==2702050==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250000ff128 at pc 0x7fdb3d3f0688 bp 0x7fdb3dfa8830 sp 0x7fdb3dfa8828
|
READ of size 1 at 0x6250000ff128 thread T5
|
#0 0x7fdb3d3f0687 in filter_query_type /data/bld/10.4-asan/plugin/server_audit/server_audit.c:1673
|
#1 0x7fdb3d3f1378 in log_statement_ex /data/bld/10.4-asan/plugin/server_audit/server_audit.c:1847
|
#2 0x7fdb3d3f17ab in log_statement /data/bld/10.4-asan/plugin/server_audit/server_audit.c:1892
|
#3 0x7fdb3d3f3da1 in auditing /data/bld/10.4-asan/plugin/server_audit/server_audit.c:2183
|
#4 0x55c838422252 in plugins_dispatch /data/bld/10.4-asan/sql/sql_audit.cc:399
|
#5 0x55c8384224bb in mysql_audit_notify(THD*, unsigned int, void const*) /data/bld/10.4-asan/sql/sql_audit.cc:438
|
#6 0x55c83801d49d in mysql_audit_general /data/bld/10.4-asan/sql/sql_audit.h:192
|
#7 0x55c83802c59f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:2453
|
#8 0x55c838025650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
|
#9 0x55c83842bd14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
|
#10 0x55c83842b62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
|
#11 0x55c83909026b in pfs_spawn_thread /data/bld/10.4-asan/storage/perfschema/pfs.cc:1869
|
#12 0x7fdb470a8043 in start_thread nptl/pthread_create.c:442
|
#13 0x7fdb4712861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
|
0x6250000ff128 is located 40 bytes inside of 8160-byte region [0x6250000ff100,0x6250001010e0)
|
freed by thread T5 here:
|
#0 0x7fdb476b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
|
#1 0x55c839bccb71 in my_free /data/bld/10.4-asan/mysys/my_malloc.c:222
|
#2 0x55c839baa1f4 in free_root /data/bld/10.4-asan/mysys/my_alloc.c:437
|
#3 0x55c837de5829 in sp_head::execute(THD*, bool) /data/bld/10.4-asan/sql/sp_head.cc:1459
|
#4 0x55c837deb227 in sp_head::execute_procedure(THD*, List<Item>*) /data/bld/10.4-asan/sql/sp_head.cc:2407
|
#5 0x55c83802fe2e in do_execute_sp /data/bld/10.4-asan/sql/sql_parse.cc:3064
|
#6 0x55c838044682 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:5873
|
#7 0x55c838052a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060
|
#8 0x55c838028ae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857
|
#9 0x55c838025650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
|
#10 0x55c83842bd14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
|
#11 0x55c83842b62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
|
#12 0x55c83909026b in pfs_spawn_thread /data/bld/10.4-asan/storage/perfschema/pfs.cc:1869
|
#13 0x7fdb470a8043 in start_thread nptl/pthread_create.c:442
|
|
previously allocated by thread T5 here:
|
#0 0x7fdb476b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
|
#1 0x55c839bcbfd2 in my_malloc /data/bld/10.4-asan/mysys/my_malloc.c:101
|
#2 0x55c839ba9064 in alloc_root /data/bld/10.4-asan/mysys/my_alloc.c:258
|
#3 0x55c8380648b8 in Query_arena::memdup_w_gap(void const*, unsigned long, unsigned long) /data/bld/10.4-asan/sql/sql_class.h:1139
|
#4 0x55c83802e15c in alloc_query(THD*, char const*, unsigned long) /data/bld/10.4-asan/sql/sql_parse.cc:2759
|
#5 0x55c837df3a13 in sp_instr_stmt::execute(THD*, unsigned int*) /data/bld/10.4-asan/sql/sp_head.cc:3654
|
#6 0x55c837de515a in sp_head::execute(THD*, bool) /data/bld/10.4-asan/sql/sp_head.cc:1372
|
#7 0x55c837deb227 in sp_head::execute_procedure(THD*, List<Item>*) /data/bld/10.4-asan/sql/sp_head.cc:2407
|
#8 0x55c83802fe2e in do_execute_sp /data/bld/10.4-asan/sql/sql_parse.cc:3064
|
#9 0x55c838044682 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:5873
|
#10 0x55c838052a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060
|
#11 0x55c838028ae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857
|
#12 0x55c838025650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
|
#13 0x55c83842bd14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
|
#14 0x55c83842b62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
|
#15 0x55c83909026b in pfs_spawn_thread /data/bld/10.4-asan/storage/perfschema/pfs.cc:1869
|
#16 0x7fdb470a8043 in start_thread nptl/pthread_create.c:442
|
|
Thread T5 created by T0 here:
|
#0 0x7fdb47649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x55c839090658 in spawn_thread_v1 /data/bld/10.4-asan/storage/perfschema/pfs.cc:1919
|
#2 0x55c837d2cf89 in inline_mysql_thread_create /data/bld/10.4-asan/include/mysql/psi/mysql_thread.h:1275
|
#3 0x55c837d44714 in create_thread_to_handle_connection(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6296
|
#4 0x55c837d44e5f in create_new_thread(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6366
|
#5 0x55c837d4532d in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.4-asan/sql/mysqld.cc:6464
|
#6 0x55c837d461d9 in handle_connections_sockets() /data/bld/10.4-asan/sql/mysqld.cc:6622
|
#7 0x55c837d43e77 in mysqld_main(int, char**) /data/bld/10.4-asan/sql/mysqld.cc:5954
|
#8 0x55c837d2b0b8 in main /data/bld/10.4-asan/sql/main.cc:25
|
#9 0x7fdb470461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/10.4-asan/plugin/server_audit/server_audit.c:1673 in filter_query_type
|
Shadow bytes around the buggy address:
|
0x0c4a80017dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4a80017de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4a80017df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4a80017e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4a80017e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
=>0x0c4a80017e20: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
|
0x0c4a80017e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c4a80017e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c4a80017e50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c4a80017e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c4a80017e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==2702050==ABORTING
|