[MDEV-18436] [draft] ASAN heap-use-after-free in my_strtod_int Created: 2019-01-31  Updated: 2019-02-01  Resolved: 2019-02-01

Status: Closed
Project: MariaDB Server
Component/s: N/A
Affects Version/s: 10.3, 10.4
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Alice Sherepa
Resolution: Duplicate Votes: 0
Labels: None

Issue Links:
Duplicate
duplicates MDEV-18414 Server crash or ASAN heap-use-after-f... Closed

 Description   

10.4 923415ffdb4ce2ef66d

 
AddressSanitizer: heap-use-after-free on address 0x60c0002e4030 at pc 0x5600dbcff78e bp 0x7fa314de02e0 sp 0x7fa314de02d0
 
READ of size 1 at 0x60c0002e4030 thread T36
 
    #0 0x5600dbcff78d in my_strtod_int /10.4/strings/dtoa.c:1378
 
    #1 0x5600dbcfc2ac in my_strtod /10.4/strings/dtoa.c:469
 
    #2 0x5600dbc949bc in my_strntod_8bit /10.4/strings/ctype-simple.c:788
 
    #3 0x5600da1c48bc in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /10.4/sql/field.h:168
 
    #4 0x5600da1c4bf3 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /10.4/sql/field.h:239
 
    #5 0x5600daaedc17 in Field_blob::val_real() /10.4/sql/field.cc:8307
 
    #6 0x5600dab8e38e in Item_field::val_real() /10.4/sql/item.cc:3149
 
    #7 0x5600dabb6d9e in Item_direct_ref::val_real() /10.4/sql/item.cc:8339
 
    #8 0x5600dabcfc60 in Item_direct_view_ref::val_real() /10.4/sql/item.h:5670
 
    #9 0x5600dabe2c73 in Arg_comparator::compare_real() /10.4/sql/item_cmpfunc.cc:826
 
    #10 0x5600dac1f346 in Arg_comparator::compare() /10.4/sql/item_cmpfunc.h:104
 
    #11 0x5600dabedd1d in Item_func_ge::val_int() /10.4/sql/item_cmpfunc.cc:1780
 
    #12 0x5600da886ef3 in Type_handler_int_result::Item_val_bool(Item*) const /10.4/sql/sql_type.cc:4375
 
    #13 0x5600da1aa26d in Item::val_bool() /10.4/sql/item.h:1448
 
    #14 0x5600dac0ce30 in Item_cond_and::val_int() /10.4/sql/item_cmpfunc.cc:5258
 
    #15 0x5600da672932 in SQL_SELECT::skip_record(THD*) /10.4/sql/opt_range.h:1658
 
    #16 0x5600dab2a6d2 in find_all_keys /10.4/sql/filesort.cc:807
 
    #17 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
 
    #18 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
 
    #19 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
 
    #20 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
 
    #21 0x5600da519f6c in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19387
 
    #22 0x5600da5185c4 in do_select /10.4/sql/sql_select.cc:18930
 
    #23 0x5600da4b6fb8 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4094
 
    #24 0x5600da4b4c5d in JOIN::exec() /10.4/sql/sql_select.cc:3888
 
    #25 0x5600da4b808c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/sql/sql_select.cc:4293
 
    #26 0x5600da492327 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/sql/sql_select.cc:385
 
    #27 0x5600da41792f in execute_sqlcom_select /10.4/sql/sql_parse.cc:6564
 
    #28 0x5600da404711 in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:3801
 
    #29 0x5600da41fe57 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8117
 
    #30 0x5600da3f8aec in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1803
 
    #31 0x5600da3f5ccc in do_command(THD*) /10.4/sql/sql_parse.cc:1356
 
    #32 0x5600da753320 in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1398
 
    #33 0x5600da752cea in handle_one_connection /10.4/sql/sql_connect.cc:1301
 
    #34 0x7fa3462fc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #35 0x7fa34558d41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
 
 
 
0x60c0002e4030 is located 112 bytes inside of 124-byte region [0x60c0002e3fc0,0x60c0002e403c)
 
freed by thread T36 here:
 
    #0 0x7fa3475722ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
 
    #1 0x5600dbc32e08 in free_memory /10.4/mysys/safemalloc.c:279
 
    #2 0x5600dbc32492 in sf_free /10.4/mysys/safemalloc.c:197
 
    #3 0x5600dbc04889 in my_free /10.4/mysys/my_malloc.c:221
 
    #4 0x5600da186535 in Binary_string::free() /10.4/sql/sql_string.h:604
 
    #5 0x5600da1c4107 in Binary_string::set(char const*, unsigned long) /10.4/sql/sql_string.h:462
 
    #6 0x5600da1c4154 in String::set(char const*, unsigned long, charset_info_st const*) /10.4/sql/sql_string.h:762
 
    #7 0x5600daae9432 in Field_longstr::uncompress(String*, String*, unsigned char const*, unsigned int) /10.4/sql/field.cc:8042
 
    #8 0x5600daaf27a4 in Field_blob_compressed::val_str(String*, String*) /10.4/sql/field.cc:8719
 
    #9 0x5600da1a5cc9 in Field::val_str(String*) /10.4/sql/field.h:834
 
    #10 0x5600dab154b0 in Field_blob::store_field(Field*) /10.4/sql/field.h:3835
 
    #11 0x5600dab226dd in field_conv_incompatible /10.4/sql/field_conv.cc:851
 
    #12 0x5600dab2277a in field_conv(Field*, Field*) /10.4/sql/field_conv.cc:864
 
    #13 0x5600daba615b in save_field_in_field /10.4/sql/item.cc:6352
 
    #14 0x5600daba67b8 in Item_field::save_in_field(Field*, bool) /10.4/sql/item.cc:6403
 
    #15 0x5600da6be37e in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /10.4/sql/table.cc:7809
 
    #16 0x5600dab4ca39 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /10.4/sql/handler.cc:3039
 
    #17 0x5600dab5f97b in handler::read_range_first(st_key_range const*, st_key_range const*, bool, bool) /10.4/sql/handler.cc:5817
 
    #18 0x5600da7f05c3 in handler::multi_range_read_next(void**) /10.4/sql/multi_range_read.cc:304
 
    #19 0x5600da7f08ed in Mrr_simple_index_reader::get_next(void**) /10.4/sql/multi_range_read.cc:336
 
    #20 0x5600da7f9652 in DsMrr_impl::dsmrr_next(void**) /10.4/sql/multi_range_read.cc:1406
 
    #21 0x5600db256ccf in ha_myisam::multi_range_read_next(void**) /10.4/storage/myisam/ha_myisam.cc:2526
 
    #22 0x5600dbb76bbe in ha_partition::handle_ordered_index_scan(unsigned char*, bool) /10.4/sql/ha_partition.cc:7535
 
    #23 0x5600dbb6dbb7 in ha_partition::multi_range_read_next(void**) /10.4/sql/ha_partition.cc:6480
 
    #24 0x5600daec76df in QUICK_RANGE_SELECT::get_next() /10.4/sql/opt_range.cc:11656
 
    #25 0x5600dab2a2f1 in find_all_keys /10.4/sql/filesort.cc:768
 
    #26 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
 
    #27 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
 
    #28 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
 
    #29 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
 
 
 
previously allocated by thread T36 here:
 
    #0 0x7fa347572602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
 
    #1 0x5600dbc31e63 in sf_malloc /10.4/mysys/safemalloc.c:118
 
    #2 0x5600dbc04006 in my_malloc /10.4/mysys/my_malloc.c:101
 
    #3 0x5600da5de861 in Binary_string::realloc_raw(unsigned long) /10.4/sql/sql_string.cc:101
 
    #4 0x5600da1865fa in Binary_string::realloc(unsigned long) /10.4/sql/sql_string.h:619
 
    #5 0x5600da5df551 in Binary_string::copy() /10.4/sql/sql_string.cc:209
 
    #6 0x5600dab087ab in String::copy() /10.4/sql/sql_string.h:811
 
    #7 0x5600dab155b9 in Field_blob::store_field(Field*) /10.4/sql/field.h:3838
 
    #8 0x5600dab226dd in field_conv_incompatible /10.4/sql/field_conv.cc:851
 
    #9 0x5600dab2277a in field_conv(Field*, Field*) /10.4/sql/field_conv.cc:864
 
    #10 0x5600daba615b in save_field_in_field /10.4/sql/item.cc:6352
 
    #11 0x5600daba67b8 in Item_field::save_in_field(Field*, bool) /10.4/sql/item.cc:6403
 
    #12 0x5600da6be37e in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /10.4/sql/table.cc:7809
 
    #13 0x5600dab4ca39 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /10.4/sql/handler.cc:3039
 
    #14 0x5600dab5f97b in handler::read_range_first(st_key_range const*, st_key_range const*, bool, bool) /10.4/sql/handler.cc:5817
 
    #15 0x5600da7f05c3 in handler::multi_range_read_next(void**) /10.4/sql/multi_range_read.cc:304
 
    #16 0x5600da7f08ed in Mrr_simple_index_reader::get_next(void**) /10.4/sql/multi_range_read.cc:336
 
    #17 0x5600da7f9652 in DsMrr_impl::dsmrr_next(void**) /10.4/sql/multi_range_read.cc:1406
 
    #18 0x5600db256ccf in ha_myisam::multi_range_read_next(void**) /10.4/storage/myisam/ha_myisam.cc:2526
 
    #19 0x5600dbb76bbe in ha_partition::handle_ordered_index_scan(unsigned char*, bool) /10.4/sql/ha_partition.cc:7535
 
    #20 0x5600dbb6dbb7 in ha_partition::multi_range_read_next(void**) /10.4/sql/ha_partition.cc:6480
 
    #21 0x5600daec76df in QUICK_RANGE_SELECT::get_next() /10.4/sql/opt_range.cc:11656
 
    #22 0x5600dab2a2f1 in find_all_keys /10.4/sql/filesort.cc:768
 
    #23 0x5600dab26cc9 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/sql/filesort.cc:272
 
    #24 0x5600da52fd02 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/sql/sql_select.cc:22552
 
    #25 0x5600da520c00 in st_join_table::sort_table() /10.4/sql/sql_select.cc:20365
 
    #26 0x5600da520145 in join_init_read_record(st_join_table*) /10.4/sql/sql_select.cc:20306
 
    #27 0x5600da519f6c in sub_select(JOIN*, st_join_table*, bool) /10.4/sql/sql_select.cc:19387
 
    #28 0x5600da5185c4 in do_select /10.4/sql/sql_select.cc:18930
 
    #29 0x5600da4b6fb8 in JOIN::exec_inner() /10.4/sql/sql_select.cc:4094
 
 
 
Thread T36 created by T0 here:
 
    #0 0x7fa347510253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
 
    #1 0x5600dbc5d575 in spawn_thread_noop /10.4/mysys/psi_noop.c:187
 
    #2 0x5600da164c36 in inline_mysql_thread_create /10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x5600da17970d in create_thread_to_handle_connection(CONNECT*) /10.4/sql/mysqld.cc:6195
 
    #4 0x5600da179e0d in create_new_thread(CONNECT*) /10.4/sql/mysqld.cc:6265
 
    #5 0x5600da17a198 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/sql/mysqld.cc:6363
 
    #6 0x5600da17ae15 in handle_connections_sockets() /10.4/sql/mysqld.cc:6521
 
    #7 0x5600da178f35 in mysqld_main(int, char**) /10.4/sql/mysqld.cc:5853
 
    #8 0x5600da162b2f in main /10.4/sql/main.cc:25
 
    #9 0x7fa3454a682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /10.4/strings/dtoa.c:1378 my_strtod_int
 
Shadow bytes around the buggy address:
 
  0x0c18800547b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
 
  0x0c18800547c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c18800547d0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
 
  0x0c18800547e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c18800547f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
=>0x0c1880054800: fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa fa
 
  0x0c1880054810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c1880054820: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c1880054830: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
 
  0x0c1880054840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
 
  0x0c1880054850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
==27244==ABORTING


 perl ./runall-new.pl --grammar=conf/runtime/information_schema.yy --gendata-advanced --skip-gendata --no-mask --queries=100M --duration=400 --threads=6 --seed=1548935188 --views --vcols --reporters=Backtrace,ErrorLog,Deadlock --validators=TransformerNoComparator --transformers=ExecuteAsCTE,ExecuteAsDeleteReturning,ExecuteAsExcept,ExecuteAsExecuteImmediate,ExecuteAsInsertSelect,ExecuteAsIntersect,ExecuteAsUnion,ExecuteAsUpdateDelete,ExecuteAsView,ExecuteAsPreparedTwice,ExecuteAsSPTwice --redefine=conf/mariadb/general-workarounds.yy --redefine=conf/mariadb/alter_table.yy --redefine=conf/mariadb/bulk_insert.yy --redefine=conf/mariadb/event.yy --redefine=conf/mariadb/instant_add.yy --redefine=conf/mariadb/sequences.yy --redefine=conf/mariadb/sp.yy --redefine=conf/mariadb/versioning.yy --mysqld=--log_output=FILE --mysqld=--log-bin --mysqld=--log_bin_trust_function_creators=1 --mysqld=--join-cache-level=4 --engine=MyISAM --mysqld=--default-storage-engine=MyISAM --basedir=/home/alice/git/10.4 --vardir1=/1



 Comments   
Comment by Elena Stepanova [ 2019-01-31 ]

Looks much like MDEV-18414.

Generated at Thu Feb 08 08:44:05 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.