 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #13 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #14 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #15 0x7fefcd60f93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x61b00005d994 is located 0 bytes to the right of 1556-byte region [0x61b00005d380,0x61b00005d994)
 
freed by thread T5 here:
 
    #0 0x7fefcf493527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x55a75a222a64 in free_memory /data/src/10.3/mysys/safemalloc.c:279
 
    #2 0x55a75a22206a in sf_free /data/src/10.3/mysys/safemalloc.c:197
 
    #3 0x55a75a1f2a7c in my_free /data/src/10.3/mysys/my_malloc.c:222
 
    #4 0x55a758f0a041 in THD::free_tmp_table_share(TMP_TABLE_SHARE*, bool) /data/src/10.3/sql/temporary_tables.cc:1460
 
    #5 0x55a758f05784 in THD::drop_temporary_table(TABLE*, bool*, bool) /data/src/10.3/sql/temporary_tables.cc:646
 
    #6 0x55a758c17b48 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9887
 
    #7 0x55a758d5f50c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:495
 
    #8 0x55a7589ff4c9 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6284
 
    #9 0x55a758a0a35e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
 
    #10 0x55a7589e45f5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
 
    #11 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
 
    #12 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #13 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #14 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #15 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7fefcf49373f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x55a75a2217da in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x55a75a1f216f in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x55a758f07020 in THD::create_temporary_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*) /data/src/10.3/sql/temporary_tables.cc:940
 
    #4 0x55a758f02966 in THD::create_and_open_tmp_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool, bool) /data/src/10.3/sql/temporary_tables.cc:76
 
    #5 0x55a758bf9e40 in create_table_impl /data/src/10.3/sql/sql_table.cc:4984
 
    #6 0x55a758bfa7e3 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5095
 
    #7 0x55a758bfb243 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.3/sql/sql_table.cc:5188
 
    #8 0x55a7589f1e3a in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4279
 
    #9 0x55a758a0a35e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
 
    #10 0x55a7589e45f5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
 
    #11 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
 
    #12 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #13 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #14 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #15 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7fefcf462bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55a7598683b1 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
    #2 0x55a75874e208 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x55a75876431c in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6563
 
    #4 0x55a758764a21 in create_new_thread /data/src/10.3/sql/mysqld.cc:6633
 
    #5 0x55a758765a38 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6908
 
    #6 0x55a7587637d9 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6185
 
    #7 0x55a75874c28f in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7fefcd5472b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strnlen
 
Shadow bytes around the buggy address:
 
  0x0c3680003ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3680003b30:[fd]fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3680003b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3680003b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3680003b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3680003b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3680003b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==3627==ABORTING

Reproducible with at least InnoDB and MyISAM.
On non-ASAN builds problems are less obvious, but for example the following has been seen:

mysqltest: At line 3: query 'INSERT INTO t1 () VALUES ()' failed: 4025: CONSTRAINT `CONSTRAINT_1` failed for `test`.``

(Note the missing table name).

Here is another test case, from a comment to MDEV-16903, it's also still failing:

CREATE TEMPORARY TABLE t1 (
 
  id INT NOT NULL AUTO_INCREMENT,
 
  f INT NOT NULL DEFAULT 0,
 
  PRIMARY KEY (id)
 
);
 
INSERT INTO t1 () VALUES ();
 
ALTER IGNORE TABLE t1 ADD CONSTRAINT CHECK (f > 0);
 
INSERT INTO t1 () VALUES ();

10.2 37ffdb44ef9

 
==3275==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00005e759 at pc 0x7f4872cd45fa bp 0x7f486661ebc0 sp 0x7f486661eb98
 
READ of size 20 at 0x61b00005e759 thread T5
 
    #0 0x7f4872cd45f9 in __interceptor_strnlen (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2a5f9)
 
    #1 0x55e7c991a36e in process_str_arg /data/src/10.2/strings/my_vsnprintf.c:205
 
    #2 0x55e7c991e747 in my_vsnprintf_ex /data/src/10.2/strings/my_vsnprintf.c:626
 
    #3 0x55e7c981045f in my_error /data/src/10.2/mysys/my_error.c:121
 
    #4 0x55e7c847f860 in TABLE::verify_constraints(bool) /data/src/10.2/sql/table.cc:5181
 
    #5 0x55e7c847f1cc in TABLE_LIST::view_check_option(THD*, bool) /data/src/10.2/sql/table.cc:5143
 
    #6 0x55e7c8184dd2 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:1034
 
    #7 0x55e7c81e75aa in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4438
 
    #8 0x55e7c81fe9eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
 
    #9 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
 
    #10 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
 
    #11 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #12 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #13 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #14 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #15 0x7f4870e7a93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x61b00005e76c is located 0 bytes to the right of 1516-byte region [0x61b00005e180,0x61b00005e76c)
 
freed by thread T5 here:
 
    #0 0x7f4872cfe527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x55e7c9858a13 in free_memory /data/src/10.2/mysys/safemalloc.c:279
 
    #2 0x55e7c9858019 in sf_free /data/src/10.2/mysys/safemalloc.c:197
 
    #3 0x55e7c98272a8 in my_free /data/src/10.2/mysys/my_malloc.c:217
 
    #4 0x55e7c8690781 in THD::free_tmp_table_share(TMP_TABLE_SHARE*, bool) /data/src/10.2/sql/temporary_tables.cc:1432
 
    #5 0x55e7c868c2ab in THD::drop_temporary_table(TABLE*, bool*, bool) /data/src/10.2/sql/temporary_tables.cc:637
 
    #6 0x55e7c8400797 in mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.2/sql/sql_table.cc:9615
 
    #7 0x55e7c852ad16 in Sql_cmd_alter_table::execute(THD*) /data/src/10.2/sql/sql_alter.cc:329
 
    #8 0x55e7c81f3eb5 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:6228
 
    #9 0x55e7c81fe9eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
 
    #10 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
 
    #11 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
 
    #12 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #13 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #14 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #15 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f4872cfe73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x55e7c9857789 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
 
    #2 0x55e7c98269e0 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
 
    #3 0x55e7c868d95c in THD::create_temporary_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*) /data/src/10.2/sql/temporary_tables.cc:931
 
    #4 0x55e7c868993d in THD::create_and_open_tmp_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool) /data/src/10.2/sql/temporary_tables.cc:74
 
    #5 0x55e7c83e3336 in create_table_impl /data/src/10.2/sql/sql_table.cc:4915
 
    #6 0x55e7c83e3c1d in mysql_create_table_no_lock(THD*, char const*, char const*, Table_specification_st*, Alter_info*, bool*, int) /data/src/10.2/sql/sql_table.cc:5019
 
    #7 0x55e7c83e444c in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.2/sql/sql_table.cc:5082
 
    #8 0x55e7c81e4dbc in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3991
 
    #9 0x55e7c81fe9eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
 
    #10 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
 
    #11 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
 
    #12 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #13 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #14 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #15 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f4872ccdbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55e7c8f37ad9 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
 
    #2 0x55e7c7fd2c8e in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
 
    #3 0x55e7c7fe7c2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6466
 
    #4 0x55e7c7fe8330 in create_new_thread /data/src/10.2/sql/mysqld.cc:6536
 
    #5 0x55e7c7fe9347 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6811
 
    #6 0x55e7c7fe7180 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6085
 
    #7 0x55e7c7fd102f in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7f4870db22b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strnlen
 
Shadow bytes around the buggy address:
 
  0x0c3680003c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003ca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3680003cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3680003ce0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa fa
 
  0x0c3680003cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3680003d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3680003d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3680003d20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3680003d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==3275==ABORTING


Generated at Thu Feb 08 08:32:25 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.