[MDEV-24665] ASAN errors, assertion failures, corrupt values after failed LOAD DATA into table with virtual/stored column Created: 2021-01-24  Updated: 2021-04-26  Resolved: 2021-04-26

Status: Closed
Project: MariaDB Server
Component/s: Virtual Columns
Affects Version/s: 10.2, 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.2.38, 10.3.29, 10.4.19, 10.5.10

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Nikita Malyavin
Resolution: Duplicate Votes: 0
Labels: None

Issue Links:
Duplicate
duplicates MDEV-24583 ASAN use-after-poison in create_tmp_t... Closed
Relates
relates to MDEV-24782 ASAN use-after-poison in Field::pack_... Closed
relates to MDEV-24656 [FATAL] InnoDB: Data field type 0, le... Closed

 Description   

There are a lot of similarity in the test case with MDEV-24656. However, the big difference there, apart from the completely differently-looking failure, is that this variant affects not only virtual (generated) columns, but also persistent (stored) columns, which are considered much more stable – so much so new functionality is planned to be based upon them.

CREATE TABLE t1 (id INT PRIMARY KEY, ts TIMESTAMP DEFAULT '1971-01-01 00:00:00', c VARBINARY(8) DEFAULT '', vc VARCHAR(3) AS (c) STORED);
 
INSERT IGNORE INTO t1 (id,c) VALUES (1,'foobar');
 
SELECT id, ts, vc INTO OUTFILE 'load_t1' FROM t1;
 
--error 0,ER_DATA_TOO_LONG
 
LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id, ts, vc);
 
INSERT IGNORE INTO t1 (id) VALUES (2);
 
 
 
# Cleanup
 
DROP TABLE t1;
 
--let $datadir= `select @@datadir`
 
--remove_file $datadir/test/load_t1

10.2 59e6d14c

 
==2965509==ERROR: AddressSanitizer: use-after-poison on address 0x619000087c47 at pc 0x55be8e22e411 bp 0x7fb01c9ccae0 sp 0x7fb01c9ccad0
 
READ of size 1 at 0x619000087c47 thread T5
 
    #0 0x55be8e22e410 in my_timestamp_from_binary(timeval*, unsigned char const*, unsigned int) /data/src/10.2/sql/compat56.cc:392
 
    #1 0x55be8e265f44 in Field_timestampf::get_timestamp(unsigned char const*, unsigned long*) const /data/src/10.2/sql/field.cc:5683
 
    #2 0x55be8e2621d1 in Field_timestamp::validate_value_in_record(THD*, unsigned char const*) const /data/src/10.2/sql/field.cc:5392
 
    #3 0x55be8e29b108 in Field::validate_value_in_record_with_warn(THD*, unsigned char const*) /data/src/10.2/sql/field.cc:11171
 
    #4 0x55be8df6e8ad in TABLE::validate_default_values_of_unset_fields(THD*) const /data/src/10.2/sql/table.cc:7984
 
    #5 0x55be8dc263e0 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:940
 
    #6 0x55be8dc8db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194
 
    #7 0x55be8dca67eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
 
    #8 0x55be8dc7f830 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #9 0x55be8dc7c5ef in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #10 0x55be8e004b1e in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #11 0x55be8e0043e1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #12 0x55be8f3a05d9 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #13 0x7fb02771e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
 
    #14 0x7fb0272f8292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x619000087c47 is located 455 bytes inside of 1100-byte region [0x619000087a80,0x619000087ecc)
 
allocated by thread T5 here:
 
    #0 0x7fb027c85bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x55be8f4bd12c in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
 
    #2 0x55be8f489091 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
 
    #3 0x55be8f466703 in alloc_root /data/src/10.2/mysys/my_alloc.c:243
 
    #4 0x55be8f468139 in memdup_root /data/src/10.2/mysys/my_alloc.c:464
 
    #5 0x55be8df3b777 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.2/sql/table.cc:1288
 
    #6 0x55be8df37143 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.2/sql/table.cc:684
 
    #7 0x55be8e189065 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.2/sql/table_cache.cc:826
 
    #8 0x55be8db607f0 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.2/sql/sql_base.cc:1797
 
    #9 0x55be8db69344 in open_and_process_table /data/src/10.2/sql/sql_base.cc:3614
 
    #10 0x55be8db6b71e in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4081
 
    #11 0x55be8db6f2a4 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4880
 
    #12 0x55be8dae646d in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.2/sql/sql_base.h:507
 
    #13 0x55be8dc2515d in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:758
 
    #14 0x55be8dc8db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194
 
    #15 0x55be8dca67eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
 
    #16 0x55be8dc7f830 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #17 0x55be8dc7c5ef in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #18 0x55be8e004b1e in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #19 0x55be8e0043e1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #20 0x55be8f3a05d9 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #21 0x7fb02771e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7fb027bb2805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x55be8f3a09ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x55be8da21083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x55be8da38c2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6567
 
    #4 0x55be8da393c6 in create_new_thread /data/src/10.2/sql/mysqld.cc:6637
 
    #5 0x55be8da3a558 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6895
 
    #6 0x55be8da37f7c in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6186
 
    #7 0x55be8da1f93c in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7fb0271fd0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.2/sql/compat56.cc:392 in my_timestamp_from_binary(timeval*, unsigned char const*, unsigned int)
 
Shadow bytes around the buggy address:
 
  0x0c3280008f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
 
  0x0c3280008f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280008f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280008f60: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00
 
  0x0c3280008f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0c3280008f80: 00 02 f7 00 f7 00 00 06[f7]01 f7 00 00 00 00 00
 
  0x0c3280008f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280008fa0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280008fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
 
  0x0c3280008fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280008fd0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==2965509==ABORTING

Reproducible on 10.2+, both with stored and virtual columns, with at least MyISAM and InnoDB.
Non-debug ASAN builds of all (10.2-10.6) versions return the failure above, as well as debug ASAN builds of 10.2-10.4.
Debug builds of 10.5-10.6 produce an assertion failure before they have a chance to fail with the ASAN error:

10.5 bf1f9b59

 
mariadbd: /data/src/10.5/sql/field.h:1155: const uchar* Field::ptr_in_record(const uchar*) const: Assertion `l_offset >= 0 && table->s->rec_buff_length - l_offset > 0' failed.
 
210124  2:19:33 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007fbc3ae04f36 in __GI___assert_fail (assertion=0x563a23cde1c8 "l_offset >= 0 && table->s->rec_buff_length - l_offset > 0", file=0x563a23cde0b6 "/data/src/10.5/sql/field.h", line=1155, function=0x563a23cde208 "const uchar* Field::ptr_in_record(const uchar*) const") at assert.c:101
 
#8  0x0000563a2303605b in Field::ptr_in_record (this=0x7fbc242201d0, record=0x7fbc240f9e90 "\376") at /data/src/10.5/sql/field.h:1155
 
#9  0x0000563a232144cc in Field_timestamp::validate_value_in_record (this=0x7fbc242201d0, thd=0x7fbc24000db8, record=0x7fbc240f9e90 "\376") at /data/src/10.5/sql/field.cc:5433
 
#10 0x0000563a2322a36a in Field::validate_value_in_record_with_warn (this=0x7fbc242201d0, thd=0x7fbc24000db8, record=0x7fbc240f9e90 "\376") at /data/src/10.5/sql/field.cc:11164
 
#11 0x0000563a230319d4 in TABLE::validate_default_values_of_unset_fields (this=0x7fbc2421fbe8, thd=0x7fbc24000db8) at /data/src/10.5/sql/table.cc:8989
 
#12 0x0000563a22e897bd in mysql_insert (thd=0x7fbc24000db8, table_list=0x7fbc24014020, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=true, result=0x0) at /data/src/10.5/sql/sql_insert.cc:957
 
#13 0x0000563a22edd596 in mysql_execute_command (thd=0x7fbc24000db8) at /data/src/10.5/sql/sql_parse.cc:4596
 
#14 0x0000563a22ee92b0 in mysql_parse (thd=0x7fbc24000db8, rawbuf=0x7fbc24013f30 "INSERT IGNORE INTO t1 (id) VALUES (2)", length=37, parser_state=0x7fbc357bf510, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:8062
 
#15 0x0000563a22ed5237 in dispatch_command (command=COM_QUERY, thd=0x7fbc24000db8, packet=0x7fbc240090a9 "INSERT IGNORE INTO t1 (id) VALUES (2)", packet_length=37, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:1889
 
#16 0x0000563a22ed3a2b in do_command (thd=0x7fbc24000db8) at /data/src/10.5/sql/sql_parse.cc:1370
 
#17 0x0000563a2308172b in do_handle_one_connection (connect=0x563a26852848, put_in_cache=true) at /data/src/10.5/sql/sql_connect.cc:1410
 
#18 0x0000563a2308148e in handle_one_connection (arg=0x563a268bf208) at /data/src/10.5/sql/sql_connect.cc:1312
 
#19 0x0000563a235e0449 in pfs_spawn_thread (arg=0x563a26852488) at /data/src/10.5/storage/perfschema/pfs.cc:2201
 
#20 0x00007fbc3b31c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#21 0x00007fbc3aef0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Here is another ASAN failure which I get in very similar circumstances. I won't clean up a test case for it, but I want the failure to be searchable and associatable with this class of problem, so I'll add it here.

10.3 4e503aec

 
==2966966==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e00001a3e5 at pc 0x56285e991fae bp 0x7f1cc9766f60 sp 0x7f1cc9766f50
 
READ of size 1 at 0x61e00001a3e5 thread T5
 
    #0 0x56285e991fad in Field_newdate::get_TIME(st_mysql_time*, unsigned char const*, unsigned long long) const /data/src/10.3/sql/field.cc:6590
 
    #1 0x56285e984a28 in Field_temporal_with_date::validate_value_in_record(THD*, unsigned char const*) const /data/src/10.3/sql/field.cc:5743
 
    #2 0x56285e9c7f28 in Field::validate_value_in_record_with_warn(THD*, unsigned char const*) /data/src/10.3/sql/field.cc:11501
 
    #3 0x56285e5a143b in TABLE::validate_default_values_of_unset_fields(THD*) const /data/src/10.3/sql/table.cc:8231
 
    #4 0x56285e1e8f1c in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:940
 
    #5 0x56285e290473 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
 
    #6 0x56285e2a8a81 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
 
    #7 0x56285e27f8c5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #8 0x56285e27c3fc in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #9 0x56285e646e4d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #10 0x56285e646707 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #11 0x56285fc602fa in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #12 0x7f1cd461e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
 
    #13 0x7f1cd41f8292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x61e00001a3e5 is located 1 bytes to the right of 2916-byte region [0x61e000019880,0x61e00001a3e4)
 
allocated by thread T5 here:
 
    #0 0x7f1cd4b85bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x56285fdaaa9b in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x56285fd78903 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x56285fd54970 in alloc_root /data/src/10.3/mysys/my_alloc.c:251
 
    #4 0x56285e56b2aa in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.3/sql/table.cc:1657
 
    #5 0x56285e563f2d in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.3/sql/table.cc:687
 
    #6 0x56285e82e70e in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840
 
    #7 0x56285e11357d in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847
 
    #8 0x56285e11d764 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730
 
    #9 0x56285e11fd87 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199
 
    #10 0x56285e124e7f in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128
 
    #11 0x56285e0892a7 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503
 
    #12 0x56285e1e7b1b in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760
 
    #13 0x56285e290473 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
 
    #14 0x56285e2a8a81 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
 
    #15 0x56285e27f8c5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #16 0x56285e27c3fc in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #17 0x56285e646e4d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #18 0x56285e646707 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #19 0x56285fc602fa in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #20 0x7f1cd461e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f1cd4ab2805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x56285fc606eb in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
 
    #2 0x56285dfa715e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x56285dfbfb2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658
 
    #4 0x56285dfc02c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728
 
    #5 0x56285dfc145a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986
 
    #6 0x56285dfbee1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280
 
    #7 0x56285dfa595c in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7f1cd40fd0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: heap-buffer-overflow /data/src/10.3/sql/field.cc:6590 in Field_newdate::get_TIME(st_mysql_time*, unsigned char const*, unsigned long long) const
 
Shadow bytes around the buggy address:
 
  0x0c3c7fffb420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0c3c7fffb470: 00 00 00 00 00 00 00 00 00 00 00 01[04]fa fa fa
 
  0x0c3c7fffb480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3c7fffb490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3c7fffb4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==2966966==ABORTING



 Comments   
Comment by Elena Stepanova [ 2021-02-02 ]

Likely the same issue:

10.3 59eda73e

 
==20251==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000279b85 at pc 0x00000104598f bp 0x7fa659007ce0 sp 0x7fa659007cd0
 
READ of size 4 at 0x621000279b85 thread T32
 
    #0 0x104598e in mi_uint5korr /home/vsts/src/include/byte_order_generic_x86_64.h:92
 
    #1 0x1047cfe in my_datetime_packed_from_binary(unsigned char const*, unsigned int) /home/vsts/src/sql/compat56.cc:310
 
    #2 0x10a7f82 in Field_datetimef::get_TIME(st_mysql_time*, unsigned char const*, unsigned long long) const /home/vsts/src/sql/field.cc:6929
 
    #3 0x10958a0 in Field_temporal_with_date::validate_value_in_record(THD*, unsigned char const*) const /home/vsts/src/sql/field.cc:5743
 
    #4 0x10db738 in Field::validate_value_in_record_with_warn(THD*, unsigned char const*) /home/vsts/src/sql/field.cc:11500
 
    #5 0xca5781 in TABLE::validate_default_values_of_unset_fields(THD*) const /home/vsts/src/sql/table.cc:8231
 
    #6 0x8c80bb in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /home/vsts/src/sql/sql_insert.cc:940
 
    #7 0x974737 in mysql_execute_command(THD*) /home/vsts/src/sql/sql_parse.cc:4481
 
    #8 0x98d290 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/vsts/src/sql/sql_parse.cc:7840
 
    #9 0x9637e1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/vsts/src/sql/sql_parse.cc:1852
 
    #10 0x95ff42 in do_command(THD*) /home/vsts/src/sql/sql_parse.cc:1398
 
    #11 0xd53df4 in do_handle_one_connection(CONNECT*) /home/vsts/src/sql/sql_connect.cc:1403
 
    #12 0xd536a8 in handle_one_connection /home/vsts/src/sql/sql_connect.cc:1308
 
    #13 0x7fa687a5f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #14 0x7fa686e914dc in clone (/lib/x86_64-linux-gnu/libc.so.6+0x1074dc)
 
0x621000279b85 is located 17 bytes to the right of 4724-byte region [0x621000278900,0x621000279b74)
 
    #0 0x7fa689551b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
 
    #1 0x25d9338 in sf_malloc /home/vsts/src/mysys/safemalloc.c:118
 
    #2 0x25a7c52 in my_malloc /home/vsts/src/mysys/my_malloc.c:101
 
    #3 0x258412c in alloc_root /home/vsts/src/mysys/my_alloc.c:251
 
    #4 0xc6ce39 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /home/vsts/src/sql/table.cc:1657
 
    #5 0xc6492d in open_table_def(THD*, TABLE_SHARE*, unsigned int) /home/vsts/src/sql/table.cc:687
 
    #6 0xf3f3e6 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /home/vsts/src/sql/table_cache.cc:840
 
    #7 0x7ecd75 in open_table(THD*, TABLE_LIST*, Open_table_context*) /home/vsts/src/sql/sql_base.cc:1847
 
    #8 0xbd6b01 in mysql_inplace_alter_table /home/vsts/src/sql/sql_table.cc:7773
 
    #9 0xbe70cd in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /home/vsts/src/sql/sql_table.cc:9980
 
    #10 0xd64ff1 in Sql_cmd_alter_table::execute(THD*) /home/vsts/src/sql/sql_alter.cc:512
 
    #11 0x980887 in mysql_execute_command(THD*) /home/vsts/src/sql/sql_parse.cc:6052
 
    #12 0x98d290 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/vsts/src/sql/sql_parse.cc:7840
 
    #13 0x9637e1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/vsts/src/sql/sql_parse.cc:1852
 
    #14 0x95ff42 in do_command(THD*) /home/vsts/src/sql/sql_parse.cc:1398
 
    #15 0xd53df4 in do_handle_one_connection(CONNECT*) /home/vsts/src/sql/sql_connect.cc:1403
 
    #16 0xd536a8 in handle_one_connection /home/vsts/src/sql/sql_connect.cc:1308
 
    #17 0x7fa687a5f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #0 0x7fa6894aad6f in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d6f)
 
    #1 0x2609526 in spawn_thread_noop /home/vsts/src/mysys/psi_noop.c:187
 
    #2 0x6745ec in inline_mysql_thread_create /home/vsts/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x68d7c6 in create_thread_to_handle_connection(CONNECT*) /home/vsts/src/sql/mysqld.cc:6660
 
    #4 0x68df97 in create_new_thread /home/vsts/src/sql/mysqld.cc:6728
 
    #5 0x68f149 in handle_connections_sockets() /home/vsts/src/sql/mysqld.cc:6986
 
    #6 0x68cafe in mysqld_main(int, char**) /home/vsts/src/sql/mysqld.cc:6280
 
    #7 0x672cc6 in main /home/vsts/src/sql/main.cc:25
 
    #8 0x7fa686daa83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
 
    #0 0x7fa6894aad6f in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d6f)
 
    #1 0x2609526 in spawn_thread_noop /home/vsts/src/mysys/psi_noop.c:187
 
    #2 0x6745ec in inline_mysql_thread_create /home/vsts/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x68d7c6 in create_thread_to_handle_connection(CONNECT*) /home/vsts/src/sql/mysqld.cc:6660
 
    #4 0x68df97 in create_new_thread /home/vsts/src/sql/mysqld.cc:6728
 
    #5 0x68f149 in handle_connections_sockets() /home/vsts/src/sql/mysqld.cc:6986
 
    #6 0x68cafe in mysqld_main(int, char**) /home/vsts/src/sql/mysqld.cc:6280
 
    #7 0x672cc6 in main /home/vsts/src/sql/main.cc:25
 
    #8 0x7fa686daa83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
 
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/vsts/src/include/byte_order_generic_x86_64.h:92 in mi_uint5korr
 
  0x0c4280047320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c4280047330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c4280047340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c4280047350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c4280047360: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 04 fa
 
=>0x0c4280047370:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c4280047380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c4280047390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c42800473a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c42800473b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c42800473c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  Container overflow:      fc
 
210202  0:20:01 [ERROR] mysqld got signal 6 ;
 
or misconfigured. This error can also be caused by malfunctioning hardware.
 
Thread pointer: 0x62a0000ae270
 
stack_bottom = 0x7fa65900ba40 thread_stack 0x5fc00
 
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0x55900)[0x7fa6894c8900]
 
maria/ma_blockrec.c:2240(store_page_range)[0x25b7760]
 
sql/rpl_utility.cc:336(table_def::calc_field_size(unsigned int, unsigned char*) const)[0x110d4f4]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7fa687a69390]
 
linux/raise.c:54(__GI_raise)[0x7fa686dbf438]
 
stdlib/abort.c:91(__GI_abort)[0x7fa686dc103a]
 
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0x10076e)[0x7fa68957376e]
 
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0x108558)[0x7fa68957b558]
 
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0xe9555)[0x7fa68955c555]
 
/usr/lib/x86_64-linux-gnu/libasan.so.4(__asan_report_load4+0x37)[0x7fa68955d227]
 
sql/sql_update.cc:2466(multi_update::send_data(List<Item>&))[0x104598f]
 
sql/sql_update.cc:2637(multi_update::do_updates())[0x1047cff]
 
sql/table.cc:8628(TABLE_LIST::change_refs_to_fields())[0x10a7f83]
 
sql/table.cc:6148(Field_iterator_table_ref::set_field_iterator())[0x10958a1]
 
sql/uniques.cc:697(Unique::merge(TABLE*, unsigned char*, bool))[0x10db739]
 
sql/sql_array.h:136(Dynamic_array<st_mysql_const_lex_string*>::at(unsigned long))[0xca5782]
 
/home/vsts/server/bin/mysqld(_Z12mysql_insertP3THDP10TABLE_LISTR4ListI4ItemERS3_IS5_ES6_S6_15enum_duplicatesb+0x1fab)[0x8c80bc]
 
/home/vsts/server/bin/mysqld(_Z21mysql_execute_commandP3THD+0x82a0)[0x974738]
 
/home/vsts/server/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x701)[0x98d291]
 
/home/vsts/server/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0x221b)[0x9637e2]
 
/home/vsts/server/bin/mysqld(_Z10do_commandP3THD+0x1515)[0x95ff43]
 
sql/sql_load.cc:2045(READ_INFO::read_xml(THD*))[0xd53df5]
 
sql/sql_load.cc:2005(READ_INFO::read_xml(THD*))[0xd536a9]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7fa687a5f6ba]
 
x86_64/clone.S:111(clone)[0x7fa686e914dd]
 
Query (0x62b00000e290): INSERT /* QNO 15365 CON_ID 15 */ IGNORE INTO `t7_InnoDB` ( `id`, `vcol_varchar` ) VALUES ( NULL, 'o' )
 
Status: NOT_KILLED

Comment by Elena Stepanova [ 2021-02-18 ]

More failures of the same variety, or at least I am going to consider them such until this issue is fixed.

These happen with a different test case, but also after a failed LOAD similar to the one in the test from the description, also ER_DATA_TOO_LONG and the target table has virtual columns; only this time the next command is ALTER.

10.3 da88e1ec ASAN

 
==219062==ERROR: AddressSanitizer: use-after-poison on address 0x61900008a562 at pc 0x55f0cf56800f bp 0x7f568de31620 sp 0x7f568de31610
 
READ of size 4 at 0x61900008a562 thread T5
 
    #0 0x55f0cf56800e in Field_long::val_str(String*, String*) /data/src/10.3/sql/field.cc:4306
 
    #1 0x55f0cebf452f in Field::val_str(String*) /data/src/10.3/sql/field.h:854
 
    #2 0x55f0cf5c5861 in Field::val_str(String*, unsigned char const*) /data/src/10.3/sql/field.h:1353
 
    #3 0x55f0cf5bed04 in Column_definition::Column_definition(THD*, Field*, Field*) /data/src/10.3/sql/field.cc:11184
 
    #4 0x55f0cee0682d in Create_field::Create_field(THD*, Field*, Field*) /data/src/10.3/sql/field.h:4776
 
    #5 0x55f0cf0d78c0 in mysql_prepare_alter_table(THD*, TABLE*, HA_CREATE_INFO*, Alter_info*, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:8168
 
    #6 0x55f0cf0e2831 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9662
 
    #7 0x55f0cf25062c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512
 
    #8 0x55f0cee95361 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6052
 
    #9 0x55f0ceea1991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
 
    #10 0x55f0cee787d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #11 0x55f0cee7530c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #12 0x55f0cf23fa9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #13 0x55f0cf23f359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #14 0x55f0d0858a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #15 0x7f5698ce6608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
    #16 0x7f56988c0292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x61900008a562 is located 738 bytes inside of 1100-byte region [0x61900008a280,0x61900008a6cc)
 
allocated by thread T5 here:
 
    #0 0x7f569924dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x55f0d09a3077 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x55f0d0970edf in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x55f0d094cf4c in alloc_root /data/src/10.3/mysys/my_alloc.c:251
 
    #4 0x55f0d094e7ab in memdup_root /data/src/10.3/mysys/my_alloc.c:494
 
    #5 0x55f0cf161499 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.3/sql/table.cc:1304
 
    #6 0x55f0cf15cbf7 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.3/sql/table.cc:687
 
    #7 0x55f0cf427256 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840
 
    #8 0x55f0ced0c505 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847
 
    #9 0x55f0ced166ec in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730
 
    #10 0x55f0ced18d0f in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199
 
    #11 0x55f0ced1de07 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128
 
    #12 0x55f0cec8222f in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503
 
    #13 0x55f0cede0a2b in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760
 
    #14 0x55f0cee89383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
 
    #15 0x55f0ceea1991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
 
    #16 0x55f0cee787d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #17 0x55f0cee7530c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #18 0x55f0cf23fa9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #19 0x55f0cf23f359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #20 0x55f0d0858a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #21 0x7f5698ce6608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f569917a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x55f0d0858e35 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
 
    #2 0x55f0ceba015e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55f0cebb8b2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658
 
    #4 0x55f0cebb92c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728
 
    #5 0x55f0cebba45a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986
 
    #6 0x55f0cebb7e1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280
 
    #7 0x55f0ceb9e95c in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7f56987c50b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/field.cc:4306 in Field_long::val_str(String*, String*)
 
Shadow bytes around the buggy address:
 
  0x0c3280009450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280009460: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00
 
  0x0c3280009470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280009480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280009490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0c32800094a0: 02 f7 00 00 00 f7 00 00 00 00 00 f7[f7]01 f7 00
 
  0x0c32800094b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c32800094c0: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00
 
  0x0c32800094d0: 00 f7 00 00 00 00 00 00 f7 04 fa fa fa fa fa fa
 
  0x0c32800094e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c32800094f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==219062==ABORTING

10.3 da88e1ec debug

 
mysqld: /data/src/10.3/sql/compat56.cc:258: void TIME_from_longlong_datetime_packed(MYSQL_TIME*, longlong): Assertion `tmp != ((long long) 0x8000000000000000LL)' failed.
 
210218 15:27:49 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007fcd9b0c3f36 in __GI___assert_fail (assertion=0x564e8594fbb0 "tmp != ((long long) 0x8", '0' <repeats 15 times>, "LL)", file=0x564e8594f930 "/data/src/10.3/sql/compat56.cc", line=258, function=0x564e8594fb70 "void TIME_from_longlong_datetime_packed(MYSQL_TIME*, longlong)") at assert.c:101
 
#8  0x0000564e84e76a9f in TIME_from_longlong_datetime_packed (ltime=0x7fcd950e55c0, tmp=-9223372036854775808) at /data/src/10.3/sql/compat56.cc:258
 
#9  0x0000564e84e982a8 in Field_datetimef::get_TIME (this=0x7fcd840aadc8, ltime=0x7fcd950e55c0, pos=0x7fcd84006fd9 "", fuzzydate=0) at /data/src/10.3/sql/field.cc:6930
 
#10 0x0000564e84eb0364 in Field_datetimef::get_date (this=0x7fcd840aadc8, ltime=0x7fcd950e55c0, fuzzydate=0) at /data/src/10.3/sql/field.h:3270
 
#11 0x0000564e84e97cae in Field_datetime_with_dec::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0, unused=0x7fcd950e56b0) at /data/src/10.3/sql/field.cc:6875
 
#12 0x0000564e84a7fa45 in Field::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0) at /data/src/10.3/sql/field.h:854
 
#13 0x0000564e84eac9f5 in Field::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0, new_ptr=0x7fcd84006fd9 "") at /data/src/10.3/sql/field.h:1353
 
#14 0x0000564e84ea9df0 in Column_definition::Column_definition (this=0x7fcd84014280, thd=0x7fcd84000d90, old_field=0x7fcd840aadc8, orig_field=0x7fcd840aadc8) at /data/src/10.3/sql/field.cc:11184
 
#15 0x0000564e84b616b6 in Create_field::Create_field (this=0x7fcd84014280, thd=0x7fcd84000d90, old_field=0x7fcd840aadc8, orig_field=0x7fcd840aadc8) at /data/src/10.3/sql/field.h:4776
 
#16 0x0000564e84c7f6d4 in mysql_prepare_alter_table (thd=0x7fcd84000d90, table=0x7fcd840373c0, create_info=0x7fcd950e74d0, alter_info=0x7fcd950e7410, alter_ctx=0x7fcd950e68e0) at /data/src/10.3/sql/sql_table.cc:8168
 
#17 0x0000564e84c83f1f in mysql_alter_table (thd=0x7fcd84000d90, new_db=0x7fcd84005478, new_name=0x7fcd84005840, create_info=0x7fcd950e74d0, table_list=0x7fcd84012bf8, alter_info=0x7fcd950e7410, order_num=0, order=0x0, ignore=false) at /data/src/10.3/sql/sql_table.cc:9662
 
#18 0x0000564e84d153fe in Sql_cmd_alter_table::execute (this=0x7fcd84013280, thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_alter.cc:512
 
#19 0x0000564e84ba0321 in mysql_execute_command (thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_parse.cc:6052
 
#20 0x0000564e84ba5b88 in mysql_parse (thd=0x7fcd84000d90, rawbuf=0x7fcd84012ab8 "ALTER TABLE /* 100502 IF EXISTS */ CC /*!100301 */ DROP PRIMARY KEY, LOCK=NONE", length=78, parser_state=0x7fcd950e85c0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7840
 
#21 0x0000564e84b922ec in dispatch_command (command=COM_QUERY, thd=0x7fcd84000d90, packet=0x7fcd84008f11 "ALTER TABLE /*!100502 IF EXISTS */ CC /*!100301 */ DROP PRIMARY KEY, LOCK=NONE", packet_length=78, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1852
 
#22 0x0000564e84b90c8c in do_command (thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_parse.cc:1398
 
#23 0x0000564e84d0f295 in do_handle_one_connection (connect=0x564e87f92070) at /data/src/10.3/sql/sql_connect.cc:1403
 
#24 0x0000564e84d0eff1 in handle_one_connection (arg=0x564e87f92070) at /data/src/10.3/sql/sql_connect.cc:1308
 
#25 0x0000564e856db061 in pfs_spawn_thread (arg=0x564e87f75440) at /data/src/10.3/storage/perfschema/pfs.cc:1869
 
#26 0x00007fcd9b5d3609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#27 0x00007fcd9b1af293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

And these are variations with the exact test case from the description, only INSERT is replaced with ALTER:

CREATE TABLE t1 (id INT PRIMARY KEY, ts TIMESTAMP DEFAULT '1971-01-01 00:00:00', c VARBINARY(8) DEFAULT '', vc VARCHAR(3) AS (c) STORED);
 
INSERT IGNORE INTO t1 (id,c) VALUES (1,'foobar');
 
SELECT id, ts, vc INTO OUTFILE 'load_t1' FROM t1;
 
--error 0,ER_DATA_TOO_LONG
 
LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id, ts, vc);
 
ALTER TABLE t1 DROP PRIMARY KEY;
 
 
# Cleanup
 
DROP TABLE t1;
 
--let $datadir= `select @@datadir`
 
--remove_file $datadir/test/load_t1

10.3 da88e1ec debug

 
mysqltest: At line 6: query 'ALTER TABLE t1 DROP PRIMARY KEY' failed: 1292: Incorrect datetime value: '2046-04-28 20:42:24' for column ``.``.`ts` at row 1

10.3 da88e1ec ASAN

 
==221218==ERROR: AddressSanitizer: use-after-poison on address 0x61900008a447 at pc 0x564afac31fe5 bp 0x7ff1d92b4380 sp 0x7ff1d92b4370
 
READ of size 1 at 0x61900008a447 thread T5
 
    #0 0x564afac31fe4 in my_timestamp_from_binary(timeval*, unsigned char const*, unsigned int) /data/src/10.3/sql/compat56.cc:394
 
    #1 0x564afac79a0e in Field_timestampf::get_timestamp(unsigned char const*, unsigned long*) const /data/src/10.3/sql/field.cc:5582
 
    #2 0x564afacc9188 in Field_timestamp::get_timestamp(unsigned long*) const /data/src/10.3/sql/field.h:2703
 
    #3 0x564afac757b3 in Field_timestamp::get_date(st_mysql_time*, unsigned long long) /data/src/10.3/sql/field.cc:5315
 
    #4 0x564afac74778 in Field_timestamp::val_str(String*, String*) /data/src/10.3/sql/field.cc:5240
 
    #5 0x564afa2f252f in Field::val_str(String*) /data/src/10.3/sql/field.h:854
 
    #6 0x564afacc3861 in Field::val_str(String*, unsigned char const*) /data/src/10.3/sql/field.h:1353
 
    #7 0x564afacbcd04 in Column_definition::Column_definition(THD*, Field*, Field*) /data/src/10.3/sql/field.cc:11184
 
    #8 0x564afa50482d in Create_field::Create_field(THD*, Field*, Field*) /data/src/10.3/sql/field.h:4776
 
    #9 0x564afa7d58c0 in mysql_prepare_alter_table(THD*, TABLE*, HA_CREATE_INFO*, Alter_info*, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:8168
 
    #10 0x564afa7e0831 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9662
 
    #11 0x564afa94e62c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512
 
    #12 0x564afa593361 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6052
 
    #13 0x564afa59f991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
 
    #14 0x564afa5767d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #15 0x564afa57330c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #16 0x564afa93da9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #17 0x564afa93d359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #18 0x564afbf56a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #19 0x7ff1e416b608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
    #20 0x7ff1e3d45292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x61900008a447 is located 455 bytes inside of 1100-byte region [0x61900008a280,0x61900008a6cc)
 
allocated by thread T5 here:
 
    #0 0x7ff1e46d2bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x564afc0a1077 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x564afc06eedf in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x564afc04af4c in alloc_root /data/src/10.3/mysys/my_alloc.c:251
 
    #4 0x564afc04c7ab in memdup_root /data/src/10.3/mysys/my_alloc.c:494
 
    #5 0x564afa85f499 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.3/sql/table.cc:1304
 
    #6 0x564afa85abf7 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.3/sql/table.cc:687
 
    #7 0x564afab25256 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840
 
    #8 0x564afa40a505 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847
 
    #9 0x564afa4146ec in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730
 
    #10 0x564afa416d0f in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199
 
    #11 0x564afa41be07 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128
 
    #12 0x564afa38022f in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503
 
    #13 0x564afa4dea2b in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760
 
    #14 0x564afa587383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
 
    #15 0x564afa59f991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
 
    #16 0x564afa5767d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #17 0x564afa57330c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #18 0x564afa93da9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #19 0x564afa93d359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #20 0x564afbf56a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #21 0x7ff1e416b608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7ff1e45ff805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x564afbf56e35 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
 
    #2 0x564afa29e15e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x564afa2b6b2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658
 
    #4 0x564afa2b72c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728
 
    #5 0x564afa2b845a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986
 
    #6 0x564afa2b5e1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280
 
    #7 0x564afa29c95c in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7ff1e3c4a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/compat56.cc:394 in my_timestamp_from_binary(timeval*, unsigned char const*, unsigned int)
 
Shadow bytes around the buggy address:
 
  0x0c3280009430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280009440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280009450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280009460: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00
 
  0x0c3280009470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0c3280009480: 00 02 f7 00 f7 00 00 06[f7]01 f7 00 00 00 00 00
 
  0x0c3280009490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c32800094a0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
 
  0x0c32800094b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c32800094c0: 00 f7 00 00 f7 00 00 00 00 00 00 f7 03 f7 04 f7
 
  0x0c32800094d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==221218==ABORTING

Generated at Thu Feb 08 09:31:43 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.