[MDEV-22832] ASAN global-buffer-overflow in QUICK_GROUP_MIN_MAX_SELECT::add_range with use_stat_tables Created: 2020-06-08  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Igor Babaev
Resolution: Unresolved Votes: 0
Labels: None


 Description    

--source include/have_innodb.inc
 
 
 
SET use_stat_tables= PREFERABLY;
 
 
 
CREATE TABLE t1 (a INT) ENGINE=InnoDB;
 
INSERT INTO t1 VALUES (1),(2);
 
 
 
CREATE TABLE t2 (f1 VARCHAR(3), f2 VARCHAR(35), KEY(f1,f2)) ENGINE=InnoDB;
 
 
 
ANALYZE TABLE t1, t2;
 
 
 
SELECT * FROM t1 WHERE ('a','b') NOT IN (SELECT f1, MIN(f2) FROM t2 WHERE f2 <> '' GROUP BY f1);
 
 
 
# Cleanup
 
DROP TABLE t1, t2;

10.1 d218d1aa ASAN (-DCMAKE_BUILD_TYPE=Debug -DWITH_ASAN=YES -DMYSQL_MAINTAINER_MODE=OFF)

 
==12898==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5624a55c7054 at pc 0x7f6f896696ff bp 0x7f6f73e104c0 sp 0x7f6f73e0fc70
 
READ of size 38 at 0x5624a55c7054 thread T23
 
    #0 0x7f6f896696fe  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x8d6fe)
 
    #1 0x5624a3d15010 in QUICK_GROUP_MIN_MAX_SELECT::add_range(SEL_ARG*) /data/src/10.1/sql/opt_range.cc:13614
 
    #2 0x5624a3d1622d in TRP_GROUP_MIN_MAX::make_quick(PARAM*, bool, st_mem_root*) /data/src/10.1/sql/opt_range.cc:13362
 
    #3 0x5624a3d03fcc in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool) /data/src/10.1/sql/opt_range.cc:2688
 
    #4 0x5624a3562609 in get_quick_record_count /data/src/10.1/sql/sql_select.cc:3538
 
    #5 0x5624a35f7bf3 in make_join_statistics /data/src/10.1/sql/sql_select.cc:4158
 
    #6 0x5624a35f7bf3 in JOIN::optimize_inner() /data/src/10.1/sql/sql_select.cc:1405
 
    #7 0x5624a35ff34b in JOIN::optimize() /data/src/10.1/sql/sql_select.cc:1059
 
    #8 0x5624a34cb460 in st_select_lex::optimize_unflattened_subqueries(bool) /data/src/10.1/sql/sql_lex.cc:3805
 
    #9 0x5624a386e460 in JOIN::optimize_constant_subqueries() /data/src/10.1/sql/opt_subselect.cc:5368
 
    #10 0x5624a35f16c5 in JOIN::optimize_inner() /data/src/10.1/sql/sql_select.cc:1214
 
    #11 0x5624a35ff34b in JOIN::optimize() /data/src/10.1/sql/sql_select.cc:1059
 
    #12 0x5624a3601657 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3487
 
    #13 0x5624a3601f61 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:377
 
    #14 0x5624a34cf069 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5690
 
    #15 0x5624a34ea622 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3037
 
    #16 0x5624a3501052 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7208
 
    #17 0x5624a3507f02 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499
 
    #18 0x5624a350d3c9 in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131
 
    #19 0x5624a37b45e3 in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331
 
    #20 0x5624a37b4b9f in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
 
    #21 0x5624a40ef064 in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1868
 
    #22 0x7f6f893c64a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
    #23 0x7f6f87bd4d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
 
 
 
0x5624a55c7054 is located 0 bytes to the right of global variable 'is_null_string' defined in '/data/src/10.1/sql/opt_range.cc:140:14' (0x5624a55c7040) of size 20
 
SUMMARY: AddressSanitizer: global-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x8d6fe) 
Shadow bytes around the buggy address:
 
  0x0ac514ab0db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0ac514ab0e00: 00 00 00 00 00 00 00 00 00 00[04]f9 f9 f9 f9 f9
 
  0x0ac514ab0e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ac514ab0e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
Thread T23 created by T0 here:
 
    #0 0x7f6f8960cf59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
 
    #1 0x5624a40fa9e8 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1918
 
 
 
==12898==ABORTING

I don't see any obvious problem on a non-ASAN build (release, debug, valgrind).
Not reproducible with use_stat_tables=NEVER.

EXPLAIN on ASAN build also causes a failure, here is the plan from a non-ASAN build (I expect it to be the same as with ASAN):

EXPLAIN EXTENDED
 
SELECT * FROM t1 WHERE ('a','b') NOT IN (SELECT f1, MIN(f2) FROM t2 WHERE f2 <> '' GROUP BY f1);
 
id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
 
1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	2	100.00	
2	SUBQUERY	t2	range	NULL	f1	44	NULL	1	0.00	Using where; Using index for group-by
 
Warnings:
 
Note	1003	select `test`.`t1`.`a` AS `a` from `test`.`t1` where 1



 Comments   
Comment by Alice Sherepa [ 2022-08-04 ] 

--source include/have_innodb.inc 
 
 
SET use_stat_tables= PREFERABLY;
 
 
 
CREATE TABLE t1 (
 
  a int,
 
  b varchar(22) NOT NULL,
 
  vb varchar(22) GENERATED ALWAYS AS (b) ,
 
  KEY  (a,vb)
 
) ENGINE=InnoDB;
 
analyze table t1;
 
 
 
SELECT min(vb) FROM t1  WHERE vb IS NOT NULL GROUP BY a;
 
 
 
drop table t1;

10.3 43c7f6a0f3d2d636fea0d

 
Version: '10.3.36-MariaDB-debug-log'  socket: '/home/alice/am/_depot/m-branch/m3-10.3-bld/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
 
=================================================================
 
==774029==ERROR: AddressSanitizer: global-buffer-overflow on address 0x559c505a77f4 at pc 0x7fe4dac6b490 bp 0x7fe4c3bccfb0 sp 0x7fe4c3bcc758
 
READ of size 26 at 0x559c505a77f4 thread T27
 
    #0 0x7fe4dac6b48f in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790
 
    #1 0x559c4f3619b3 in memdup_root /10.3/src/mysys/my_alloc.c:495
 
    #2 0x559c4d666e2d in Query_arena::memdup(void const*, unsigned long) /10.3/src/sql/sql_class.h:1046
 
    #3 0x559c4e3ed214 in QUICK_RANGE::QUICK_RANGE(THD*, unsigned char const*, unsigned int, unsigned long, unsigned char const*, unsigned int, unsigned long, unsigned int) /10.3/src/sql/opt_range.h:700
 
    #4 0x559c4e3e05b3 in QUICK_GROUP_MIN_MAX_SELECT::add_range(SEL_ARG*) /10.3/src/sql/opt_range.cc:13936
 
    #5 0x559c4e3de430 in TRP_GROUP_MIN_MAX::make_quick(PARAM*, bool, st_mem_root*) /10.3/src/sql/opt_range.cc:13676
 
    #6 0x559c4e3955ac in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool) /10.3/src/sql/opt_range.cc:2701
 
    #7 0x559c4d940e95 in get_quick_record_count /10.3/src/sql/sql_select.cc:4411
 
    #8 0x559c4d9477a4 in make_join_statistics /10.3/src/sql/sql_select.cc:5111
 
    #9 0x559c4d927ad3 in JOIN::optimize_inner() /10.3/src/sql/sql_select.cc:1992
 
    #10 0x559c4d922fae in JOIN::optimize() /10.3/src/sql/sql_select.cc:1534
 
    #11 0x559c4d940688 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.3/src/sql/sql_select.cc:4360
 
    #12 0x559c4d9169cc in handle_select(THD*, LEX*, select_result*, unsigned long) /10.3/src/sql/sql_select.cc:372
 
    #13 0x559c4d8876dc in execute_sqlcom_select /10.3/src/sql/sql_parse.cc:6340
 
    #14 0x559c4d875717 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:3871
 
    #15 0x559c4d891439 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7871
 
    #16 0x559c4d868316 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852
 
    #17 0x559c4d864e59 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398
 
    #18 0x559c4dc389d8 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403
 
    #19 0x559c4dc38292 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
 
    #20 0x559c4f269254 in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
 
    #21 0x7fe4da38b608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #22 0x7fe4da2b0132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x559c505a77f4 is located 0 bytes to the right of global variable 'is_null_string' defined in '/10.3/src/sql/opt_range.cc:139:14' (0x559c505a77e0) of size 20
 
SUMMARY: AddressSanitizer: global-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790 in __interceptor_memcpy
 
Shadow bytes around the buggy address:
 
  0x0ab40a0acea0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 
  0x0ab40a0aceb0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 
  0x0ab40a0acec0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 
  0x0ab40a0aced0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 
  0x0ab40a0acee0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 
=>0x0ab40a0acef0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00[04]f9
 
  0x0ab40a0acf00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ab40a0acf10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ab40a0acf20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0ab40a0acf30: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
 
  0x0ab40a0acf40: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
Thread T27 created by T0 here:
 
    #0 0x7fe4dac0a815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x559c4f269645 in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919
 
    #2 0x559c4d58a39e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x559c4d5a3158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668
 
    #4 0x559c4d5a38f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738
 
    #5 0x559c4d5a4a85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996
 
    #6 0x559c4d5a2449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290
 
    #7 0x559c4d588b9c in main /10.3/src/sql/main.cc:25
 
    #8 0x7fe4da1b5082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
==774029==ABORTING
 
----------SERVER LOG END-------------

Generated at Thu Feb 08 09:17:48 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.