[MDEV-31274] LSAN: 32 bytes leaked in 1 allocation in mariadb_dyncol_json Created: 2023-05-15  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: JSON
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Alexey Botchkov
Resolution: Unresolved Votes: 0
Labels: LSAN, Memory_leak


 Description    

CREATE TABLE t (c INT,INDEX (c)) TRANSACTIONAL=1;
 
INSERT INTO t VALUES (1);
 
SELECT COLUMN_JSON(c) FROM t;
 
SHUTDOWN;

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Optimized, UBASAN)

 
==577810==ERROR: LeakSanitizer: detected memory leaks
 
 
 
Direct leak of 32 byte(s) in 1 object(s) allocated from:
 
    #0 0x55a3f7e85b17 in malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-opt/bin/mariadbd+0x7a1eb17)
 
    #1 0x55a3fc28f394 in my_malloc /test/11.0_opt_san/mysys/my_malloc.c:91
 
    #2 0x55a3fc29d025 in init_dynamic_string /test/11.0_opt_san/mysys/string.c:39
 
    #3 0x55a3fc2ed493 in mariadb_dyncol_json /test/11.0_opt_san/mysys/ma_dyncol.c:4266
 
    #4 0x55a3fa402903 in Item_func_dyncol_json::val_str(String*) /test/11.0_opt_san/sql/item_strfunc.cc:4964
 
    #5 0x55a3f9528646 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_opt_san/sql/sql_type.cc:7446
 
    #6 0x55a3f8080c4c in Protocol::send_result_set_row(List<Item>*) /test/11.0_opt_san/sql/protocol.cc:1332
 
    #7 0x55a3f84046da in select_send::send_data(List<Item>&) /test/11.0_opt_san/sql/sql_class.cc:3102
 
    #8 0x55a3f8a5f413 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5748
 
    #9 0x55a3f8a5f413 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5738
 
    #10 0x55a3f8a5f413 in end_send /test/11.0_opt_san/sql/sql_select.cc:24518
 
    #11 0x55a3f88fc4b9 in evaluate_join_record /test/11.0_opt_san/sql/sql_select.cc:23485
 
    #12 0x55a3f898f956 in sub_select(JOIN*, st_join_table*, bool) /test/11.0_opt_san/sql/sql_select.cc:23252
 
    #13 0x55a3f8b712e3 in do_select /test/11.0_opt_san/sql/sql_select.cc:22780
 
    #14 0x55a3f8b712e3 in JOIN::exec_inner() /test/11.0_opt_san/sql/sql_select.cc:4900
 
    #15 0x55a3f8b76743 in JOIN::exec() /test/11.0_opt_san/sql/sql_select.cc:4677
 
    #16 0x55a3f8b641f0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_opt_san/sql/sql_select.cc:5158
 
    #17 0x55a3f8b67d80 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_opt_san/sql/sql_select.cc:616
 
    #18 0x55a3f86e8b80 in execute_sqlcom_select /test/11.0_opt_san/sql/sql_parse.cc:6279
 
    #19 0x55a3f874e5f6 in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:3949
 
    #20 0x55a3f875f4d2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8014
 
    #21 0x55a3f876cf5d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894
 
    #22 0x55a3f8776728 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407
 
    #23 0x55a3f908580c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416
 
    #24 0x55a3f9087e0c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318
 
    #25 0x1539dd494b42 in start_thread nptl/pthread_create.c:442
 
 
 
SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).
 
230515 19:40:05 [ERROR] mysqld got signal 6 ;

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug)

 
==1050686==ERROR: LeakSanitizer: detected memory leaks
 
 
 
Direct leak of 32 byte(s) in 1 object(s) allocated from:
 
    #0 0x562f3ac93337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
 
    #1 0x562f3f3aa703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
 
    #2 0x562f3f3b79bb in init_dynamic_string /test/11.0_dbg_san/mysys/string.c:39
 
    #3 0x562f3f3f548b in mariadb_dyncol_json /test/11.0_dbg_san/mysys/ma_dyncol.c:4266
 
    #4 0x562f3d5e7343 in Item_func_dyncol_json::val_str(String*) /test/11.0_dbg_san/sql/item_strfunc.cc:4964
 
    #5 0x562f3c52c7af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
 
    #6 0x562f3bf75cf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
 
    #7 0x562f3ad07888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
 
    #8 0x562f3aec3e96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
 
    #9 0x562f3b28f4a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
 
    #10 0x562f3b948c34 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
 
    #11 0x562f3b948c34 in end_send /test/11.0_dbg_san/sql/sql_select.cc:24518
 
    #12 0x562f3b7a23ef in evaluate_join_record /test/11.0_dbg_san/sql/sql_select.cc:23485
 
    #13 0x562f3b869299 in sub_select(JOIN*, st_join_table*, bool) /test/11.0_dbg_san/sql/sql_select.cc:23252
 
    #14 0x562f3ba17164 in do_select /test/11.0_dbg_san/sql/sql_select.cc:22780
 
    #15 0x562f3ba17164 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4900
 
    #16 0x562f3ba18916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
 
    #17 0x562f3ba070c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
 
    #18 0x562f3ba0b51c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
 
    #19 0x562f3b57da01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
 
    #20 0x562f3b5deef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
 
    #21 0x562f3b60e973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #22 0x562f3b61e707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #23 0x562f3b62c542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #24 0x562f3c0018b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #25 0x562f3c002dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
    #26 0x14ae4b094b42 in start_thread nptl/pthread_create.c:442
 
 
 
SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).
 
230515 19:44:15 [ERROR] mysqld got signal 6 ;

Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
 
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
 
Set before execution:
 
    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.4.30 (dbg), 10.4.30 (opt), 10.5.21 (dbg), 10.5.21 (opt), 10.6.14 (dbg), 10.6.14 (opt), 10.9.7 (dbg), 10.9.7 (opt), 10.10.5 (dbg), 10.10.5 (opt), 10.11.4 (dbg), 10.11.4 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)

Also note:

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug)

 
11.0.2-dbg>SELECT COLUMN_JSON(c) FROM t;
 
ERROR 1919 (HY000): Encountered illegal format of dynamic column string



 Comments   
Comment by Roel Van de Paar [ 2023-08-09 ]

Alternative testcase

CREATE TABLE t (a INT,b INT) ENGINE=InnoDB;
 
INSERT INTO t VALUES (0,0);
 
SELECT COLUMN_JSON(b) FROM t;
 
SHUTDOWN;


LSAN|memory leak|mysys/my_malloc.c|__interceptor_malloc|my_malloc|init_dynamic_string|mariadb_dyncol_json
 
LSAN|memory leak|mysys/my_malloc.c|malloc|my_malloc|init_dynamic_string|mariadb_dyncol_json

Generated at Thu Feb 08 10:22:36 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.