[MDEV-25638] Assertion `!result' failed in convert_const_to_int Created: 2021-05-10 Updated: 2022-04-15 Resolved: 2022-04-15 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Data Definition - Create Table, Debug |
| Affects Version/s: | 10.5.9, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7 |
| Fix Version/s: | 10.2.44, 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4 |
| Type: | Bug | Priority: | Blocker |
| Reporter: | Zuming Jiang | Assignee: | Sergei Golubchik |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | crash | ||
| Environment: |
Ubuntu 18.04 |
||
| Attachments: |
|
||||||||||||||||||||||||||||||||||||||||||||
| Issue Links: |
|
||||||||||||||||||||||||||||||||||||||||||||
| Description |
|
I used my fuzzing tool to test Mariadb , and found a bug that can result in an heap-use-after-free (reported by ASAN). Mariadb installation: How to Repeat: I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the ASAN report. |
| Comments |
| Comment by Alice Sherepa [ 2021-05-10 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Thanks! I repeated on 10.2-10.5, works as expected on 5.5-10.1.
non-debug build returns just
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-02-10 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
The problem is that convert_const_to_int() trys to store value of the field x (because there is no flag STATUS_NO_RECORD), but the record in the process of the opening the field looks like contain a garbage. So flag STATUS_NO_RECORD should be put if thee is no record in the buffer yet (and it shoud not be value in the buffer because it is creation of the field) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-02-10 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
There is 3 problems 1) Above (absence of STATUS_NO_RECORD)
2) mismatch signed unsigned (I belive can be made separate test with big numbers:
3) Placing revert replacement with integer (as vell as other types) in TABLE mem_root, which freed in CREATE TABLE earlier then runtime mem_root, which lead to attempt of accessing freed memory. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Joris de Leeuw [ 2022-03-02 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Just an additional warning. If you leave the table with the bigint on your system this can also cause crashes of MariaDB when running queries on information_schema.tables. So I would highly recommend to remove the table after testing from a staging system if you want to test something different. Example on how to also make MariaDB crash: Step 1: Create the table as stated above if it doesn't exist yet:
You now get a signal 11 and ignore it Step 2:
This now also causes a signal 11 with e.g. the following crash report:
I hope this issue can be resolved soon as it can cause unwanted behaviour on a MariaDB server. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-03-21 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
IMHO to fix 3) we should do correct parse/prepare/memory management: | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Oleksandr Byelkin [ 2022-04-06 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
commit 16f2cf8f6fff884d75c5680230e2a54009ae5097 (HEAD The test suite triggers 3 bugs: I. Absence of STATUS_NO_RECORD on an empty record A cycle of live of Items (expressions) in table is following: 1) Parsed in the query arena of the table So looking on the above all changes in the expressions belonged to |