[MDEV-32721] Heap-Use-After-Free at /mariadb-11.3.0/sql/item.cc:882 Created: 2023-11-07  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 20.04


 Description   

Run these queries in debug build:

CREATE TABLE x ( x INT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE x = 1 ;
INSERT INTO x ( x ) VALUES ( 1 ) , ( 1 ) ;
WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x ) SELECT x - x , x + x FROM x WHERE x IS NULL AND x IS NULL GROUP BY x HAVING ( SELECT CASE WHEN x = 1 THEN 1 ELSE x + 1 END , x FROM x GROUP BY x + 1 , 1 NOT IN ( SELECT 1.000000 ^ 1.000000 FROM x WHERE 'x' * ( x LIKE 'x' ) > 'x' * 1 + x GROUP BY x ) ) NOT IN ( SELECT x , x FROM x GROUP BY 1 HAVING 1.000000 + 1.000000 ) ORDER BY x DESC LIMIT 1 ;

Will trigger heap-use-after-free.
ASAN info:
=================================================================
==62215==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a0003938f0 at pc 0x555557b74402 bp 0x7fffd192b040 sp 0x7fffd192b030
READ of size 8 at 0x61a0003938f0 thread T15
#0 0x555557b74401 in Item_field::register_field_in_read_map(void*) /home/wx/mariadb-11.3.0/sql/item.cc:882
#1 0x555556e15d98 in Item::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:2128
#2 0x5555578eb76f in Item_cache::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:7199
#3 0x5555578eb76f in Item_cache::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:7199
#4 0x555557033611 in Item_ref::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:5702
#5 0x555556ea6750 in Item_args::walk_args(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:2796
#6 0x555556ea77b4 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:5496
#7 0x555557c154d8 in Item_cond::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5202
#8 0x555556ea6750 in Item_args::walk_args(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:2796
#9 0x555556ea77b4 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:5496
#10 0x555557c154d8 in Item_cond::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5202
#11 0x555557da8e06 in Item_subselect::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:752
#12 0x555557de436d in Item_in_subselect::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item_subselect.h:757
#13 0x555556ea6750 in Item_args::walk_args(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:2796
#14 0x555556ea77b4 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:5496
#15 0x555557bd1789 in Item_cache_wrapper::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:5992
#16 0x555556ea6750 in Item_args::walk_args(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:2796
#17 0x555556ea77b4 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) /home/wx/mariadb-11.3.0/sql/item.h:5496
#18 0x555557aff091 in find_all_keys /home/wx/mariadb-11.3.0/sql/filesort.cc:945
#19 0x555557afab65 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /home/wx/mariadb-11.3.0/sql/filesort.cc:408
#20 0x5555573791c2 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:26843
#21 0x5555573677dc in st_join_table::sort_table() /home/wx/mariadb-11.3.0/sql/sql_select.cc:24485
#22 0x555557366bdb in join_init_read_record(st_join_table*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:24405
#23 0x5555573a1fcd in AGGR_OP::end_send() /home/wx/mariadb-11.3.0/sql/sql_select.cc:32319
#24 0x55555735ebd7 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23128
#25 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#26 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#27 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#28 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#29 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#30 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#31 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#32 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#33 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#34 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#35 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#36 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#37 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#38 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#39 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#40 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x61a0003938f0 is located 624 bytes inside of 1156-byte region [0x61a000393680,0x61a000393b04)
freed by thread T15 here:
#0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297
#2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203
#3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217
#4 0x555558edf55d in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83
#5 0x555558ee1e27 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:509
#6 0x55555735c1ac in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713
#7 0x55555732c895 in JOIN::cleanup(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:16348
#8 0x55555732bbb0 in JOIN::join_free() /home/wx/mariadb-11.3.0/sql/sql_select.cc:16236
#9 0x55555735e108 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:23008
#10 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#11 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#12 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
#13 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#14 0x555557daf3d2 in Item_singlerow_subselect::bring_value() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1420
#15 0x555557bc8575 in Item_cache_row::cache_value() /home/wx/mariadb-11.3.0/sql/item.cc:10646
#16 0x555557bf1835 in Item_in_optimizer::fix_left(THD*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1362
#17 0x555557dc7a5e in Item_in_subselect::select_in_like_transformer(JOIN*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3476
#18 0x555557dc031e in Item_in_subselect::select_transformer(JOIN*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:2774
#19 0x55555779104f in check_and_do_in_subquery_rewrites(JOIN*) /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:794
#20 0x5555572b7f1b in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1631
#21 0x555557dcc18d in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3943
#22 0x555557da5ca4 in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296
#23 0x555557dc8ea6 in Item_in_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3602
#24 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
#25 0x555557c6c9f1 in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349
#26 0x555557c20fbd in Item_func_not::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:6558
#27 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
#28 0x555556f04088 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156
#29 0x55555703235a in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160

previously allocated by thread T15 here:
#0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126
#2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89
#3 0x555558edf4d5 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71
#4 0x555558ee0d78 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339
#5 0x5555573ac1ac in Field::operator new(unsigned long, st_mem_root*) /home/wx/mariadb-11.3.0/sql/field.h:771
#6 0x5555578c76ab in Type_handler_long::make_table_field_from_def(TABLE_SHARE*, st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Bit_addr const&, Column_definition_attributes const*, unsigned int) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:8138
#7 0x5555578acfef in Type_handler_int_result::make_table_field(st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE_SHARE*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:3573
#8 0x5555578acd0a in Type_handler::make_and_init_table_field(st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:3558
#9 0x555557346c00 in Item_result_field::create_tmp_field_ex_from_handler(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*, Type_handler const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20737
#10 0x555556ea70b9 in Item_result_field::create_tmp_field_ex(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*) /home/wx/mariadb-11.3.0/sql/item.h:3478
#11 0x555557347540 in create_tmp_field(TABLE*, Item*, Item**, Field, Field*, bool, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20823
#12 0x55555734c152 in Create_tmp_table::add_fields(THD*, TABLE*, TMP_TABLE_PARAM*, List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21261
#13 0x555557355331 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21920
#14 0x5555572d3c99 in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>, st_order, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:4215
#15 0x5555572cf218 in JOIN::make_aggr_tables_info() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3775
#16 0x5555572ca92f in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3397
#17 0x5555572c2f33 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#18 0x5555572bbba5 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#19 0x555557dcd490 in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4075
#20 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#21 0x555557daf3d2 in Item_singlerow_subselect::bring_value() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1420
#22 0x555557bc8575 in Item_cache_row::cache_value() /home/wx/mariadb-11.3.0/sql/item.cc:10646
#23 0x555557bf1835 in Item_in_optimizer::fix_left(THD*) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1362
#24 0x555557dc7a5e in Item_in_subselect::select_in_like_transformer(JOIN*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3476
#25 0x555557dc031e in Item_in_subselect::select_transformer(JOIN*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:2774
#26 0x55555779104f in check_and_do_in_subquery_rewrites(JOIN*) /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:794
#27 0x5555572b7f1b in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1631
#28 0x555557dcc18d in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3943
#29 0x555557da5ca4 in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296

Thread T15 created by T0 here:
#0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
#2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
#3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
#4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
#5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
#6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
#7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
#8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
#9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
#10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/item.cc:882 in Item_field::register_field_in_read_map(void*)
Shadow bytes around the buggy address:
0x0c348006a6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c348006a6d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a6e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a6f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c348006a710: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
0x0c348006a720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c348006a760: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==62215==ABORTING

 Comments   
Comment by Alice Sherepa [ 2023-11-08 ]

Thanks!
Repeatable on 10.4-11.2

Version: '10.4.32-MariaDB-debug-log'  5c5123dfe0ae0d162f135a43095dade008972b97
 
=================================================================
 
==553156==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000f75f0 at pc 0x55748ed502ba bp 0x7efdef29f8c0 sp 0x7efdef29f8b0
 
READ of size 8 at 0x6190000f75f0 thread T27
 
    #0 0x55748ed502b9 in Item_field::register_field_in_read_map(void*) /10.4/src/sql/item.cc:849
 
    #1 0x55748e279110 in Item::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:1873
 
    #2 0x55748eaf0fc8 in Item_cache::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:6981
 
    #3 0x55748eaf0fc8 in Item_cache::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:6981
 
    #4 0x55748e3d1365 in Item_ref::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:5495
 
    #5 0x55748e3cee34 in Item_args::walk_args(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:2603
 
    #6 0x55748e3cfdcd in Item_func_or_sum::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:5300
 
    #7 0x55748edf4d1c in Item_cond::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item_cmpfunc.cc:5038
 
    #8 0x55748e3cee34 in Item_args::walk_args(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:2603
 
    #9 0x55748e3cfdcd in Item_func_or_sum::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:5300
 
    #10 0x55748edf4d1c in Item_cond::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item_cmpfunc.cc:5038
 
    #11 0x55748ef2ddce in Item_subselect::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item_subselect.cc:698
 
    #12 0x55748ef694d9 in Item_in_subselect::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item_subselect.h:759
 
    #13 0x55748e3cee34 in Item_args::walk_args(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:2603
 
    #14 0x55748e3cfdcd in Item_func_or_sum::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:5300
 
    #15 0x55748edaf359 in Item_cache_wrapper::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:5794
 
    #16 0x55748e3cee34 in Item_args::walk_args(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:2603
 
    #17 0x55748e3cfdcd in Item_func_or_sum::walk(bool (Item::*)(void*), bool, void*) /10.4/src/sql/item.h:5300
 
    #18 0x55748ecebaaf in find_all_keys /10.4/src/sql/filesort.cc:767
 
    #19 0x55748ece7bd0 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /10.4/src/sql/filesort.cc:262
 
    #20 0x55748e69cfb8 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /10.4/src/sql/sql_select.cc:24246
 
    #21 0x55748e68b3d6 in st_join_table::sort_table() /10.4/src/sql/sql_select.cc:21910
 
    #22 0x55748e68a8d8 in join_init_read_record(st_join_table*) /10.4/src/sql/sql_select.cc:21849
 
    #23 0x55748e6c6960 in AGGR_OP::end_send() /10.4/src/sql/sql_select.cc:29716
 
    #24 0x55748e682e5e in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20621
 
    #25 0x55748e683959 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867
 
    #26 0x55748e682059 in do_select /10.4/src/sql/sql_select.cc:20445
 
    #27 0x55748e60fa9b in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #28 0x55748e60d0cb in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #29 0x55748e6112a7 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846
 
    #30 0x55748e5e1b1d in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442
 
    #31 0x55748e54d885 in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475
 
    #32 0x55748e53affc in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978
 
    #33 0x55748e556dc4 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8013
 
    #34 0x55748e52d186 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #35 0x55748e529cb1 in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #36 0x55748e9395b4 in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1420
 
    #37 0x55748e938e58 in handle_one_connection /10.4/src/sql/sql_connect.cc:1324
 
    #38 0x55748f5d547d in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #39 0x7efe05e70608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
    #40 0x7efe05a41132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x6190000f75f0 is located 624 bytes inside of 1100-byte region [0x6190000f7380,0x6190000f77cc)
 
freed by thread T27 here:
 
    #0 0x7efe0646e40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
 
    #1 0x55749015ca5a in free_memory /10.4/src/mysys/safemalloc.c:279
 
    #2 0x55749015c016 in sf_free /10.4/src/mysys/safemalloc.c:197
 
    #3 0x55749012ac0e in my_free /10.4/src/mysys/my_malloc.c:222
 
    #4 0x557490107954 in free_root /10.4/src/mysys/my_alloc.c:437
 
    #5 0x55748e68069d in free_tmp_table(THD*, TABLE*) /10.4/src/sql/sql_select.cc:20209
 
    #6 0x55748e654e81 in JOIN::cleanup(bool) /10.4/src/sql/sql_select.cc:14166
 
    #7 0x55748e6541a4 in JOIN::join_free() /10.4/src/sql/sql_select.cc:14054
 
    #8 0x55748e68257f in do_select /10.4/src/sql/sql_select.cc:20490
 
    #9 0x55748e60fa9b in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #10 0x55748e60d0cb in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #11 0x55748ef53b7b in subselect_single_select_engine::exec() /10.4/src/sql/item_subselect.cc:4032
 
    #12 0x55748ef2ebe3 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #13 0x55748ef34252 in Item_singlerow_subselect::bring_value() /10.4/src/sql/item_subselect.cc:1358
 
    #14 0x55748eda56e0 in Item_cache_row::cache_value() /10.4/src/sql/item.cc:10511
 
    #15 0x55748edcff8b in Item_in_optimizer::fix_left(THD*) /10.4/src/sql/item_cmpfunc.cc:1369
 
    #16 0x55748ef4cf8a in Item_in_subselect::select_in_like_transformer(JOIN*) /10.4/src/sql/item_subselect.cc:3351
 
    #17 0x55748ef45910 in Item_in_subselect::select_transformer(JOIN*) /10.4/src/sql/item_subselect.cc:2659
 
    #18 0x55748ea166ce in check_and_do_in_subquery_rewrites(JOIN*) /10.4/src/sql/opt_subselect.cc:750
 
    #19 0x55748e5ec91e in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.4/src/sql/sql_select.cc:1454
 
    #20 0x55748ef51611 in subselect_single_select_engine::prepare(THD*) /10.4/src/sql/item_subselect.cc:3815
 
    #21 0x55748ef2b30c in Item_subselect::fix_fields(THD*, Item**) /10.4/src/sql/item_subselect.cc:289
 
    #22 0x55748ef4e3d4 in Item_in_subselect::fix_fields(THD*, Item**) /10.4/src/sql/item_subselect.cc:3477
 
    #23 0x55748e2965e4 in Item::fix_fields_if_needed(THD*, Item**) /10.4/src/sql/item.h:966
 
    #24 0x55748ee560cd in Item_func::fix_fields(THD*, Item**) /10.4/src/sql/item_func.cc:355
 
    #25 0x55748ee01012 in Item_func_not::fix_fields(THD*, Item**) /10.4/src/sql/item_cmpfunc.cc:6436
 
    #26 0x55748e2965e4 in Item::fix_fields_if_needed(THD*, Item**) /10.4/src/sql/item.h:966
 
    #27 0x55748e29661e in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /10.4/src/sql/item.h:970
 
    #28 0x55748e3ceb32 in Item::fix_fields_if_needed_for_bool(THD*, Item**) /10.4/src/sql/item.h:974
 
    #29 0x55748e5ec168 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.4/src/sql/sql_select.cc:1412
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7efe0646e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x55749015b9ca in sf_malloc /10.4/src/mysys/safemalloc.c:118
 
    #2 0x55749012a117 in my_malloc /10.4/src/mysys/my_malloc.c:101
 
    #3 0x55749010675a in alloc_root /10.4/src/mysys/my_alloc.c:258
 
    #4 0x55748e6cb1b6 in Field::operator new(unsigned long, st_mem_root*) /10.4/src/sql/field.h:636
 
    #5 0x55748eab4356 in Type_handler_long::make_table_field(st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE*) const /10.4/src/sql/sql_type.cc:3209
 
    #6 0x55748eab3d29 in Type_handler::make_and_init_table_field(st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE*) const /10.4/src/sql/sql_type.cc:3156
 
    #7 0x55748e276f35 in Item::tmp_table_field_from_field_type(TABLE*) /10.4/src/sql/item.h:809
 
    #8 0x55748e66f155 in Item_result_field::create_tmp_field_ex(TABLE*, Tmp_field_src*, Tmp_field_param const*) /10.4/src/sql/sql_select.cc:18431
 
    #9 0x55748e66f7d5 in create_tmp_field(TABLE*, Item*, Item***, Field**, Field**, bool, bool, bool, bool) /10.4/src/sql/sql_select.cc:18510
 
    #10 0x55748e672ad6 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /10.4/src/sql/sql_select.cc:18894
 
    #11 0x55748e607a81 in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool) /10.4/src/sql/sql_select.cc:3916
 
    #12 0x55748e6032dd in JOIN::make_aggr_tables_info() /10.4/src/sql/sql_select.cc:3504
 
    #13 0x55748e5feb6d in JOIN::optimize_stage2() /10.4/src/sql/sql_select.cc:3128
 
    #14 0x55748e5f73c1 in JOIN::optimize_inner() /10.4/src/sql/sql_select.cc:2414
 
    #15 0x55748e5f00cc in JOIN::optimize() /10.4/src/sql/sql_select.cc:1731
 
    #16 0x55748ef528e3 in subselect_single_select_engine::exec() /10.4/src/sql/item_subselect.cc:3948
 
    #17 0x55748ef2ebe3 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #18 0x55748ef34252 in Item_singlerow_subselect::bring_value() /10.4/src/sql/item_subselect.cc:1358
 
    #19 0x55748eda56e0 in Item_cache_row::cache_value() /10.4/src/sql/item.cc:10511
 
    #20 0x55748edcff8b in Item_in_optimizer::fix_left(THD*) /10.4/src/sql/item_cmpfunc.cc:1369
 
    #21 0x55748ef4cf8a in Item_in_subselect::select_in_like_transformer(JOIN*) /10.4/src/sql/item_subselect.cc:3351
 
    #22 0x55748ef45910 in Item_in_subselect::select_transformer(JOIN*) /10.4/src/sql/item_subselect.cc:2659
 
    #23 0x55748ea166ce in check_and_do_in_subquery_rewrites(JOIN*) /10.4/src/sql/opt_subselect.cc:750
 
    #24 0x55748e5ec91e in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.4/src/sql/sql_select.cc:1454
 
    #25 0x55748ef51611 in subselect_single_select_engine::prepare(THD*) /10.4/src/sql/item_subselect.cc:3815
 
    #26 0x55748ef2b30c in Item_subselect::fix_fields(THD*, Item**) /10.4/src/sql/item_subselect.cc:289
 
    #27 0x55748ef4e3d4 in Item_in_subselect::fix_fields(THD*, Item**) /10.4/src/sql/item_subselect.cc:3477
 
    #28 0x55748e2965e4 in Item::fix_fields_if_needed(THD*, Item**) /10.4/src/sql/item.h:966
 
    #29 0x55748ee560cd in Item_func::fix_fields(THD*, Item**) /10.4/src/sql/item_func.cc:355
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7efe0639b815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x55748f5d586e in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919
 
    #2 0x55748e224f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55748e23d103 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6289
 
    #4 0x55748e23d89e in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6359
 
    #5 0x55748e23dd84 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6457
 
    #6 0x55748e23ec40 in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6615
 
    #7 0x55748e23c808 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5947
 
    #8 0x55748e222f3c in main /10.4/src/sql/main.cc:25
 
    #9 0x7efe05946082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/sql/item.cc:849 in Item_field::register_field_in_read_map(void*)
 
Shadow bytes around the buggy address:
 
  0x0c3280016e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280016e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3280016eb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
 
  0x0c3280016ec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016ed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016ee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280016ef0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
 
  0x0c3280016f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==553156==ABORTING
 
----------SERVER LOG END-------------


CREATE TABLE t1 ( x INT ) ;
 
INSERT INTO t1 VALUES (1),(1),(1);
 
CREATE VIEW x as SELECT 1 x except SELECT x + 1 FROM t1 ;
 
 
 
SELECT 1 FROM x GROUP BY x HAVING (SELECT x , x FROM x GROUP BY x) IN (SELECT x , x FROM x);

Generated at Thu Feb 08 10:33:30 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.