[MDEV-25781] ASAN/Valgrind errors in SHA1_Update upon combinations of functions with value truncation in the middle Created: 2021-05-26  Updated: 2023-10-13

Status: Confirmed
Project: MariaDB Server
Component/s: Data types, Server
Affects Version/s: 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.4, 10.5

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: not-10.6+

Issue Links:
Relates
relates to MDEV-26434 MariaDB Server SEGV in setup_copy_fields Closed

 Description    

CREATE TABLE t1 (a SET('1','2'), b INT);
 
INSERT INTO t1 VALUES ('',1001),('',10001);
 
 
 
SELECT SHA1(GREATEST(CAST(b AS BINARY(4)), a)) AS f FROM t1 GROUP BY f;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.2 d8fa71a0 ASAN

 
==1852044==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000147e0 at pc 0x7fdeba8bb480 bp 0x7fdeaf40d1e0 sp 0x7fdeaf40c988
 
READ of size 4 at 0x60f0000147e0 thread T5
 
    #0 0x7fdeba8bb47f  (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
 
    #1 0x7fdeba497052 in SHA1_Update (/lib/x86_64-linux-gnu/libcrypto.so.1.1+0x1c2052)
 
    #2 0x555ad4a7ba0d in sha_input /data/src/10.2/mysys_ssl/my_sha.ic:94
 
    #3 0x555ad4a7bb13 in my_sha1 /data/src/10.2/mysys_ssl/my_sha.ic:137
 
    #4 0x555ad3ace020 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:176
 
    #5 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
 
    #6 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
 
    #7 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
 
    #8 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
 
    #9 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
 
    #10 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
 
    #11 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
 
    #12 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
 
    #13 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
 
    #14 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
 
    #15 0x555ad340c82d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18913
 
    #16 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
 
    #17 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
 
    #18 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
 
    #19 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
 
    #20 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
 
    #21 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
 
    #22 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
 
    #23 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
 
    #24 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #25 0x555ad32d81a1 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #26 0x555ad3661ed5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #27 0x555ad3661798 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #28 0x555ad4a07c51 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #29 0x7fdeba2b3608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
    #30 0x7fdeb9e8f292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x60f0000147e0 is located 112 bytes inside of 164-byte region [0x60f000014770,0x60f000014814)
 
freed by thread T5 here:
 
    #0 0x7fdeba92d7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
 
    #1 0x555ad4b25896 in free_memory /data/src/10.2/mysys/safemalloc.c:279
 
    #2 0x555ad4b24de2 in sf_free /data/src/10.2/mysys/safemalloc.c:197
 
    #3 0x555ad4af114e in my_free /data/src/10.2/mysys/my_malloc.c:218
 
    #4 0x555ad30a18ef in String::free() /data/src/10.2/sql/sql_string.h:351
 
    #5 0x555ad32a217d in String::operator=(String const&) /data/src/10.2/sql/sql_string.h:422
 
    #6 0x555ad38ea0d5 in Field_set::val_str(String*, String*) /data/src/10.2/sql/field.cc:9281
 
    #7 0x555ad396f69c in Item_field::val_str(String*) /data/src/10.2/sql/item.cc:2801
 
    #8 0x555ad3a6ee2f in Item_func_min_max::val_str(String*) /data/src/10.2/sql/item_func.cc:2960
 
    #9 0x555ad3acdfd5 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:171
 
    #10 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
 
    #11 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
 
    #12 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
 
    #13 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
 
    #14 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
 
    #15 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
 
    #16 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
 
    #17 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
 
    #18 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
 
    #19 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
 
    #20 0x555ad340c82d in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18913
 
    #21 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
 
    #22 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
 
    #23 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
 
    #24 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
 
    #25 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
 
    #26 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
 
    #27 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
 
    #28 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
 
    #29 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7fdeba92dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x555ad4b24754 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
 
    #2 0x555ad4af06dd in my_malloc /data/src/10.2/mysys/my_malloc.c:101
 
    #3 0x555ad34dcdb4 in String::real_alloc(unsigned long) /data/src/10.2/sql/sql_string.cc:45
 
    #4 0x555ad30c9cbf in String::alloc(unsigned long) /data/src/10.2/sql/sql_string.h:361
 
    #5 0x555ad3ace034 in Item_func_sha::val_str_ascii(String*) /data/src/10.2/sql/item_strfunc.cc:178
 
    #6 0x555ad3accebd in Item_func::val_str_from_val_str_ascii(String*, String*) /data/src/10.2/sql/item_strfunc.cc:82
 
    #7 0x555ad3856b59 in Item_str_ascii_func::val_str(String*) /data/src/10.2/sql/item_strfunc.h:94
 
    #8 0x555ad3989c9c in Item::save_in_field(Field*, bool) /data/src/10.2/sql/item.cc:6397
 
    #9 0x555ad31e58fa in Item_result_field::save_in_result_field(bool) /data/src/10.2/sql/item.h:2564
 
    #10 0x555ad3431a76 in copy_funcs(Item**, THD const*) /data/src/10.2/sql/sql_select.cc:23923
 
    #11 0x555ad34173c4 in end_write /data/src/10.2/sql/sql_select.cc:20278
 
    #12 0x555ad3448124 in AGGR_OP::put_record(bool) /data/src/10.2/sql/sql_select.cc:26819
 
    #13 0x555ad34565dc in AGGR_OP::put_record() (/mnt-hd8t/bld/10.2-asan-nightly/bin/mysqld+0xfb85dc)
 
    #14 0x555ad340b109 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18595
 
    #15 0x555ad340d82a in evaluate_join_record /data/src/10.2/sql/sql_select.cc:19094
 
    #16 0x555ad340c19c in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18874
 
    #17 0x555ad340a285 in do_select /data/src/10.2/sql/sql_select.cc:18418
 
    #18 0x555ad33a40da in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3651
 
    #19 0x555ad33a1bf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3446
 
    #20 0x555ad33a5474 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3849
 
    #21 0x555ad3381e4f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:361
 
    #22 0x555ad32f8cbc in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6271
 
    #23 0x555ad32e6045 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3582
 
    #24 0x555ad33021d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
 
    #25 0x555ad32db3d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #26 0x555ad32d81a1 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #27 0x555ad3661ed5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
 
    #28 0x555ad3661798 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #29 0x555ad4a07c51 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7fdeba85a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x555ad4a08042 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x555ad307c243 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x555ad309419a in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6573
 
    #4 0x555ad3094935 in create_new_thread /data/src/10.2/sql/mysqld.cc:6643
 
    #5 0x555ad3095ad8 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6901
 
    #6 0x555ad30934eb in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6192
 
    #7 0x555ad307aafc in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7fdeb9d940b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f) 
Shadow bytes around the buggy address:
 
  0x0c1e7fffa8a0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
 
  0x0c1e7fffa8b0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c1e7fffa8c0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
 
  0x0c1e7fffa8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c1e7fffa8e0: 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fd fd
 
=>0x0c1e7fffa8f0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
 
  0x0c1e7fffa900: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1e7fffa910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1e7fffa920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1e7fffa930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c1e7fffa940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1852044==ABORTING

10.2 d8fa71a0 valgrind

 
==1852169== Thread 6:
 
==1852169== Invalid read of size 2
 
==1852169==    at 0x4842B30: memmove (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
 
==1852169==    by 0x4C9C052: SHA1_Update (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1)
 
==1852169==    by 0x11057A3: sha_input(SHAstate_st*, unsigned char const*, unsigned int) (my_sha.ic:94)
 
==1852169==    by 0x110580D: my_sha1 (my_sha.ic:137)
 
==1852169==    by 0xA42CDB: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:176)
 
==1852169==    by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
 
==1852169==    by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
 
==1852169==    by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
 
==1852169==    by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
 
==1852169==    by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
 
==1852169==    by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
 
==1852169==    by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
 
==1852169==    by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
 
==1852169==    by 0x773A87: sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) (sql_select.cc:18595)
 
==1852169==    by 0x7746C3: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:19094)
 
==1852169==    by 0x77415D: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:18913)
 
==1852169==  Address 0xbfdd668 is 8 bytes inside a block of size 56 free'd
 
==1852169==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
 
==1852169==    by 0x1138959: my_free (my_malloc.c:218)
 
==1852169==    by 0x6119C1: String::free() (sql_string.h:351)
 
==1852169==    by 0x6E68CC: String::operator=(String const&) (sql_string.h:422)
 
==1852169==    by 0x97C50F: Field_set::val_str(String*, String*) (field.cc:9281)
 
==1852169==    by 0x9B08EC: Item_field::val_str(String*) (item.cc:2801)
 
==1852169==    by 0xA19B64: Item_func_min_max::val_str(String*) (item_func.cc:2960)
 
==1852169==    by 0xA42C9D: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:171)
 
==1852169==    by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
 
==1852169==    by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
 
==1852169==    by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
 
==1852169==    by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
 
==1852169==    by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
 
==1852169==    by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
 
==1852169==    by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
 
==1852169==    by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
 
==1852169==  Block was alloc'd at
 
==1852169==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
 
==1852169==    by 0x113835A: my_malloc (my_malloc.c:101)
 
==1852169==    by 0x7C26B5: String::real_alloc(unsigned long) (sql_string.cc:45)
 
==1852169==    by 0x62149E: String::alloc(unsigned long) (sql_string.h:361)
 
==1852169==    by 0xA42CEC: Item_func_sha::val_str_ascii(String*) (item_strfunc.cc:178)
 
==1852169==    by 0xA42634: Item_func::val_str_from_val_str_ascii(String*, String*) (item_strfunc.cc:82)
 
==1852169==    by 0x9449D9: Item_str_ascii_func::val_str(String*) (item_strfunc.h:94)
 
==1852169==    by 0x9BA664: Item::save_in_field(Field*, bool) (item.cc:6397)
 
==1852169==    by 0x69C8DD: Item_result_field::save_in_result_field(bool) (item.h:2564)
 
==1852169==    by 0x780B37: copy_funcs(Item**, THD const*) (sql_select.cc:23923)
 
==1852169==    by 0x77780A: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:20278)
 
==1852169==    by 0x788F3E: AGGR_OP::put_record(bool) (sql_select.cc:26819)
 
==1852169==    by 0x78F2C2: AGGR_OP::put_record() (sql_select.h:973)
 
==1852169==    by 0x773A87: sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) (sql_select.cc:18595)
 
==1852169==    by 0x7746C3: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:19094)
 
==1852169==    by 0x773FAA: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:18874)

Reproducible on 10.2-10.6.
No obvious problem on a non-instrumented build – SELECT returns a result set with a warning:

SELECT SHA1(GREATEST(CAST(b AS BINARY(4)), a)) AS f FROM t1 GROUP BY f;
 
f
 
328773d12eb25541474aad19d682b234a4268d0e
 
dd01903921ea24941c26a48f2cec24e0bb0e8cc7
 
Warnings:
 
Warning	1292	Truncated incorrect BINARY(4) value: '10001'


Generated at Thu Feb 08 09:40:19 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.