[MDEV-32398] Use-After-Poison at /mariadb-11.3.0/sql/field_conv.cc:619 Created: 2023-10-10  Updated: 2023-10-13  Resolved: 2023-10-13

Status: Closed
Project: MariaDB Server
Component/s: Optimizer, Server
Affects Version/s: 11.3.0
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Duplicate
duplicates MDEV-29210 Assertion `param->field_count > (uint... Confirmed

 Description   

Run these queries in debug build:

CREATE TABLE t0 ( c39 INT , c45 SMALLINT ) ;
INSERT INTO t0 VALUES ( -1 , 86 NOT LIKE CASE WHEN 78 THEN RAND ( ) + EXISTS ( SELECT c45 AS c45 FROM ( SELECT CASE c39 WHEN 2729039170178489003 THEN 24 ELSE 115 END IS TRUE AS c57 FROM t0 ) AS t1 GROUP BY c57 , c57 , c57 WITH ROLLUP HAVING REVERSE ( ~ FORMAT ( -1745216741589043951 = IF ( -35 , 21 , -3 ) IN ( 23 = RAND ( ) & TRIM( TRAILING FROM 77 ) IS NULL ) , -11 ) ) AND CONVERT ( -17 , UNSIGNED ) ) ^ RAND ( ) IS NOT NULL ELSE -127 END ) , ( -43 , 94 ) ;

Will trigger use-after-poison.
ASAN info:
=================================================================
==77203==ERROR: AddressSanitizer: use-after-poison on address 0x6290000bb1a0 at pc 0x0000012bb20b bp 0x7fffd24297c0 sp 0x7fffd24297b8
WRITE of size 8 at 0x6290000bb1a0 thread T15
#0 0x12bb20a in Copy_field::set(unsigned char*, Field*) /home/wx/mariadb-11.3.0/sql/field_conv.cc:619:11
#1 0xc3c28c in setup_copy_fields(THD*, TMP_TABLE_PARAM*, Bounds_checked_array<Item*>, List<Item>&, List<Item>&, unsigned int, List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_select.cc:28337:17
#2 0xc2e2f1 in JOIN::make_aggr_tables_info() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4023:5
#3 0xc08b1b in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3397:7
#4 0xc13910 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650:9
#5 0xbfc155 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944:10
#6 0xab5420 in st_select_lex::optimize_unflattened_subqueries(bool) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916:31
#7 0xa688a5 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /home/wx/mariadb-11.3.0/sql/sql_insert.cc:875:38
#8 0xb36565 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4417:10
#9 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#10 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#11 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#12 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#13 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#14 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#15 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#16 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6290000bb1a0 is located 8096 bytes inside of 16400-byte region [0x6290000b9200,0x6290000bd210)
allocated by thread T15 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x229068a in multi_alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:412:24
#5 0xc14981 in make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5464:8
#6 0xc14981 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2624:7
#7 0xbfc155 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944:10
#8 0xab5420 in st_select_lex::optimize_unflattened_subqueries(bool) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916:31
#9 0xa688a5 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /home/wx/mariadb-11.3.0/sql/sql_insert.cc:875:38
#10 0xb36565 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4417:10
#11 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#12 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#13 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#14 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#15 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#16 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#17 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

Thread T15 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison /home/wx/mariadb-11.3.0/sql/field_conv.cc:619:11 in Copy_field::set(unsigned char*, Field*)
Shadow bytes around the buggy address:
0x0c528000f5e0: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
0x0c528000f5f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c528000f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c528000f610: 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 f7 04
0x0c528000f620: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c528000f630: 00 00 00 00[f7]00 00 00 00 00 00 00 00 00 00 00
0x0c528000f640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c528000f650: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
0x0c528000f660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c528000f670: 00 00 00 00 f7 06 f7 00 00 f7 00 00 00 00 00 00
0x0c528000f680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==77203==ABORTING

And will trigger Segmentation fault in release build.
GDB info:
Thread 17 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe011a700 (LWP 45725)]
0x0000000000000000 in ?? ()

#0 0x0000000000000000 in ?? ()
#1 0x0000555555ddc418 in JOIN::make_sum_func_list (this=this@entry=0x7fff9801e2d0,
field_list=..., send_result_set_metadata=..., before_group_by=before_group_by@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:28498
#2 0x0000555555dde95e in JOIN::make_aggr_tables_info (this=this@entry=0x7fff9801e2d0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4038
#3 0x0000555555deacd9 in JOIN::optimize_stage2 (this=this@entry=0x7fff9801e2d0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3397
#4 0x0000555555ded98c in JOIN::optimize_inner (this=this@entry=0x7fff9801e2d0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#5 0x0000555555defccd in JOIN::optimize (this=this@entry=0x7fff9801e2d0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#6 0x0000555555d4db06 in st_select_lex::optimize_unflattened_subqueries (
this=0x7fff98013798, const_only=const_only@entry=false)
at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
#7 0x0000555555d3dfd6 in mysql_insert (thd=thd@entry=0x7fff98000c58,
table_list=<optimized out>, fields=..., values_list=..., update_fields=...,
update_values=..., duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_lex.h:985
#8 0x0000555555d79972 in mysql_execute_command (thd=thd@entry=0x7fff98000c58,
is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4417
#9 0x0000555555d68c27 in mysql_parse (thd=0x7fff98000c58, rawbuf=<optimized out>,
length=<optimized out>, parser_state=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#10 0x0000555555d74fdd in dispatch_command (command=command@entry=COM_QUERY,
thd=thd@entry=0x7fff98000c58,
packet=packet@entry=0x7fff98008509 "INSERT INTO t0 VALUES ( -1 , 86 NOT LIKE CASE WHEN 78 THEN RAND ( ) + EXISTS ( SELECT c45 AS c45 FROM ( SELECT CASE c39 WHEN 2729039170178489003 THEN 24 ELSE 115 END IS TRUE AS c57 FROM t0 ) AS t1 GRO"...,
packet_length=packet_length@entry=458, blocking=blocking@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_class.h:251
#11 0x0000555555d7721e in do_command (thd=0x7fff98000c58, blocking=blocking@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#12 0x0000555555e9a617 in do_handle_one_connection (connect=<optimized out>,
connect@entry=0x555557e0ce08, put_in_cache=put_in_cache@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#13 0x0000555555e9a94d in handle_one_connection (arg=arg@entry=0x555557e0ce08)
at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#14 0x00005555561e658d in pfs_spawn_thread (arg=0x555557db6698)
-Type <RET> for more, q to quit, c to continue without paging-c
at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#15 0x00007ffff7b48609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#16 0x00007ffff7719133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

 Comments   
Comment by Alice Sherepa [ 2023-10-13 ]

Thanks! This is the same bug as MDEV-29210

Version: '10.5.23-MariaDB-debug-log'  
mariadbd: /10.5/src/sql/sql_select.cc:25974: bool setup_copy_fields(THD*, TMP_TABLE_PARAM*, Ref_ptr_array, List<Item>&, List<Item>&, uint, List<Item>&): Assertion `param->field_count > (uint) (copy - copy_start)' failed.
 
231013 18:34:50 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.5.23-MariaDB-debug-log source revision: b04af64882f233e3937f729aac321de504db3f63
 
 
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f29b6efbfd6]
 
sql/sql_select.cc:25975(setup_copy_fields(THD*, TMP_TABLE_PARAM*, Bounds_checked_array<Item*>, List<Item>&, List<Item>&, unsigned int, List<Item>&))[0x5576747e4040]
 
sql/sql_select.cc:3732(JOIN::make_aggr_tables_info())[0x55767473eeb9]
 
sql/sql_select.cc:3105(JOIN::optimize_stage2())[0x557674737ad1]
 
sql/sql_select.cc:2389(JOIN::optimize_inner())[0x557674730337]
 
sql/sql_select.cc:1721(JOIN::optimize())[0x557674729505]
 
sql/sql_lex.cc:4848(st_select_lex::optimize_unflattened_subqueries(bool))[0x5576745f6490]
 
sql/sql_insert.cc:850(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x5576745a715f]
 
sql/sql_parse.cc:4641(mysql_execute_command(THD*))[0x55767467322d]
 
sql/sql_parse.cc:8120(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55767468b977]
 
sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5576746613a5]
 
sql/sql_parse.cc:1375(do_command(THD*))[0x55767465dd0d]
 
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x557674abc95b]
 
sql/sql_connect.cc:1320(handle_one_connection)[0x557674abc2bf]
 
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x557675748aba]
 
nptl/pthread_create.c:478(start_thread)[0x7f29b7416609]
 
 
 
Query (0x62b0000852a8): INSERT INTO t0 VALUES ( -1 , 86 NOT LIKE CASE WHEN 78 THEN RAND ( ) + EXISTS ( SELECT c45 AS c45 FROM ( SELECT CASE c39 WHEN 2729039170178489003 THEN 24 ELSE 115 END IS TRUE AS c57 FROM t0 ) AS t1 GROUP BY c57 , c57 , c57 WITH ROLLUP HAVING REVERSE ( ~ FORMAT ( -1745216741589043951 = IF ( -35 , 21 , -3 ) IN ( 23 = RAND ( ) & TRIM( TRAILING FROM 77 ) IS NULL ) , -11 ) ) AND CONVERT ( -17 , UNSIGNED ) ) ^ RAND ( ) IS NOT NULL ELSE -127 END ) , ( -43 , 94 )
 
 

Generated at Thu Feb 08 10:31:03 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.