[MDEV-32400] Item_ref? Heap-Use-After-Free at /mariadb-11.3.0/sql/field.h:1403 Created: 2023-10-10  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer - Window functions
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Rex Johnston
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Relates
relates to MDEV-10885 Server crashes in Field::is_null / Pr... Closed

 Description   

Run these queries in debug build:

CREATE TABLE t0 ( c60 DECIMAL ( 49 ) DEFAULT ( 37 ) ) ;
INSERT IGNORE INTO t0 VALUES ( RAND ( ) REGEXP UNHEX ( 88 ) ) , ( 100 ) ;
ALTER TABLE t0 MODIFY COLUMN c60 TINYBLOB DEFAULT ( 28 ) ;
INSERT INTO t0 VALUES ( -526864902151552948 ) , ( -107 ) ;
SELECT t1 . c46 AS c43 FROM ( SELECT c60 AS c46 FROM t0 ) AS t1 JOIN t0 ON t1 . c46 = t0 . c60 HAVING NULLIF ( 58 , QUOTE ( ( SELECT VAR_SAMP( c46 ) OVER ( ) AS c32 HAVING SQRT ( 111 ) - PI ( ) LIMIT 1 ) = 58 ) << RAND ( ) IN ( 55 , 48 , 33 ) IS TRUE ) * PI ( ) ;

Will trigger heap-use-after-free.
ASAN info:
=================================================================
==78695==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000d93c8 at pc 0x0000008ab7d5 bp 0x7fffd2429de0 sp 0x7fffd2429dd8
READ of size 8 at 0x6190000d93c8 thread T15
#0 0x8ab7d4 in Field::is_null(long long) const /home/wx/mariadb-11.3.0/sql/field.h:1403:12
#1 0x8ab7d4 in Protocol_text::store(Field*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1607:14
#2 0x8abb67 in Protocol::send_result_set_row(List<Item>*) /home/wx/mariadb-11.3.0/sql/protocol.cc:1332:15
#3 0xa1170c in select_send::send_data(List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_class.cc:3124:17
#4 0xc36f99 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_class.h:5842:12
#5 0xc36f99 in end_send(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710:9
#6 0xf8f900 in JOIN_CACHE::generate_full_extensions(unsigned char*) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2511:11
#7 0xf8f321 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2403:13
#8 0xf8e694 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158:9
#9 0xc9da16 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192:16
#10 0xc4536b in do_select(JOIN*, Procedure*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963:14
#11 0xc4536b in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941:50
#12 0xc428e8 in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718:8
#13 0xbe5127 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249:21
#14 0xbe4595 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628:10
#15 0xb3df17 in execute_sqlcom_select(THD*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013:12
#16 0xb2cd50 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912:12
#17 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#18 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#19 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#20 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#21 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#22 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#23 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#24 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6190000d93c8 is located 72 bytes inside of 1040-byte region [0x6190000d9380,0x6190000d9790)
freed by thread T15 here:
#0 0x7ca37d in free (/usr/local/mysql/bin/mariadbd+0x7ca37d)
#1 0x2290b64 in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83:5
#2 0x2290b64 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:515:7
#3 0xc3da3d in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713:3
#4 0xc485ab in JOIN::cleanup(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:16348:13
#5 0xc4747b in JOIN::join_free() /home/wx/mariadb-11.3.0/sql/sql_select.cc:16236:3
#6 0xc45afc in do_select(JOIN*, Procedure*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23008:11
#7 0xc45afc in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941:50
#8 0xc428e8 in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718:8
#9 0x15d8105 in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159:23
#10 0x15b3edb in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812:21
#11 0x15b9524 in Item_singlerow_subselect::val_real() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1441:8
#12 0x13b0dec in Arg_comparator::compare_real_fixed() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:911:15
#13 0x13b5ea1 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104:33
#14 0x13b5ea1 in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780:18
#15 0x145d5b1 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760:15
#16 0x153e826 in Item_func_quote::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:4491:25
#17 0x150bb30 in Item_str_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:147:16
#18 0x10b6a7f in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293:16
#19 0x14c3c28 in Func_handler_shift_left_decimal_to_ulonglong::to_longlong_null(Item_handled_func*) const /home/wx/mariadb-11.3.0/sql/item_func.cc:2202:12
#20 0x1413061 in Item_handled_func::Handler_int::val_int(Item_handled_func*) const /home/wx/mariadb-11.3.0/sql/item_func.h:696:26
#21 0x1318ed1 in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343:16
#22 0x13cd36c in in_decimal::get_value(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3923:29
#23 0x13d4c99 in in_vector::find(Item*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3656:17
#24 0x13d4c99 in Item_func_in::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:4744:21
#25 0x10d6cd0 in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082:16
#26 0x13b2300 in Item_func_truth::val_bool() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1179:22
#27 0x13b242d in Item_func_truth::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1202:11
#28 0x13ae2e0 in Arg_comparator::compare_int_signed() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:947:26
#29 0x13c00fb in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104:33
#30 0x13c00fb in Item_func_nullif::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:2855:14
#31 0x13c00fb in Item_func_nullif::int_op() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:2888:8
#32 0x145ddc5 in Item_func_hybrid_field_type::val_real_from_int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:827:20
#33 0x14641a3 in Item_func_mul::real_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1370:26
#34 0x145e0c7 in Item_func_hybrid_field_type::val_int_from_real_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:853:39
#35 0xc36c7c in end_send(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:24685:37

previously allocated by thread T15 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x2291217 in memdup_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:611:12
#5 0x1250974 in Field::make_new_field(st_mem_root*, TABLE*, bool) /home/wx/mariadb-11.3.0/sql/field.cc:2551:23
#6 0x1250cfc in Field::create_tmp_field(st_mem_root*, TABLE*, bool) /home/wx/mariadb-11.3.0/sql/field.cc:2608:19
#7 0xc87e72 in Item_field::create_tmp_field_from_item_field(st_mem_root*, TABLE*, Item_ref*, Tmp_field_param const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20628:20
#8 0xc881a9 in Item_field::create_tmp_field_ex(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20645:17
#9 0xc8940f in create_tmp_field(TABLE*, Item*, Item**, Field, Field*, bool, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20823:24
#10 0xc8c548 in Create_tmp_table::add_fields(THD*, TABLE*, TMP_TABLE_PARAM*, List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21261:9
#11 0xc36790 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21920:13
#12 0xc38fed in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>, st_order, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:4215:17
#13 0xc2eab9 in JOIN::make_aggr_tables_info() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3775:9
#14 0xbfc65f in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3438:9
#15 0xc13910 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650:9
#16 0xbfc155 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944:10
#17 0xab5420 in st_select_lex::optimize_unflattened_subqueries(bool) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916:31
#18 0xc0856b in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229:7
#19 0xc13910 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650:9
#20 0xbfc155 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944:10
#21 0xbe4fde in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235:19
#22 0xbe4595 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628:10
#23 0xb3df17 in execute_sqlcom_select(THD*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013:12
#24 0xb2cd50 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912:12
#25 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#26 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#27 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#28 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#29 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#30 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3

Thread T15 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/field.h:1403:12 in Field::is_null(long long) const
Shadow bytes around the buggy address:
0x0c3280013220: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280013230: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280013240: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280013250: f7 f7 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280013260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3280013270: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
0x0c3280013280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280013290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c32800132a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c32800132b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c32800132c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==78695==ABORTING

 Comments   
Comment by Alice Sherepa [ 2023-10-24 ]

Thanks! I repeated on 10.4-11.2

CREATE TABLE t1 ( a int ) ;
 
INSERT INTO t1 VALUES (1),(2),(3);
 
 
 
SELECT a  FROM (SELECT a FROM t1 )dt HAVING NULLIF( 58 ,  (( SELECT VAR_SAMP(a) OVER () HAVING 1 LIMIT 1 ) )) ;


Version: '10.4.32-MariaDB-debug-log' source revision babd833685e1fd1da4411a0874ba1c98bb0b631d 
=================================================================
 
==731877==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000f2e28 at pc 0x55b306a16d61 bp 0x7fd679487170 sp 0x7fd679487160
 
READ of size 8 at 0x6190000f2e28 thread T27
 
    #0 0x55b306a16d60 in Field::is_null(long long) const /10.4/src/sql/field.h:1198
 
    #1 0x55b306a10312 in Protocol_text::store(Field*) /10.4/src/sql/protocol.cc:1263
 
    #2 0x55b307529394 in Item_field::send(Protocol*, st_value*) /10.4/src/sql/item.cc:7306
 
    #3 0x55b3075319e0 in Item_ref::send(Protocol*, st_value*) /10.4/src/sql/item.cc:8270
 
    #4 0x55b30753b884 in Item_direct_view_ref::send(Protocol*, st_value*) /10.4/src/sql/item.cc:9038
 
    #5 0x55b306a0df62 in Protocol::send_result_set_row(List<Item>*) /10.4/src/sql/protocol.cc:1038
 
    #6 0x55b306bc0d50 in select_send::send_data(List<Item>&) /10.4/src/sql/sql_class.cc:3139
 
    #7 0x55b306e316a6 in end_send /10.4/src/sql/sql_select.cc:22098
 
    #8 0x55b306e29a54 in evaluate_join_record /10.4/src/sql/sql_select.cc:21129
 
    #9 0x55b306e28389 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20902
 
    #10 0x55b306e2612f in do_select /10.4/src/sql/sql_select.cc:20423
 
    #11 0x55b306db3c77 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4605
 
    #12 0x55b306db12a7 in JOIN::exec() /10.4/src/sql/sql_select.cc:4387
 
    #13 0x55b306db5483 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4826
 
    #14 0x55b306d85f7b in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442
 
    #15 0x55b306cf1d7f in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475
 
    #16 0x55b306cdf4f6 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978
 
    #17 0x55b306cfb25a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8012
 
    #18 0x55b306cd1680 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #19 0x55b306cce1ab in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #20 0x55b3070dc56c in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #21 0x55b3070dbe10 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
    #22 0x55b307d86d89 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #23 0x7fd690054608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
    #24 0x7fd68fc25132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x6190000f2e28 is located 168 bytes inside of 1100-byte region [0x6190000f2d80,0x6190000f31cc)
 
freed by thread T27 here:
 
    #0 0x7fd69065240f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
 
    #1 0x55b30891d7e8 in free_memory /10.4/src/mysys/safemalloc.c:279
 
    #2 0x55b30891cda4 in sf_free /10.4/src/mysys/safemalloc.c:197
 
    #3 0x55b3088eb7b3 in my_free /10.4/src/mysys/my_malloc.c:222
 
    #4 0x55b3088c7e95 in free_root /10.4/src/mysys/my_alloc.c:437
 
    #5 0x55b306e24879 in free_tmp_table(THD*, TABLE*) /10.4/src/sql/sql_select.cc:20189
 
    #6 0x55b306df905d in JOIN::cleanup(bool) /10.4/src/sql/sql_select.cc:14146
 
    #7 0x55b306df8380 in JOIN::join_free() /10.4/src/sql/sql_select.cc:14034
 
    #8 0x55b306e2675b in do_select /10.4/src/sql/sql_select.cc:20470
 
    #9 0x55b306db3c77 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4605
 
    #10 0x55b306db12a7 in JOIN::exec() /10.4/src/sql/sql_select.cc:4387
 
    #11 0x55b3076f6a0f in subselect_single_select_engine::exec() /10.4/src/sql/item_subselect.cc:4032
 
    #12 0x55b3076d1a77 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #13 0x55b3076d7526 in Item_singlerow_subselect::val_real() /10.4/src/sql/item_subselect.cc:1379
 
    #14 0x55b30756dcd2 in Arg_comparator::compare_real_fixed() /10.4/src/sql/item_cmpfunc.cc:920
 
    #15 0x55b3075b036d in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104
 
    #16 0x55b30758436d in Item_func_nullif::compare() /10.4/src/sql/item_cmpfunc.cc:2852
 
    #17 0x55b3075847c8 in Item_func_nullif::int_op() /10.4/src/sql/item_cmpfunc.cc:2885
 
    #18 0x55b30728be67 in Item_func_hybrid_field_type::val_int_from_int_op() (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x188ee67)
 
    #19 0x55b307260825 in Type_handler_int_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const /10.4/src/sql/sql_type.cc:4961
 
    #20 0x55b306ca1bee in Item_func_hybrid_field_type::val_int() /10.4/src/sql/item_func.h:805
 
    #21 0x55b306e313f9 in end_send /10.4/src/sql/sql_select.cc:22086
 
    #22 0x55b306e29a54 in evaluate_join_record /10.4/src/sql/sql_select.cc:21129
 
    #23 0x55b306e28389 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20902
 
    #24 0x55b306e2612f in do_select /10.4/src/sql/sql_select.cc:20423
 
    #25 0x55b306db3c77 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4605
 
    #26 0x55b306db12a7 in JOIN::exec() /10.4/src/sql/sql_select.cc:4387
 
    #27 0x55b306db5483 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4826
 
    #28 0x55b306d85f7b in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442
 
    #29 0x55b306cf1d7f in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7fd690652808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x55b30891c758 in sf_malloc /10.4/src/mysys/safemalloc.c:118
 
    #2 0x55b3088eacbc in my_malloc /10.4/src/mysys/my_malloc.c:101
 
    #3 0x55b3088c6c9b in alloc_root /10.4/src/mysys/my_alloc.c:258
 
    #4 0x55b3088c84fa in memdup_root /10.4/src/mysys/my_alloc.c:501
 
    #5 0x55b30740eb25 in Field::make_new_field(st_mem_root*, TABLE*, bool) /10.4/src/sql/field.cc:2374
 
    #6 0x55b30740efdc in Field::create_tmp_field(st_mem_root*, TABLE*, bool) /10.4/src/sql/field.cc:2432
 
    #7 0x55b306e12422 in Item_field::create_tmp_field_from_item_field(TABLE*, Item_ref*, Tmp_field_param const*) /10.4/src/sql/sql_select.cc:18307
 
    #8 0x55b306e1275d in Item_field::create_tmp_field_ex(TABLE*, Tmp_field_src*, Tmp_field_param const*) /10.4/src/sql/sql_select.cc:18325
 
    #9 0x55b306e139b1 in create_tmp_field(TABLE*, Item*, Item***, Field**, Field**, bool, bool, bool, bool) /10.4/src/sql/sql_select.cc:18490
 
    #10 0x55b306e16cb2 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /10.4/src/sql/sql_select.cc:18874
 
    #11 0x55b306dabc5d in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool) /10.4/src/sql/sql_select.cc:3896
 
    #12 0x55b306da74b9 in JOIN::make_aggr_tables_info() /10.4/src/sql/sql_select.cc:3484
 
    #13 0x55b306da335e in JOIN::optimize_stage2() /10.4/src/sql/sql_select.cc:3150
 
    #14 0x55b306d9b59d in JOIN::optimize_inner() /10.4/src/sql/sql_select.cc:2394
 
    #15 0x55b306d942a8 in JOIN::optimize() /10.4/src/sql/sql_select.cc:1711
 
    #16 0x55b306c6cb83 in st_select_lex::optimize_unflattened_subqueries(bool) /10.4/src/sql/sql_lex.cc:4232
 
    #17 0x55b3071df026 in JOIN::optimize_unflattened_subqueries() /10.4/src/sql/opt_subselect.cc:5610
 
    #18 0x55b306da1626 in JOIN::optimize_stage2() /10.4/src/sql/sql_select.cc:2942
 
    #19 0x55b306d9b59d in JOIN::optimize_inner() /10.4/src/sql/sql_select.cc:2394
 
    #20 0x55b306d942a8 in JOIN::optimize() /10.4/src/sql/sql_select.cc:1711
 
    #21 0x55b306db5292 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4812
 
    #22 0x55b306d85f7b in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442
 
    #23 0x55b306cf1d7f in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475
 
    #24 0x55b306cdf4f6 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978
 
    #25 0x55b306cfb25a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8012
 
    #26 0x55b306cd1680 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #27 0x55b306cce1ab in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #28 0x55b3070dc56c in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #29 0x55b3070dbe10 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7fd69057f815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x55b307d8717a in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919
 
    #2 0x55b3069c9f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55b3069e2103 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6289
 
    #4 0x55b3069e289e in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6359
 
    #5 0x55b3069e2d84 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6457
 
    #6 0x55b3069e3c40 in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6615
 
    #7 0x55b3069e1808 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5947
 
    #8 0x55b3069c7f3c in main /10.4/src/sql/main.cc:25
 
    #9 0x7fd68fb2a082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/sql/field.h:1198 in Field::is_null(long long) const
 
Shadow bytes around the buggy address:
 
  0x0c3280016570: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c3280016580: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c3280016590: f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa fa fa fa
 
  0x0c32800165a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c32800165b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c32800165c0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800165d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800165e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800165f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==731877==ABORTING
 
----------SERVER LOG END-------------

Generated at Thu Feb 08 10:31:04 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.