[MDEV-27333] global-buffer-overflow in spider_sys_get_table_sts() Created: 2021-12-21  Updated: 2023-11-15  Resolved: 2023-11-15

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.5
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Nayuta Yanagisawa (Inactive) Assignee: Yuchen Pei
Resolution: Cannot Reproduce Votes: 0
Labels: spider-sts-crd


 Description   

The following error occurs on ASAN build (-DWITH_ASAN=ON -DWITH_SAFEMALLOC=OFF):

Use test;
 
INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
CREATE SERVER d FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',DATABASE'',USER'',PORT 10000,PASSWORD'');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=SPIDER;
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER UNION=(t);


==2175739==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f79a9e25261 at pc 0x55902fa30b1c bp 0x7f79aa21e220 sp 0x7f79aa21e210
 
READ of size 1 at 0x7f79a9e25261 thread T12
 
    #0 0x55902fa30b1b in my_charlen_utf8mb3 /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/strings/ctype-utf8.c:5205
 
    #1 0x55902fa30b1b in my_well_formed_char_length_utf8mb3 /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/strings/ctype-mb.ic:187
 
    #2 0x55902f9dd6cd in my_ci_well_formed_char_length /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/include/m_ctype.h:1021
 
    #3 0x55902f9dd6cd in my_copy_fix_mb /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/strings/ctype-mb.c:406
 
    #4 0x55902e29bc2a in charset_info_st::copy_fix(char*, unsigned long, char const*, unsigned long, unsigned long, MY_STRCOPY_STATUS*) const /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/include/m_ctype.h:761
 
    #5 0x55902e29bc2a in String_copier::well_formed_copy(charset_info_st const*, char*, unsigned long, charset_info_st const*, char const*, unsigned long, unsigned long) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_string.cc:1115
 
    #6 0x55902e740233 in Field_longstr::well_formed_copy_with_check(char*, unsigned long, charset_info_st const*, char const*, unsigned long, unsigned long, bool, unsigned int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/field.h:2178
 
    #7 0x55902e740233 in Field_string::store(char const*, unsigned long, charset_info_st const*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/field.cc:7291
 
    #8 0x7f79a9c170e6 in spider_sys_get_table_sts(THD*, char const*, unsigned int, ha_statistics*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/storage/spider/spd_sys_table.cc:3442
 
    #9 0x7f79a9cdf902 in spider_get_sts(st_spider_share*, int, long, ha_spider*, double, int, int, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/storage/spider/spd_table.cc:8006
 
    #10 0x7f79a9d03798 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/storage/spider/spd_table.cc:5505
 
    #11 0x7f79a9d7bd61 in ha_spider::open(char const*, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/storage/spider/ha_spider.cc:441
 
    #12 0x55902e7775c3 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/handler.cc:2997
 
    #13 0x55902e381fb9 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/table.cc:4242
 
    #14 0x55902e60d51c in THD::open_temporary_table(TMP_TABLE_SHARE*, char const*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/temporary_tables.cc:1117
 
    #15 0x55902e6122ba in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/temporary_tables.cc:74
 
    #16 0x55902e2d0191 in create_table_impl /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_table.cc:5424
 
    #17 0x55902e2d12c9 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_table.cc:5496
 
    #18 0x55902e2d1b93 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_table.cc:5600
 
    #19 0x55902e2e1f0e in Sql_cmd_create_table_like::execute(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_table.cc:12238
 
    #20 0x55902e08ec0b in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_parse.cc:6056
 
    #21 0x55902e09bf01 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_parse.cc:8100
 
    #22 0x55902e0a2f64 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_parse.cc:1891
 
    #23 0x55902e0a7c04 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_parse.cc:1370
 
    #24 0x55902e41c9c6 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_connect.cc:1418
 
    #25 0x55902e41d074 in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/sql/sql_connect.cc:1312
 
    #26 0x55902efa4c58 in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27240/storage/perfschema/pfs.cc:2201
 
    #27 0x7f79baf6b44f in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x944f)
 
    #28 0x7f79bab02d52 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x117d52)



 Comments   
Comment by Nayuta Yanagisawa (Inactive) [ 2022-01-07 ]

The following SQLs, which are from MDEV-27171, also occur a similar crash on https://github.com/MariaDB/server/commit/82b74a0e7cfb7082e7bef3840df5d172fe6cc834. 

INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
CREATE SERVER d FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',DATABASE'',USER'',PORT 10000,PASSWORD'');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=SPIDER;
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER UNION=(t);
 
INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);

Comment by Yuchen Pei [ 2023-11-15 ]

I cannot reproduce this at 10.5
c638051d808a7b29b10e231c9eae97d5909d17f6, closing.

Here are my testcases:

INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
evalp CREATE SERVER d FOREIGN DATA WRAPPER mysql
 
OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=SPIDER;
 
--error ER_BAD_FIELD_ERROR
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
--error ER_BAD_FIELD_ERROR
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
--error ER_ILLEGAL_HA_CREATE_OPTION
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER UNION=(t);
 

INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
evalp CREATE SERVER d FOREIGN DATA WRAPPER mysql
 
OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=SPIDER;
 
--error ER_BAD_FIELD_ERROR
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
--error ER_BAD_FIELD_ERROR
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
--error ER_ILLEGAL_HA_CREATE_OPTION
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER UNION=(t);
 
--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE
 
INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);

Generated at Thu Feb 08 09:52:07 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.