[MDEV-32421] Heap-Use-Sfter-Free at /mariadb-11.3.0/sql/sql_base.cc:881 Created: 2023-10-10  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 20.04


 Description   

Run these queries in debug build:

CREATE TABLE x ( x INT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE CASE WHEN 1 THEN 1 WHEN 'x' THEN 'x' WHEN 1 THEN 'x' ELSE x = ( SELECT x FROM x WHERE x IN ( SELECT x WHERE x = x OR ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT x % ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x ORDER BY x , x DESC , x , x = ( SELECT x WHERE ( SELECT x AS x WHERE 1 > x ) LIKE - ( SELECT 1 AS x ) ) IS NOT NULL , ( x = 1 AND x = 1 ) DESC ) SELECT 1 FROM x WHERE x != 'x' ) FROM x WHERE x LIKE ( x BETWEEN 1 AND 1 ) GROUP BY x HAVING x > 'x' ) SELECT x ORDER BY 1 ) OR x = 1 ) ) ) END ;

Will trigger heap-use-after-free.
ASAN info:
=================================================================
==92204==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f000016cc8 at pc 0x0000009b7615 bp 0x7fffd1c14160 sp 0x7fffd1c14158
READ of size 8 at 0x61f000016cc8 thread T16
#0 0x9b7614 in close_thread_tables(THD*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:881:20
#1 0xb31c59 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:5815:3
#2 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#3 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#4 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#5 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#6 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#7 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#8 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#9 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x61f000016cc8 is located 72 bytes inside of 3136-byte region [0x61f000016c80,0x61f0000178c0)
freed by thread T16 here:
#0 0x7ca37d in free (/usr/local/mysql/bin/mariadbd+0x7ca37d)
#1 0x22909f4 in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83:5
#2 0x22909f4 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:509:7
#3 0xc3da3d in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713:3
#4 0x9b7233 in close_thread_tables(THD*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:882:7
#5 0xb31c59 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:5815:3
#6 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#7 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#8 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#9 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#10 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#11 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#12 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

previously allocated by thread T16 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x229068a in multi_alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:412:24
#5 0xc8ae29 in Create_tmp_table::start(THD*, TMP_TABLE_PARAM*, st_mysql_const_lex_string const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21053:8
#6 0xc36773 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21919:22
#7 0xde6e5c in select_unit::create_result_table(THD*, List<Item>, bool, unsigned long long, st_mysql_const_lex_string const, bool, bool, bool, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_union.cc:354:17
#8 0xa53691 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:876:32
#9 0xa57cc1 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200:15
#10 0xe7cf8c in TABLE_LIST::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/table.cc:9651:9
#11 0xab86cb in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.h:4579:43
#12 0xab86cb in st_select_lex::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4989:15
#13 0xbf2a77 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1439:19
#14 0x15d5c2f in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3943:13
#15 0x15b1a8d in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296:22
#16 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#17 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#18 0x9d3358 in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#19 0x9d3358 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156:12
#20 0x9d3358 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>, List<Item>, bool) /home/wx/mariadb-11.3.0/sql/sql_base.cc:8061:15
#21 0xbf311b in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1526:7
#22 0xdec229 in st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long long, bool) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1103:22
#23 0xde1742 in st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1659:14
#24 0xa52e37 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:840:19
#25 0xa57cc1 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200:15
#26 0xe7cf8c in TABLE_LIST::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/table.cc:9651:9
#27 0xab86cb in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.h:4579:43
#28 0xab86cb in st_select_lex::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4989:15
#29 0xa52ab0 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:794:21
#30 0xa578e4 in mysql_handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:123:7
#31 0xe1e19e in Multiupdate_prelocking_strategy::handle_end(THD*) /home/wx/mariadb-11.3.0/sql/sql_update.cc:1549:7
#32 0x9c648f in open_tables(THD*, DDL_options_st const&, TABLE_LIST*, unsigned int, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:4747:38
#33 0x9cbaf7 in open_tables(THD*, TABLE_LIST*, unsigned int, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.h:267:10
#34 0x9cbaf7 in open_tables_for_query(THD*, TABLE_LIST*, unsigned int*, unsigned int, DML_prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:5746:7
#35 0xcc3b6a in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33256:7
#36 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9

Thread T16 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/sql_base.cc:881:20 in close_thread_tables(THD*)
Shadow bytes around the buggy address:
0x0c3e7fffad40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffad50: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c3e7fffad60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e7fffad70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e7fffad80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3e7fffad90: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
0x0c3e7fffada0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffadb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffadc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffadd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffade0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==92204==ABORTING

 Comments   
Comment by Alice Sherepa [ 2023-10-25 ]

Thanks! I repeated as described on 10.4-11.2,
on non-debug:

Version: '10.11.5-MariaDB'  
double free or corruption (out)
 
231025 15:21:28 [ERROR] mysqld got signal 6 ;
 
....

10.4

ERROR: AddressSanitizer: heap-use-after-free on address 0x6220000349a0 at pc 0x55dc69f9ac1c bp 0x7f89bad58ac0 sp 0x7f89bad58ab0
 
READ of size 8 at 0x6220000349a0 thread T27
 
    #0 0x55dc69f9ac1b in close_thread_tables(THD*) /10.4/src/sql/sql_base.cc:953
 
    #1 0x55dc6a14bf62 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:6283
 
    #2 0x55dc6a15725a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8012
 
    #3 0x55dc6a12d680 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #4 0x55dc6a12a1ab in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #5 0x55dc6a53856c in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #6 0x55dc6a537e10 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
    #7 0x55dc6b1e2d89 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #8 0x7f89d1925608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
    #9 0x7f89d14f6132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x6220000349a0 is located 160 bytes inside of 5844-byte region [0x622000034900,0x622000035fd4)
 
freed by thread T27 here:
 
    #0 0x7f89d1f2340f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
 
    #1 0x55dc6bd797e8 in free_memory /10.4/src/mysys/safemalloc.c:279
 
    #2 0x55dc6bd78da4 in sf_free /10.4/src/mysys/safemalloc.c:197
 
    #3 0x55dc6bd477b3 in my_free /10.4/src/mysys/my_malloc.c:222
 
    #4 0x55dc6bd23d8a in free_root /10.4/src/mysys/my_alloc.c:428
 
    #5 0x55dc6a280879 in free_tmp_table(THD*, TABLE*) /10.4/src/sql/sql_select.cc:20189
 
    #6 0x55dc69f9ac46 in close_thread_tables(THD*) /10.4/src/sql/sql_base.cc:954
 
    #7 0x55dc6a14bf62 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:6283
 
    #8 0x55dc6a15725a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8012
 
    #9 0x55dc6a12d680 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #10 0x55dc6a12a1ab in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #11 0x55dc6a53856c in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #12 0x55dc6a537e10 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
    #13 0x55dc6b1e2d89 in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #14 0x7f89d1925608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f89d1f23808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x55dc6bd78758 in sf_malloc /10.4/src/mysys/safemalloc.c:118
 
    #2 0x55dc6bd46cbc in my_malloc /10.4/src/mysys/my_malloc.c:101
 
    #3 0x55dc6bd22c9b in alloc_root /10.4/src/mysys/my_alloc.c:258
 
    #4 0x55dc6bd2347c in multi_alloc_root /10.4/src/mysys/my_alloc.c:332
 
    #5 0x55dc6a270ec1 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /10.4/src/sql/sql_select.cc:18689
 
    #6 0x55dc6a3f90f9 in select_unit::create_result_table(THD*, List<Item>*, bool, unsigned long long, st_mysql_const_lex_string const*, bool, bool, bool, unsigned int) /10.4/src/sql/sql_union.cc:393
 
    #7 0x55dc6a062a53 in mysql_derived_prepare /10.4/src/sql/sql_derived.cc:853
 
    #8 0x55dc6a05eb37 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /10.4/src/sql/sql_derived.cc:200
 
    #9 0x55dc6a48b886 in TABLE_LIST::handle_derived(LEX*, unsigned int) /10.4/src/sql/table.cc:9097
 
    #10 0x55dc6a0a7031 in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /10.4/src/sql/sql_lex.h:4395
 
    #11 0x55dc6a0c90d0 in st_select_lex::handle_derived(LEX*, unsigned int) /10.4/src/sql/sql_lex.cc:4305
 
    #12 0x55dc6a1ea167 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.4/src/sql/sql_select.cc:1243
 
    #13 0x55dc6ab504a5 in subselect_single_select_engine::prepare(THD*) /10.4/src/sql/item_subselect.cc:3815
 
    #14 0x55dc6ab2a1a0 in Item_subselect::fix_fields(THD*, Item**) /10.4/src/sql/item_subselect.cc:289
 
    #15 0x55dc69e975cc in Item::fix_fields_if_needed(THD*, Item**) /10.4/src/sql/item.h:966
 
    #16 0x55dc6aa54f55 in Item_func::fix_fields(THD*, Item**) /10.4/src/sql/item_func.cc:355
 
    #17 0x55dc69e975cc in Item::fix_fields_if_needed(THD*, Item**) /10.4/src/sql/item.h:966
 
    #18 0x55dc69e97606 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x103e606)
 
    #19 0x55dc69fc0ed2 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool) /10.4/src/sql/sql_base.cc:7745
 
    #20 0x55dc6a1eb404 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.4/src/sql/sql_select.cc:1330
 
    #21 0x55dc6a3fb989 in st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long, bool) /10.4/src/sql/sql_union.cc:662
 
    #22 0x55dc6a3ffd10 in st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long) /10.4/src/sql/sql_union.cc:1089
 
    #23 0x55dc6a062766 in mysql_derived_prepare /10.4/src/sql/sql_derived.cc:824
 
    #24 0x55dc6a05eb37 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /10.4/src/sql/sql_derived.cc:200
 
    #25 0x55dc6a48b886 in TABLE_LIST::handle_derived(LEX*, unsigned int) /10.4/src/sql/table.cc:9097
 
    #26 0x55dc6a0a7031 in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /10.4/src/sql/sql_lex.h:4395
 
    #27 0x55dc6a0c90d0 in st_select_lex::handle_derived(LEX*, unsigned int) /10.4/src/sql/sql_lex.cc:4305
 
    #28 0x55dc6a0620af in mysql_derived_prepare /10.4/src/sql/sql_derived.cc:778
 
    #29 0x55dc6a05e308 in mysql_handle_derived(LEX*, unsigned int) /10.4/src/sql/sql_derived.cc:123
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f89d1e50815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x55dc6b1e317a in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919
 
    #2 0x55dc69e25f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55dc69e3e103 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6289
 
    #4 0x55dc69e3e89e in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6359
 
    #5 0x55dc69e3ed84 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6457
 
    #6 0x55dc69e3fc40 in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6615
 
    #7 0x55dc69e3d808 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5947
 
    #8 0x55dc69e23f3c in main /10.4/src/sql/main.cc:25
 
    #9 0x7f89d13fb082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/sql/sql_base.cc:953 in close_thread_tables(THD*)
 
Shadow bytes around the buggy address:
 
  0x0c447fffe8e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447fffe8f0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
 
  0x0c447fffe900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c447fffe910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c447fffe920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c447fffe930: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447fffe940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447fffe950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447fffe960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447fffe970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447fffe980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1205417==ABORTING
 
----------SERVER LOG END-------------

Generated at Thu Feb 08 10:31:14 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.