[MDEV-27842] SIGSEGV in replace_routine_table on GRANT Created: 2022-02-14  Updated: 2023-04-27

Status: Open
Project: MariaDB Server
Component/s: Binary Protocol
Affects Version/s: 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Andrei Elkin
Resolution: Unresolved Votes: 0
Labels: None


 Description   

SET sql_mode='';
SET log_bin_trust_function_creators=1;
RENAME TABLE mysql.procs_priv TO mysql.procs_priv_bak;
USE mysql;
CREATE TABLE procs_priv (dummy INT);
CREATE FUNCTION f() RETURNS INT RETURN (SELECT 1 t);
GRANT EXECUTE ON FUNCTION f TO a@b;

Leads to:

10.9.0 b5852ffbeebc3000982988383daeefb0549e058a (Debug)

Core was generated by `/test/MD140222-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005557948dca2c in replace_routine_table (thd=thd@entry=0x154830000db8, 
    grant_name=grant_name@entry=0x5557975e5518, table=0x15483007b148, 
    combo=..., db=<optimized out>, db@entry=0x154830014648 "mysql", 
    routine_name=routine_name@entry=0x154830013ec8 "f", sph=
    0x555795f49688 <sp_handler_function>, rights=EXECUTE_ACL, 
    revoke_grant=false) at /test/10.9_dbg/sql/sql_acl.cc:5957
5957	  table->field[1]->store(db,(uint) strlen(db), &my_charset_latin1);
[Current thread is 1 (Thread 0x15488c1e9700 (LWP 2861119))]
(gdb) bt
#0  0x00005557948dca2c in replace_routine_table (thd=thd@entry=0x154830000db8, grant_name=grant_name@entry=0x5557975e5518, table=0x15483007b148, combo=@0x154830013f28: {<AUTHID> = {user = {str = 0x154830013f18 "a", length = 1}, host = {str = 0x154830013f20 "b", length = 1}}, auth = 0x555795ff29a0 <auth_no_password>}, db=<optimized out>, db@entry=0x154830014648 "mysql", routine_name=routine_name@entry=0x154830013ec8 "f", sph=0x555795f49688 <sp_handler_function>, rights=EXECUTE_ACL, revoke_grant=false) at /test/10.9_dbg/sql/sql_acl.cc:5957
#1  0x00005557948fc7c0 in mysql_routine_grant (thd=thd@entry=0x154830000db8, table_list=0x154830013f68, sph=0x555795f49688 <sp_handler_function>, user_list=@0x154830006060: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x154830013f50, last = 0x154830013f50, elements = 1}, <No data fields>}, rights=rights@entry=EXECUTE_ACL, revoke_grant=false, write_to_binlog=true) at /test/10.9_dbg/sql/sql_acl.cc:7327
#2  0x00005557948fcfbc in Sql_cmd_grant_sp::execute (this=0x154830014650, thd=0x154830000db8) at /test/10.9_dbg/sql/sql_acl.h:317
#3  0x00005557949ae80e in mysql_execute_command (thd=thd@entry=0x154830000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.9_dbg/sql/sql_parse.cc:5988
#4  0x0000555794995315 in mysql_parse (thd=thd@entry=0x154830000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15488c1e8400) at /test/10.9_dbg/sql/sql_parse.cc:8027
#5  0x00005557949a3fb1 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154830000db8, packet=packet@entry=0x15483000b889 "GRANT EXECUTE ON FUNCTION f TO a@b", packet_length=packet_length@entry=34, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_class.h:1362
#6  0x00005557949a73f8 in do_command (thd=0x154830000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1402
#7  0x0000555794b21fc4 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557975d4048, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418
#8  0x0000555794b225c9 in handle_one_connection (arg=arg@entry=0x5557975d4048) at /test/10.9_dbg/sql/sql_connect.cc:1312
#9  0x0000555794fa8d67 in pfs_spawn_thread (arg=0x5557974e7268) at /test/10.9_dbg/storage/perfschema/pfs.cc:2201
#10 0x00001548b0d95609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#11 0x00001548b0983293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.6.6 (opt), 10.7.2 (dbg), 10.7.2 (opt), 10.8.1 (dbg), 10.8.1 (opt), 10.9.0 (dbg), 10.9.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)



 Comments   
Comment by Roel Van de Paar [ 2022-02-14 ]

UniqueID's seen

SIGSEGV|replace_routine_table|mysql_routine_grant|Sql_cmd_grant_sp::execute|mysql_execute_command
SIGSEGV|replace_routine_table|mysql_routine_grant|mysql_execute_command|mysql_parse

Comment by Roel Van de Paar [ 2022-02-14 ]

SET sql_mode='';
RENAME TABLE mysql.procs_priv TO mysql.procs_priv_bak;
CREATE TABLE mysql.procs_priv (dummy INT) ENGINE=InnoDB;
CREATE FUNCTION f() RETURNS INT RETURN (SELECT 1 t);
GRANT EXECUTE ON FUNCTION f TO a@b;

Produces the same outcome.

Generated at Thu Feb 08 09:56:00 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.