[MDEV-19637] Crash on an SP variable assignment to a wrong subselect Created: 2019-05-30  Updated: 2019-05-30  Resolved: 2019-05-30

Status: Closed
Project: MariaDB Server
Component/s: Stored routines
Affects Version/s: 10.4, 10.5
Fix Version/s: 10.4.6, 10.5.0

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Blocks
blocks MDEV-5816 MySQL WL#4179 - Stored programs: vali... Closed

 Description    

SET sql_mode='';
 
DELIMITER $$
 
BEGIN NOT ATOMIC
 
  DECLARE a INT;
 
  SET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);
 
END;
 
$$
 
DELIMITER ;


ERROR 2013 (HY000): Lost connection to MySQL server during query

Note, 10.3 correctly returns the expected error without crashing:

ERROR 1234 (42000): Incorrect usage/placement of 'HIGH_PRIORITY'



 Comments   
Comment by Elena Stepanova [ 2019-05-30 ]

To make it findable and comparable:

10.4 7d3a759d

 
#3  <signal handler called>
 
#4  0x0000562e0d716119 in plugin_unlock_list (thd=0x0, list=0x8f8f8f8f8f8f8f97, count=2408550286) at /data/src/10.4/sql/sql_plugin.cc:1404
 
#5  0x0000562e0d6c4e70 in lex_end_stage1 (lex=0x7fee34147a28) at /data/src/10.4/sql/sql_lex.cc:803
 
#6  0x0000562e0d6c4dd1 in lex_end (lex=0x7fee34147a28) at /data/src/10.4/sql/sql_lex.cc:789
 
#7  0x0000562e0d610b87 in sp_head::~sp_head (this=0x7fee34136d78, __in_chrg=<optimized out>) at /data/src/10.4/sql/sp_head.cc:821
 
#8  0x0000562e0d610c5e in sp_head::~sp_head (this=0x7fee34136d78, __in_chrg=<optimized out>) at /data/src/10.4/sql/sp_head.cc:832
 
#9  0x0000562e0d6ca9b4 in LEX::cleanup_lex_after_parse_error (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_lex.cc:3138
 
#10 0x0000562e0d9a105c in MYSQLparse (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_yacc.yy:16264
 
#11 0x0000562e0d710488 in parse_sql (thd=0x7fee34000b00, parser_state=0x7fee44ece180, creation_ctx=0x0, do_pfs_digest=true) at /data/src/10.4/sql/sql_parse.cc:10184
 
#12 0x0000562e0d70b404 in mysql_parse (thd=0x7fee34000b00, rawbuf=0x7fee34013108 "BEGIN NOT ATOMIC\nDECLARE a INT;\nSET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);\nEND", length=102, parser_state=0x7fee44ece180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8110
 
#13 0x0000562e0d6f6c83 in dispatch_command (command=COM_QUERY, thd=0x7fee34000b00, packet=0x7fee34008311 "BEGIN NOT ATOMIC\nDECLARE a INT;\nSET a=(SELECT 1 FROM DUAL UNION SELECT HIGH_PRIORITY 2 FROM DUAL);\nEND;\n", packet_length=104, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829
 
#14 0x0000562e0d6f5441 in do_command (thd=0x7fee34000b00) at /data/src/10.4/sql/sql_parse.cc:1362
 
#15 0x0000562e0d86d411 in do_handle_one_connection (connect=0x562e0fff7010) at /data/src/10.4/sql/sql_connect.cc:1403
 
#16 0x0000562e0d86d175 in handle_one_connection (arg=0x562e0fff7010) at /data/src/10.4/sql/sql_connect.cc:1306
 
#17 0x0000562e0e1956ab in pfs_spawn_thread (arg=0x562e1002c3a0) at /data/src/10.4/storage/perfschema/pfs.cc:1862
 
#18 0x00007fee4c8714a4 in start_thread (arg=0x7fee44ecf700) at pthread_create.c:456
 
#19 0x00007fee4adb9d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97


==31430==ERROR: AddressSanitizer: use-after-poison on address 0x6250000e7a58 at pc 0x55c409bba3fa bp 0x7f88f643fe00 sp 0x7f88f643fdf8
 
WRITE of size 8 at 0x6250000e7a58 thread T5
 
    #0 0x55c409bba3f9 in sp_head::~sp_head() /data/src/10.4/sql/sp_head.cc:820
 
    #1 0x55c409bba659 in sp_head::~sp_head() /data/src/10.4/sql/sp_head.cc:832
 
    #2 0x55c409d604e0 in LEX::cleanup_lex_after_parse_error(THD*) /data/src/10.4/sql/sql_lex.cc:3138
 
    #3 0x55c40a3afcf3 in MYSQLparse(THD*) /data/src/10.4/sql/sql_yacc.yy:16264
 
    #4 0x55c409df0d52 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.4/sql/sql_parse.cc:10184
 
    #5 0x55c409de440c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8110
 
    #6 0x55c409dbd56a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #7 0x55c409dba4d9 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1362
 
    #8 0x55c40a12df90 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1403
 
    #9 0x55c40a12d959 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1306
 
    #10 0x55c40b4ccf71 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #11 0x7f8900c4b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
    #12 0x7f88ff193d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
 
 
 
0x6250000e7a58 is located 6488 bytes inside of 8268-byte region [0x6250000e6100,0x6250000e814c)
 
allocated by thread T5 here:
 
    #0 0x7f8900f22d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
 
    #1 0x55c40b5f1eb8 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118
 
    #2 0x55c40b5c4159 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
 
    #3 0x55c40b5a46f8 in alloc_root /data/src/10.4/mysys/my_alloc.c:250
 
    #4 0x55c409b40c49 in Sql_alloc::operator new(unsigned long, st_mem_root*) /data/src/10.4/sql/sql_alloc.h:39
 
    #5 0x55c409bc2d15 in sp_head::reset_lex(THD*) /data/src/10.4/sql/sp_head.cc:2402
 
    #6 0x55c40a34b886 in sp_create_assignment_lex(THD*, bool) /data/src/10.4/sql/sql_yacc.yy:520
 
    #7 0x55c40a3afa39 in MYSQLparse(THD*) /data/src/10.4/sql/sql_yacc.yy:16220
 
    #8 0x55c409df0d52 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.4/sql/sql_parse.cc:10184
 
    #9 0x55c409de440c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8110
 
    #10 0x55c409dbd56a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
 
    #11 0x55c409dba4d9 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1362
 
    #12 0x55c40a12df90 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1403
 
    #13 0x55c40a12d959 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1306
 
    #14 0x55c40b4ccf71 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #15 0x7f8900c4b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f8900e91f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
 
    #1 0x55c40b4cd35e in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
 
    #2 0x55c409b21908 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x55c409b35a5d in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6238
 
    #4 0x55c409b36154 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6308
 
    #5 0x55c409b364df in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6406
 
    #6 0x55c409b37140 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6564
 
    #7 0x55c409b352a1 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5896
 
    #8 0x55c409b1f7ef in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f88ff0cb2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/sql/sp_head.cc:820 in sp_head::~sp_head()
 
Shadow bytes around the buggy address:
 
  0x0c4a80014ef0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
=>0x0c4a80014f40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7
 
  0x0c4a80014f50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c4a80014f90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==31430==ABORTING

Generated at Thu Feb 08 08:53:12 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.