[MDEV-29864] ASAN heap-buffer-overflow in Field_datetime_with_dec::sort_string Created: 2022-10-24  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Storage Engine - RocksDB
Affects Version/s: 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None


 Description   

Possibly the test case can be modified to avoid application periods, and then applied to 10.3-10.4, but I don't realistically expect it to be fixed before 10.3/4 go EOL, so it doesn't make much difference. If by chance it is, please check if the underlying problem affects 10.3/10.4 and change affected/fix versions accordingly.

INSTALL SONAME 'ha_rocksdb';
 
 
 
CREATE TABLE t (id INT, f VARCHAR(8), s DATETIME, e DATETIME, PERIOD FOR p(s,e), PRIMARY KEY(id), UNIQUE ind1 (id, p WITHOUT OVERLAPS)) ENGINE=RocksDB;
 
INSERT INTO t (id,s,e) VALUES (1,'2000-01-01','2022-12-12'), (2,'2000-01-01','2022-12-12');
 
--error ER_DUP_ENTRY
 
ALTER TABLE t DROP KEY IF EXISTS ind1, ADD UNIQUE (s);
 
UPDATE t SET id = 3;
 
 
 
# Cleanup
 
DROP TABLE t;

10.5 dca4fc24

 
==7485==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400003e478 at pc 0x7f39e33f28a1 bp 0x7f39d9469e90 sp 0x7f39d9469640
 
WRITE of size 5 at 0x60400003e478 thread T5
 
    #0 0x7f39e33f28a0 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806
 
    #1 0x56552eb4542e in Field_datetime_with_dec::sort_string(unsigned char*, unsigned int) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/field.h:3854
 
    #2 0x7f39d7e7e029 in myrocks::Rdb_key_def::pack_with_make_sort_key(myrocks::Rdb_field_packing*, Field*, unsigned char*, unsigned char**, myrocks::Rdb_pack_field_context*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/rdb_datadic.cc:1499
 
    #3 0x7f39d7e7bfa1 in myrocks::Rdb_key_def::pack_field(Field*, myrocks::Rdb_field_packing*, unsigned char*, unsigned char*, unsigned char*, myrocks::Rdb_string_writer*, unsigned int*) const /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/rdb_datadic.cc:1234
 
    #4 0x7f39d7e7cca8 in myrocks::Rdb_key_def::pack_record(TABLE const*, unsigned char*, unsigned char const*, unsigned char*, myrocks::Rdb_string_writer*, bool, long long, unsigned int, unsigned int*, char const*) const /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/rdb_datadic.cc:1382
 
    #5 0x7f39d7d3c984 in myrocks::ha_rocksdb::check_and_lock_sk(unsigned int, myrocks::ha_rocksdb::update_row_info const&, bool*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/ha_rocksdb.cc:9836
 
    #6 0x7f39d7d3d677 in myrocks::ha_rocksdb::check_uniqueness_and_lock(myrocks::ha_rocksdb::update_row_info const&, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/ha_rocksdb.cc:9960
 
    #7 0x7f39d7d40d15 in myrocks::ha_rocksdb::update_write_row(unsigned char const*, unsigned char const*, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/ha_rocksdb.cc:10401
 
    #8 0x7f39d7d474b7 in myrocks::ha_rocksdb::update_row(unsigned char const*, unsigned char const*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/ha_rocksdb.cc:11252
 
    #9 0x56552eba619b in handler::ha_update_row(unsigned char const*, unsigned char const*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/handler.cc:7281
 
    #10 0x56552e6d54fc in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_update.cc:1085
 
    #11 0x56552e41316b in mysql_execute_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:4468
 
    #12 0x56552e42ac52 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:8087
 
    #13 0x56552e403448 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1891
 
    #14 0x56552e400681 in do_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1375
 
    #15 0x56552e7df7cf in do_handle_one_connection(CONNECT*, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1416
 
    #16 0x56552e7df197 in handle_one_connection /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1318
 
    #17 0x56552f2fbb1b in pfs_spawn_thread /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/pfs.cc:2201
 
    #18 0x7f39e2e6aea6 in start_thread nptl/pthread_create.c:477
 
    #19 0x7f39e2a57aee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfcaee)
 
 
 
0x60400003e478 is located 0 bytes to the right of 40-byte region [0x60400003e450,0x60400003e478)
 
allocated by thread T5 here:
 
    #0 0x7f39e3462e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
 
    #1 0x56552feb329c in my_malloc /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/mysys/my_malloc.c:90
 
    #2 0x7f39d7d24532 in myrocks::ha_rocksdb::alloc_key_buffers(TABLE const*, myrocks::Rdb_tbl_def const*, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/ha_rocksdb.cc:6607
 
    #3 0x7f39d7d52607 in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/rocksdb/ha_rocksdb.cc:12706
 
    #4 0x56552e691267 in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/handler.h:4514
 
    #5 0x56552e6724f9 in mysql_inplace_alter_table /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_table.cc:8156
 
    #6 0x56552e6850bd in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_table.cc:10860
 
    #7 0x56552e7f7987 in Sql_cmd_alter_table::execute(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_alter.cc:553
 
    #8 0x56552e41ecfd in mysql_execute_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:6057
 
    #9 0x56552e42ac52 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:8087
 
    #10 0x56552e403448 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1891
 
    #11 0x56552e400681 in do_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1375
 
    #12 0x56552e7df7cf in do_handle_one_connection(CONNECT*, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1416
 
    #13 0x56552e7df197 in handle_one_connection /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1318
 
    #14 0x56552f2fbb1b in pfs_spawn_thread /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/pfs.cc:2201
 
    #15 0x7f39e2e6aea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f39e340e2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x56552f2f787c in my_thread_create /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/my_thread.h:52
 
    #2 0x56552f2fbf0a in pfs_spawn_thread_v1 /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/pfs.cc:2252
 
    #3 0x56552e152d54 in inline_mysql_thread_create /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/include/mysql/psi/mysql_thread.h:1323
 
    #4 0x56552e1667f7 in create_thread_to_handle_connection(CONNECT*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6068
 
    #5 0x56552e166b68 in create_new_thread(CONNECT*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6127
 
    #6 0x56552e166dab in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6192
 
    #7 0x56552e16794d in handle_connections_sockets() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6319
 
    #8 0x56552e166348 in mysqld_main(int, char**) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:5714
 
    #9 0x56552e1518f4 in main /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/main.cc:25
 
    #10 0x7f39e297ed09 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:806 in __interceptor_memcpy
 
Shadow bytes around the buggy address:
 
  0x0c087ffffc30: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
 
  0x0c087ffffc40: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
 
  0x0c087ffffc50: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
 
  0x0c087ffffc60: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
 
  0x0c087ffffc70: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
 
=>0x0c087ffffc80: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00[fa]
 
  0x0c087ffffc90: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
 
  0x0c087ffffca0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
 
  0x0c087ffffcb0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
 
  0x0c087ffffcc0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
 
  0x0c087ffffcd0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==7485==ABORTING


Generated at Thu Feb 08 10:11:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.