[MDEV-24934] ASAN heap-use-after-free in Item_dyncol_get::val_str Created: 2021-02-21  Updated: 2023-10-20

Status: Open
Project: MariaDB Server
Component/s: Dynamic Columns
Affects Version/s: 5.5, 10.0, 10.1, 10.2, 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.4, 10.5

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None


 Description   

Setting to minor, because if no users have complained about it for all these years, probably nobody cares.

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (a BLOB) ENGINE=InnoDB;
 
INSERT INTO t1 VALUES (COLUMN_CREATE(1,REPEAT('x',31))),(COLUMN_CREATE(1,100));
 
SELECT COLUMN_GET(a, 1 AS CHAR) = 'foo' FROM t1;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.2 5ecaf52d

 
==4128049==ERROR: AddressSanitizer: heap-use-after-free on address 0x629000140290 at pc 0x7fc0241fc57d bp 0x7fc00d165e00 sp 0x7fc00d1655a8
 
WRITE of size 3 at 0x629000140290 thread T27
 
    #0 0x7fc0241fc57c  (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c)
 
    #1 0x55eee83e7b4e in my_longlong10_to_str_8bit /data/src/10.2/strings/ctype-simple.c:889
 
    #2 0x55eee6d45890 in String::set_int(long long, bool, charset_info_st const*) /data/src/10.2/sql/sql_string.cc:130
 
    #3 0x55eee735ebe0 in Item_dyncol_get::val_str(String*) /data/src/10.2/sql/item_strfunc.cc:4864
 
    #4 0x55eee73f0cae in Item_char_typecast::val_str(String*) /data/src/10.2/sql/item_timefunc.cc:2509
 
    #5 0x55eee7234a15 in Arg_comparator::compare_string() /data/src/10.2/sql/item_cmpfunc.cc:825
 
    #6 0x55eee72727e1 in Arg_comparator::compare() /data/src/10.2/sql/item_cmpfunc.h:87
 
    #7 0x55eee72407a5 in Item_func_eq::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1803
 
    #8 0x55eee71f419a in Item::send(Protocol*, String*) /data/src/10.2/sql/item.cc:6938
 
    #9 0x55eee692c30f in Protocol::send_result_set_row(List<Item>*) /data/src/10.2/sql/protocol.cc:992
 
    #10 0x55eee6a93b3a in select_send::send_data(List<Item>&) /data/src/10.2/sql/sql_class.cc:2734
 
    #11 0x55eee6c7c838 in end_send /data/src/10.2/sql/sql_select.cc:20031
 
    #12 0x55eee6c75352 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19079
 
    #13 0x55eee6c74355 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18898
 
    #14 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
 
    #15 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
 
    #16 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
 
    #17 0x55eee6c0d25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837
 
    #18 0x55eee6be9d01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
 
    #19 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
 
    #20 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
 
    #21 0x55eee6b6a169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
 
    #22 0x55eee6b431ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #23 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #24 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #25 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #26 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #27 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
    #28 0x7fc0238e1292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x629000140290 is located 144 bytes inside of 16512-byte region [0x629000140200,0x629000144280)
 
freed by thread T27 here:
 
    #0 0x7fc02426e7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
 
    #1 0x55eee785127f in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.2/storage/innobase/mem/mem0mem.cc:428
 
    #2 0x55eee7979c55 in mem_heap_free /data/src/10.2/storage/innobase/include/mem0mem.ic:416
 
    #3 0x55eee7980d42 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:164
 
    #4 0x55eee79f2102 in row_sel_store_mysql_rec /data/src/10.2/storage/innobase/row/row0sel.cc:3157
 
    #5 0x55eee79ffab0 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0sel.cc:5623
 
    #6 0x55eee76cb20c in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9659
 
    #7 0x55eee76cc43f in ha_innobase::rnd_next(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9870
 
    #8 0x55eee719904a in handler::ha_rnd_next(unsigned char*) /data/src/10.2/sql/handler.cc:2669
 
    #9 0x55eee7546947 in rr_sequential(READ_RECORD*) /data/src/10.2/sql/records.cc:492
 
    #10 0x55eee6c73f85 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18878
 
    #11 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
 
    #12 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
 
    #13 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
 
    #14 0x55eee6c0d25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837
 
    #15 0x55eee6be9d01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
 
    #16 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
 
    #17 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
 
    #18 0x55eee6b6a169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
 
    #19 0x55eee6b431ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #20 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #21 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #22 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #23 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #24 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7fc02426ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x55eee78507bc in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:289
 
    #2 0x55eee79dd3e8 in mem_heap_create_func /data/src/10.2/storage/innobase/include/mem0mem.ic:374
 
    #3 0x55eee79f1abf in row_sel_store_mysql_field_func /data/src/10.2/storage/innobase/row/row0sel.cc:3098
 
    #4 0x55eee79f2c28 in row_sel_store_mysql_rec /data/src/10.2/storage/innobase/row/row0sel.cc:3245
 
    #5 0x55eee79ffab0 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.2/storage/innobase/row/row0sel.cc:5623
 
    #6 0x55eee76c893c in ha_innobase::index_read(unsigned char*, unsigned char const*, unsigned int, ha_rkey_function) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9392
 
    #7 0x55eee76cbce2 in ha_innobase::index_first(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9769
 
    #8 0x55eee76cc3b9 in ha_innobase::rnd_next(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9862
 
    #9 0x55eee719904a in handler::ha_rnd_next(unsigned char*) /data/src/10.2/sql/handler.cc:2669
 
    #10 0x55eee7546947 in rr_sequential(READ_RECORD*) /data/src/10.2/sql/records.cc:492
 
    #11 0x55eee6c7a633 in join_init_read_record(st_join_table*) /data/src/10.2/sql/sql_select.cc:19785
 
    #12 0x55eee6c73b08 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18856
 
    #13 0x55eee6c71dad in do_select /data/src/10.2/sql/sql_select.cc:18403
 
    #14 0x55eee6c0bf40 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3642
 
    #15 0x55eee6c09a57 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3437
 
    #16 0x55eee6c0d25f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3837
 
    #17 0x55eee6be9d01 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
 
    #18 0x55eee6b60bec in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6248
 
    #19 0x55eee6b4db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3559
 
    #20 0x55eee6b6a169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
 
    #21 0x55eee6b431ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #22 0x55eee6b3ff6d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #23 0x55eee6ec8924 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #24 0x55eee6ec81e7 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #25 0x55eee8264aab in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #26 0x7fc023d07608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7fc02419b805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x55eee8264e9c in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x55eee68e5083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x55eee68fcc54 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573
 
    #4 0x55eee68fd3ef in create_new_thread /data/src/10.2/sql/mysqld.cc:6643
 
    #5 0x55eee68fe581 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901
 
    #6 0x55eee68fbfa5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192
 
    #7 0x55eee68e393c in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7fc0237e60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c) 
Shadow bytes around the buggy address:
 
  0x0c5280020000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280020010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280020020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280020030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280020040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c5280020050: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280020060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280020070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280020080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280020090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c52800200a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==4128049==ABORTING

Reproducible on all of 5.5-10.6.
Couldn't reproduce with MyISAM.
No obvious immediate problem on a non-ASAN build.

Other variations of stack traces observed on intermediate versions of the test case:

10.4 901bcde2

 
==4128679==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290003702e7 at pc 0x55d62f7b0664 bp 0x7f70ae49f970 sp 0x7f70ae49f960
 
WRITE of size 1 at 0x6290003702e7 thread T30
 
    #0 0x55d62f7b0663 in fmt_number /data/src/10.4/sql-common/my_time.c:1470
 
    #1 0x55d62f7b1007 in my_date_to_str /data/src/10.4/sql-common/my_time.c:1553
 
    #2 0x55d62f7b1515 in my_TIME_to_str /data/src/10.4/sql-common/my_time.c:1600
 
    #3 0x55d62e5a1674 in Item_dyncol_get::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:5002
 
    #4 0x55d62e649e49 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2337
 
    #5 0x55d62e459890 in Arg_comparator::compare_string() /data/src/10.4/sql/item_cmpfunc.cc:766
 
    #6 0x55d62e49d6e9 in Arg_comparator::compare() /data/src/10.4/sql/item_cmpfunc.h:104
 
    #7 0x55d62e465b88 in Item_func_eq::val_int() /data/src/10.4/sql/item_cmpfunc.cc:1770
 
    #8 0x55d62e0ec427 in Type_handler_int_result::Item_val_bool(Item*) const /data/src/10.4/sql/sql_type.cc:4514
 
    #9 0x55d62d8e270b in Item::val_bool() /data/src/10.4/sql/item.h:1465
 
    #10 0x55d62e487cd1 in Item_cond_and::val_int() /data/src/10.4/sql/item_cmpfunc.cc:5299
 
    #11 0x55d62de74d2e in SQL_SELECT::skip_record(THD*) /data/src/10.4/sql/opt_range.h:1665
 
    #12 0x55d62e818388 in record_should_be_deleted /data/src/10.4/sql/sql_delete.cc:232
 
    #13 0x55d62e81d135 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:787
 
    #14 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
 
    #15 0x55d62dbb4442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
 
    #16 0x55d62db8b033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
 
    #17 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
 
    #18 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
 
    #19 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
 
    #20 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #21 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
    #22 0x7f70c4f11292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x6290003702e7 is located 231 bytes inside of 16512-byte region [0x629000370200,0x629000374280)
 
freed by thread T30 here:
 
    #0 0x7f70c589e7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
 
    #1 0x55d62eb62dca in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.4/storage/innobase/mem/mem0mem.cc:416
 
    #2 0x55d62ecc7ab7 in mem_heap_free /data/src/10.4/storage/innobase/include/mem0mem.ic:417
 
    #3 0x55d62eccf5a1 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /data/src/10.4/storage/innobase/row/row0mysql.cc:162
 
    #4 0x55d62ed5bc74 in row_sel_store_mysql_rec /data/src/10.4/storage/innobase/row/row0sel.cc:3029
 
    #5 0x55d62ed6be73 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:5533
 
    #6 0x55d62e977e92 in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9510
 
    #7 0x55d62e97871d in ha_innobase::index_next(unsigned char*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9578
 
    #8 0x55d62e3abb3e in handler::ha_index_next(unsigned char*) /data/src/10.4/sql/handler.cc:2972
 
    #9 0x55d62e7d107c in rr_index /data/src/10.4/sql/records.cc:450
 
    #10 0x55d62d9e68eb in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
 
    #11 0x55d62e81cfd8 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:783
 
    #12 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
 
    #13 0x55d62dbb4442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
 
    #14 0x55d62db8b033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
 
    #15 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
 
    #16 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
 
    #17 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
 
    #18 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #19 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
previously allocated by thread T30 here:
 
    #0 0x7f70c589ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x55d62eb621c7 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:277
 
    #2 0x55d62ed44b41 in mem_heap_create_func /data/src/10.4/storage/innobase/include/mem0mem.ic:375
 
    #3 0x55d62ed5b527 in row_sel_store_mysql_field /data/src/10.4/storage/innobase/row/row0sel.cc:2970
 
    #4 0x55d62ed5c92d in row_sel_store_mysql_rec /data/src/10.4/storage/innobase/row/row0sel.cc:3117
 
    #5 0x55d62ed6be73 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:5533
 
    #6 0x55d62e977e92 in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9510
 
    #7 0x55d62e97871d in ha_innobase::index_next(unsigned char*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9578
 
    #8 0x55d62e3abb3e in handler::ha_index_next(unsigned char*) /data/src/10.4/sql/handler.cc:2972
 
    #9 0x55d62e7d107c in rr_index /data/src/10.4/sql/records.cc:450
 
    #10 0x55d62d9e68eb in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
 
    #11 0x55d62e81cfd8 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:783
 
    #12 0x55d62db9e1cf in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4770
 
    #13 0x55d62dbb4442 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7958
 
    #14 0x55d62db8b033 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855
 
    #15 0x55d62db87ae2 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373
 
    #16 0x55d62df79f3d in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
 
    #17 0x55d62df797e1 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
 
    #18 0x55d62f633c3a in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #19 0x7f70c56a8608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T30 created by T0 here:
 
    #0 0x7f70c57cb805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x55d62f63402b in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
 
    #2 0x55d62d890c78 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55d62d8a8851 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6259
 
    #4 0x55d62d8a8fec in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6329
 
    #5 0x55d62d8a94d2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6427
 
    #6 0x55d62d8aa36b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6585
 
    #7 0x55d62d8a7f56 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5917
 
    #8 0x55d62d88ebec in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f70c4e160b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql-common/my_time.c:1470 in fmt_number
 
Shadow bytes around the buggy address:
 
  0x0c5280066000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280066010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280066020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280066030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280066040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c5280066050: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
 
  0x0c5280066060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280066070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280066080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280066090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c52800660a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==4128679==ABORTING



 Comments   
Comment by Elena Stepanova [ 2023-10-20 ]

Different data types, fails on the 2nd execution of PS with a bit different stack trace

CREATE TABLE t (f TEXT);
 
INSERT INTO t VALUES (COLUMN_CREATE(2,10 AS DOUBLE)), (COLUMN_CREATE(2,REPEAT('x',256)));
 
PREPARE stmt FROM 'SELECT COLUMN_GET(f, 2 AS CHAR) = "foo" FROM t';
 
EXECUTE stmt;
 
EXECUTE stmt;

10.4 b1c8ea83

 
==1974123==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000050dac at pc 0x7f3e5ac48061 bp 0x7f3e527c54a0 sp 0x7f3e527c4c50
 
WRITE of size 2 at 0x613000050dac thread T5
 
    #0 0x7f3e5ac48060 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
 
    #1 0x55d83d88a31f in Binary_string::copy(char const*, unsigned long) /data/src/10.4/sql/sql_string.cc:272
 
    #2 0x55d83d379cd9 in String::copy(char const*, unsigned long, charset_info_st const*) /data/src/10.4/sql/sql_string.h:931
 
    #3 0x55d83d88add7 in String::copy(char const*, unsigned long, charset_info_st const*, charset_info_st const*, unsigned int*) /data/src/10.4/sql/sql_string.cc:457
 
    #4 0x55d83d889d4f in String::set_real(double, unsigned int, charset_info_st const*) /data/src/10.4/sql/sql_string.cc:218
 
    #5 0x55d83e00a59b in Item_dyncol_get::val_str(String*) /data/src/10.4/sql/item_strfunc.cc:4980
 
    #6 0x55d83e0b2262 in Item_char_typecast::val_str(String*) /data/src/10.4/sql/item_timefunc.cc:2347
 
    #7 0x55d83dec27f0 in Arg_comparator::compare_string() /data/src/10.4/sql/item_cmpfunc.cc:777
 
    #8 0x55d83df060bf in Arg_comparator::compare() /data/src/10.4/sql/item_cmpfunc.h:104
 
    #9 0x55d83deceeb5 in Item_func_eq::val_int() /data/src/10.4/sql/item_cmpfunc.cc:1790
 
    #10 0x55d83dbd0f6f in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /data/src/10.4/sql/sql_type.cc:7106
 
    #11 0x55d83dbea49f in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/mnt8t/bld/10.4-asan/bin/mysqld+0x18ba49f)
 
    #12 0x55d83d3a490f in Item::send(Protocol*, st_value*) /data/src/10.4/sql/item.h:1044
 
    #13 0x55d83d3969ac in Protocol::send_result_set_row(List<Item>*) /data/src/10.4/sql/protocol.cc:1038
 
    #14 0x55d83d5419d0 in select_send::send_data(List<Item>&) /data/src/10.4/sql/sql_class.cc:3138
 
    #15 0x55d83d7a91e7 in end_send /data/src/10.4/sql/sql_select.cc:22098
 
    #16 0x55d83d7a165d in evaluate_join_record /data/src/10.4/sql/sql_select.cc:21129
 
    #17 0x55d83d79ff99 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20902
 
    #18 0x55d83d79dd9d in do_select /data/src/10.4/sql/sql_select.cc:20423
 
    #19 0x55d83d72cc18 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4605
 
    #20 0x55d83d72a223 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
 
    #21 0x55d83d72e2b1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4826
 
    #22 0x55d83d6fee16 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
 
    #23 0x55d83d66e338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
 
    #24 0x55d83d65b84d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
 
    #25 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068
 
    #26 0x55d83d6c6d3c in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515
 
    #27 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587
 
    #28 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994
 
    #29 0x55d83d677588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
 
    #30 0x55d83d64d817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
 
    #31 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
 
    #32 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
 
    #33 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
 
    #34 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #35 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442
 
    #36 0x7f3e5a6495bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
 
 
 
0x613000050dac is located 44 bytes inside of 384-byte region [0x613000050d80,0x613000050f00)
 
freed by thread T5 here:
 
    #0 0x7f3e5acb78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
 
    #1 0x55d83f205565 in my_realloc /data/src/10.4/mysys/my_malloc.c:165
 
    #2 0x55d83f0ee4fc in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762
 
    #3 0x55d83f0d2803 in mi_reset /data/src/10.4/storage/myisam/mi_extra.c:476
 
    #4 0x55d83f072673 in ha_myisam::reset() /data/src/10.4/storage/myisam/ha_myisam.cc:2177
 
    #5 0x55d83de2df69 in handler::ha_reset() /data/src/10.4/sql/handler.cc:6621
 
    #6 0x55d83d4c3322 in close_thread_table(THD*, TABLE**) /data/src/10.4/sql/sql_base.cc:1086
 
    #7 0x55d83d4c29ac in close_thread_tables(THD*) /data/src/10.4/sql/sql_base.cc:1035
 
    #8 0x55d83d66c513 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:6283
 
    #9 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068
 
    #10 0x55d83d6c6d3c in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515
 
    #11 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587
 
    #12 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994
 
    #13 0x55d83d677588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
 
    #14 0x55d83d64d817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
 
    #15 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
 
    #16 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
 
    #17 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
 
    #18 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #19 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f3e5acb78d5 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
 
    #1 0x55d83f205565 in my_realloc /data/src/10.4/mysys/my_malloc.c:165
 
    #2 0x55d83f0ee4fc in mi_alloc_rec_buff /data/src/10.4/storage/myisam/mi_open.c:762
 
    #3 0x55d83f0cadfe in _mi_read_rnd_dynamic_record /data/src/10.4/storage/myisam/mi_dynrec.c:1811
 
    #4 0x55d83f117109 in mi_scan /data/src/10.4/storage/myisam/mi_scan.c:45
 
    #5 0x55d83f071332 in ha_myisam::rnd_next(unsigned char*) /data/src/10.4/storage/myisam/ha_myisam.cc:2071
 
    #6 0x55d83de0fd5c in handler::ha_rnd_next(unsigned char*) /data/src/10.4/sql/handler.cc:2904
 
    #7 0x55d83e235151 in rr_sequential(READ_RECORD*) /data/src/10.4/sql/records.cc:485
 
    #8 0x55d83d4ab177 in READ_RECORD::read_record() /data/src/10.4/sql/records.h:70
 
    #9 0x55d83d7a01cf in sub_select(JOIN*, st_join_table*, bool) /data/src/10.4/sql/sql_select.cc:20921
 
    #10 0x55d83d79dd9d in do_select /data/src/10.4/sql/sql_select.cc:20423
 
    #11 0x55d83d72cc18 in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4605
 
    #12 0x55d83d72a223 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
 
    #13 0x55d83d72e2b1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4826
 
    #14 0x55d83d6fee16 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
 
    #15 0x55d83d66e338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
 
    #16 0x55d83d65b84d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
 
    #17 0x55d83d6cb6fc in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5068
 
    #18 0x55d83d6c6d3c in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4515
 
    #19 0x55d83d6c0bae in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3587
 
    #20 0x55d83d65b892 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3994
 
    #21 0x55d83d677588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
 
    #22 0x55d83d64d817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
 
    #23 0x55d83d64a386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
 
    #24 0x55d83da49dd3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
 
    #25 0x55d83da496ea in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
 
    #26 0x55d83e6bb2f7 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #27 0x7f3e5a5c8fd3 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f3e5ac49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
 
    #1 0x55d83e6bb6e4 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
 
    #2 0x55d83d354f89 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55d83d36c6b6 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6289
 
    #4 0x55d83d36ce01 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6359
 
    #5 0x55d83d36d2cf in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6457
 
    #6 0x55d83d36e17b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6615
 
    #7 0x55d83d36be19 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5947
 
    #8 0x55d83d3530b8 in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f3e5a567189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
 
Shadow bytes around the buggy address:
 
  0x0c2680002160: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
 
  0x0c2680002170: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c2680002180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2680002190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c26800021a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
=>0x0c26800021b0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
 
  0x0c26800021c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c26800021d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c26800021e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c26800021f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c2680002200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==1974123==ABORTING

Generated at Thu Feb 08 09:33:49 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.