[MDEV-32722] Heap-Use-After-Free at /mariadb-11.3.0/sql/sql_select.cc:28029 Created: 2023-11-07  Updated: 2023-11-07  Resolved: 2023-11-07

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 11.3.0
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Duplicate
duplicates MDEV-29363 Server crashed with heap-use-after-fr... In Review

 Description   

Run these queries in debug build:

CREATE TABLE x ( x VARCHAR ( 1 ) ) ;
 
INSERT INTO x ( x ) VALUES ( 'x' ) , ( NULL ) , ( 'x' ) , ( NULL ) ;
 
SELECT x AS x , x AS x FROM x GROUP BY x , x HAVING ( ( x >= ( 1.000000 % FALSE AND x = x AND x = 1 ) AND x < 1 ) = 1 AND x = ( SELECT x FROM x AS x GROUP BY x ORDER BY x * 1 , x ASC , x DESC ) ) ORDER BY x / 1 ;

Will trigger heap-use-after-free.
ASAN info:

==173985==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000660200 at pc 0x55555738207d bp 0x7fffd193c3a0 sp 0x7fffd193c390
 
READ of size 8 at 0x61a000660200 thread T15
 
    #0 0x55555738207c in calc_group_buffer(TMP_TABLE_PARAM*, st_order*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:28029
 
    #1 0x555557382512 in calc_group_buffer /home/wx/mariadb-11.3.0/sql/sql_select.cc:28100
 
    #2 0x5555572c8036 in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3122
 
    #3 0x5555572c2f33 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
 
    #4 0x5555572bbba5 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
 
    #5 0x555557143850 in st_select_lex::optimize_unflattened_subqueries(bool) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
 
    #6 0x5555577b7508 in JOIN::optimize_unflattened_subqueries() /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5864
 
    #7 0x5555572c91e6 in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229
 
    #8 0x5555572c2f33 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
 
    #9 0x5555572bbba5 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
 
    #10 0x5555572dd9b9 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
 
    #11 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
 
    #12 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
 
    #13 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
 
    #14 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
 
    #15 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
 
    #16 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
 
    #17 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
 
    #18 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
 
    #19 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
 
    #20 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #21 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x61a000660200 is located 384 bytes inside of 1156-byte region [0x61a000660080,0x61a000660504)
 
freed by thread T15 here:
 
    #0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
 
    #1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297
 
    #2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203
 
    #3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217
 
    #4 0x555558edf55d in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83
 
    #5 0x555558ee1ef8 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:515
 
    #6 0x55555735c1ac in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713
 
    #7 0x55555732c895 in JOIN::cleanup(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:16348
 
    #8 0x5555572dc5cb in JOIN::destroy() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4970
 
    #9 0x55555752ecd5 in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2905
 
    #10 0x555557dcbd06 in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3933
 
    #11 0x555557da5ca4 in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296
 
    #12 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
 
    #13 0x555557c6c9f1 in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349
 
    #14 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
 
    #15 0x555556f04088 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156
 
    #16 0x55555703235a in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160
 
    #17 0x555557c13a3a in Item_cond::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:4941
 
    #18 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
 
    #19 0x555557c6c9f1 in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349
 
    #20 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
 
    #21 0x555556f04088 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156
 
    #22 0x55555703235a in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160
 
    #23 0x555557c13a3a in Item_cond::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:4941
 
    #24 0x555556f0404e in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147
 
    #25 0x555557c6c9f1 in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349
 
    #26 0x55555717464d in st_select_lex::pushdown_from_having_into_where(THD*, Item*) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:11284
 
    #27 0x5555572c0713 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2381
 
    #28 0x5555572bbba5 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
 
    #29 0x5555572dd9b9 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
 
 
 
previously allocated by thread T15 here:
 
    #0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126
 
    #2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89
 
    #3 0x555558edf4d5 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71
 
    #4 0x555558ee0d78 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339
 
    #5 0x5555573ac1ac in Field::operator new(unsigned long, st_mem_root*) /home/wx/mariadb-11.3.0/sql/field.h:771
 
    #6 0x5555578c702e in Type_handler_double::make_table_field_from_def(TABLE_SHARE*, st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Bit_addr const&, Column_definition_attributes const*, unsigned int) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:8076
 
    #7 0x5555578ad464 in Type_handler_real_result::make_table_field(st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE_SHARE*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:3601
 
    #8 0x5555578acd0a in Type_handler::make_and_init_table_field(st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:3558
 
    #9 0x555557346c00 in Item_result_field::create_tmp_field_ex_from_handler(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*, Type_handler const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20737
 
    #10 0x555556ea70b9 in Item_result_field::create_tmp_field_ex(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*) /home/wx/mariadb-11.3.0/sql/item.h:3478
 
    #11 0x555557347540 in create_tmp_field(TABLE*, Item*, Item***, Field**, Field**, bool, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20823
 
    #12 0x55555734c152 in Create_tmp_table::add_fields(THD*, TABLE*, TMP_TABLE_PARAM*, List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21261
 
    #13 0x555557355331 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21920
 
    #14 0x5555572d3c99 in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:4215
 
    #15 0x5555572cf218 in JOIN::make_aggr_tables_info() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3775
 
    #16 0x5555572ca92f in JOIN::optimize_stage2() /home/wx/mariadb-11.3.0/sql/sql_select.cc:3397
 
    #17 0x5555572c2f33 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
 
    #18 0x5555572bbba5 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
 
    #19 0x555557143850 in st_select_lex::optimize_unflattened_subqueries(bool) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
 
    #20 0x5555577b75f5 in JOIN::optimize_constant_subqueries() /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5898
 
    #21 0x5555572beb78 in JOIN::optimize_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:2274
 
    #22 0x5555572bbba5 in JOIN::optimize() /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
 
    #23 0x5555572dd9b9 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
 
    #24 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
 
    #25 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
 
    #26 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
 
    #27 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
 
    #28 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
 
    #29 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
 
 
 
Thread T15 created by T0 here:
 
    #0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
 
    #2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
 
    #3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
 
    #4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
 
    #5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
 
    #6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
 
    #7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
 
    #8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
 
    #9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
 
    #10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/sql_select.cc:28029 in calc_group_buffer(TMP_TABLE_PARAM*, st_order*)
 
Shadow bytes around the buggy address:
 
  0x0c34800c3ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c34800c4000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c34800c4010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c34800c4040:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c34800c4090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==173985==ABORTING



 Comments   
Comment by Alice Sherepa [ 2023-11-07 ]

Thanks! This is the same bug as MDEV-29363, I will add the test case there

Generated at Thu Feb 08 10:33:30 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.