[MDEV-32759] Heap-Use-After-Free at /mariadb-11.3.0/strings/dtoa.c:1378 Created: 2023-11-10  Updated: 2023-11-22  Resolved: 2023-11-22

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Duplicate
duplicates MDEV-28345 ASAN: use-after-poison or unknown-cra... Confirmed
Relates
relates to MDEV-18414 Server crash or ASAN heap-use-after-f... Closed

 Description   

Run these queries in debug build:

CREATE TABLE t0 ( c8 INT , CONSTRAINT cc0 UNIQUE i0 ( c8 ) ) ;
INSERT INTO t0 VALUES ( ) , ( ) ;
ALTER TABLE t0 ADD COLUMN c59 TEXT NOT NULL AFTER c8 ;
INSERT INTO t0 VALUES ( -95 , 86 ) , ( -58 , -36 ) ;
SELECT t1 . c41 AS c18 FROM ( SELECT c59 AS c41 FROM t0 ) AS t1 JOIN t0 ON c8 IN ( SELECT c8 AS c45 FROM t0 GROUP BY c59 , c8 HAVING c59 = AVG ( ( SELECT c8 AS c30 FROM t0 HAVING ATAN ( ROUND ( -588949354837696189 , IF ( 6068938522839077129 , -1 BETWEEN 79 AND 49 , 21 ) ) , RAND ( ) ) = t0 . c59 LIMIT 1 ) ) ) ;

Will trigger Heap-Use-After-Free.
ASAN info:
=================================================================
==10747==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001e52a0 at pc 0x555559052512 bp 0x7fffd1626d70 sp 0x7fffd1626d60
READ of size 1 at 0x6290001e52a0 thread T15
#0 0x555559052511 in my_strtod_int /home/wx/mariadb-11.3.0/strings/dtoa.c:1378
#1 0x55555904eb04 in my_strtod /home/wx/mariadb-11.3.0/strings/dtoa.c:469
#2 0x555558fbc7ff in my_strntod_8bit /home/wx/mariadb-11.3.0/strings/ctype-simple.c:800
#3 0x555556f02963 in charset_info_st::strntod(char*, unsigned long, char*, int) const /home/wx/mariadb-11.3.0/include/m_ctype.h:930
#4 0x555556f033f8 in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:210
#5 0x555556f03768 in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /home/wx/mariadb-11.3.0/sql/field.h:281
#6 0x555557ac216f in Field_blob::val_real() /home/wx/mariadb-11.3.0/sql/field.cc:8744
#7 0x555557b8a817 in Item_field::val_result() /home/wx/mariadb-11.3.0/sql/item.cc:3428
#8 0x555557bb2e6f in Item_ref::val_real() /home/wx/mariadb-11.3.0/sql/item.cc:8513
#9 0x555557beab70 in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
#10 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#11 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#12 0x555557369752 in end_send /home/wx/mariadb-11.3.0/sql/sql_select.cc:24685
#13 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#14 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#15 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#16 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#17 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#18 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
#19 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#20 0x555557db09ea in Item_singlerow_subselect::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525
#21 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
#22 0x555557e05b78 in Item_sum_avg::reset_field() /home/wx/mariadb-11.3.0/sql/item_sum.cc:2923
#23 0x55555738760f in init_tmptable_sum_functions /home/wx/mariadb-11.3.0/sql/sql_select.cc:28763
#24 0x55555736dee6 in end_unique_update /home/wx/mariadb-11.3.0/sql/sql_select.cc:25138
#25 0x5555573a1a76 in AGGR_OP::put_record(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:32254
#26 0x5555573b632c in AGGR_OP::put_record() (/usr/local/mysql/bin/mariadbd+0x1e6232c)
#27 0x55555735ec69 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23134
#28 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#29 0x55555736083b in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#30 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#31 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#32 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#33 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
#34 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#35 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#36 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#37 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#38 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#39 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#40 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
#41 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
#42 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#43 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#44 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#45 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#46 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#47 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#48 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#49 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#50 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#51 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#52 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#53 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#54 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#55 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#56 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#57 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#58 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#59 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6290001e52a0 is located 160 bytes inside of 16536-byte region [0x6290001e5200,0x6290001e9298)
freed by thread T15 here:
#0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x555558563801 in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:424
#2 0x55555872d475 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:416
#3 0x5555588a10ad in mem_heap_free /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:419
#4 0x5555588a3967 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /home/wx/mariadb-11.3.0/storage/innobase/row/row0mysql.cc:101
#5 0x55555891fea6 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3148
#6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689
#7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289
#8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485
#9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615
#10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513
#11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81
#12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461
#13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
#17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
#24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
#25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

previously allocated by thread T15 here:
#0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x5555585632ec in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /home/wx/mariadb-11.3.0/storage/innobase/include/ut0new.h:375
#2 0x55555872c719 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/mem/mem0mem.cc:277
#3 0x55555890917c in mem_heap_create_func /home/wx/mariadb-11.3.0/storage/innobase/include/mem0mem.inl:377
#4 0x55555891f76c in row_sel_store_mysql_field /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3089
#5 0x555558920887 in row_sel_store_mysql_rec /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:3235
#6 0x5555589305df in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /home/wx/mariadb-11.3.0/storage/innobase/row/row0sel.cc:5689
#7 0x55555850ec8d in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9289
#8 0x55555850fb99 in ha_innobase::rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/storage/innobase/handler/ha_innodb.cc:9485
#9 0x555557b2f44b in handler::ha_rnd_next(unsigned char*) /home/wx/mariadb-11.3.0/sql/handler.cc:3615
#10 0x555556ee425a in rr_sequential(READ_RECORD*) /home/wx/mariadb-11.3.0/sql/records.cc:513
#11 0x555556ead6ff in READ_RECORD::read_record() /home/wx/mariadb-11.3.0/sql/records.h:81
#12 0x555557360458 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23461
#13 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#14 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#15 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#16 0x555557dd9278 in subselect_hash_sj_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:5730
#17 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#18 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#19 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#20 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#21 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#22 0x5555570d0aa0 in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#23 0x555557760355 in JOIN_TAB_SCAN::next() /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:3502
#24 0x55555775ab37 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2342
#25 0x555557759950 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#26 0x55555735ef48 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#27 0x55555735f712 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23378
#28 0x55555735dbe2 in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#29 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941

Thread T15 created by T0 here:
#0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
#2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
#3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
#4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
#5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
#6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
#7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
#8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
#9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
#10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/dtoa.c:1378 in my_strtod_int
Shadow bytes around the buggy address:
0x0c5280034a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c5280034a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c5280034a50: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c5280034aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==10747==ABORTING

 Comments   
Comment by Alice Sherepa [ 2023-11-10 ]

Thanks! I repeated on 10.4-11.2. This is probably the same bug as MDEV-28345, I will add the test there to be checked

Version: '10.4.32-MariaDB-debug-log'   62d80652be7c19f4ad2bf68d6ffbb4e1eb1d77ea
 
=================================================================
 
==692855==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290002ee288 at pc 0x55e185f94137 bp 0x7f32ecfbbc90 sp 0x7f32ecfbbc80
 
READ of size 1 at 0x6290002ee288 thread T27
 
    #0 0x55e185f94136 in my_strtod_int /10.4/src/strings/dtoa.c:1378
 
    #1 0x55e185f90729 in my_strtod /10.4/src/strings/dtoa.c:469
 
    #2 0x55e185f08817 in my_strntod_8bit /10.4/src/strings/ctype-simple.c:801
 
    #3 0x55e183fc9fcf in Value_source::Converter_strntod::Converter_strntod(charset_info_st const*, char const*, unsigned long) /10.4/src/sql/field.h:168
 
    #4 0x55e183fca39a in Value_source::Converter_strntod_with_warn::Converter_strntod_with_warn(THD*, Value_source::Warn_filter, charset_info_st const*, char const*, unsigned long) /10.4/src/sql/field.h:239
 
    #5 0x55e1849e36a5 in Field_blob::val_real() /10.4/src/sql/field.cc:8570
 
    #6 0x55e184aa288c in Item_field::val_result() /10.4/src/sql/item.cc:3351
 
    #7 0x55e184acb0d1 in Item_ref::val_real() /10.4/src/sql/item.cc:8376
 
    #8 0x55e184b04e90 in Arg_comparator::compare_real() /10.4/src/sql/item_cmpfunc.cc:854
 
    #9 0x55e184b489a5 in Arg_comparator::compare() /10.4/src/sql/item_cmpfunc.h:104
 
    #10 0x55e184b10782 in Item_func_eq::val_int() /10.4/src/sql/item_cmpfunc.cc:1790
 
    #11 0x55e1843c8355 in end_send /10.4/src/sql/sql_select.cc:22106
 
    #12 0x55e1843c09b0 in evaluate_join_record /10.4/src/sql/sql_select.cc:21149
 
    #13 0x55e1843bf2e5 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20922
 
    #14 0x55e1843bd08b in do_select /10.4/src/sql/sql_select.cc:20443
 
    #15 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #16 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #17 0x55e184c90329 in subselect_single_select_engine::exec() /10.4/src/sql/item_subselect.cc:4032
 
    #18 0x55e184c6b391 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #19 0x55e184c72252 in Item_singlerow_subselect::val_decimal(my_decimal*) /10.4/src/sql/item_subselect.cc:1463
 
    #20 0x55e1847dc45f in VDec::VDec(Item*) /10.4/src/sql/sql_type.cc:195
 
    #21 0x55e184cc8380 in Item_sum_avg::reset_field() /10.4/src/sql/item_sum.cc:2889
 
    #22 0x55e1843e6a82 in init_tmptable_sum_functions /10.4/src/sql/sql_select.cc:26124
 
    #23 0x55e1843cc948 in end_unique_update /10.4/src/sql/sql_select.cc:22530
 
    #24 0x55e184401546 in AGGR_OP::put_record(bool) /10.4/src/sql/sql_select.cc:29651
 
    #25 0x55e184411014 in AGGR_OP::put_record() (/home/alice/am/_depot/m-branch/m4-10.4-bld/sql/mysqld+0x148e014)
 
    #26 0x55e1843be028 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20627
 
    #27 0x55e1843c09b0 in evaluate_join_record /10.4/src/sql/sql_select.cc:21149
 
    #28 0x55e1843bf94b in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20961
 
    #29 0x55e1843bd08b in do_select /10.4/src/sql/sql_select.cc:20443
 
    #30 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #31 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #32 0x55e184c9a9b4 in subselect_hash_sj_engine::exec() /10.4/src/sql/item_subselect.cc:5594
 
    #33 0x55e184c6b391 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #34 0x55e184c6c995 in Item_in_subselect::exec() /10.4/src/sql/item_subselect.cc:938
 
    #35 0x55e184c77f70 in Item_in_subselect::val_bool() /10.4/src/sql/item_subselect.cc:1886
 
    #36 0x55e183fac951 in Item::val_bool_result() /10.4/src/sql/item.h:1562
 
    #37 0x55e184b0e8f7 in Item_in_optimizer::val_int() /10.4/src/sql/item_cmpfunc.cc:1673
 
    #38 0x55e1845681ca in SQL_SELECT::skip_record(THD*) /10.4/src/sql/opt_range.h:1665
 
    #39 0x55e18472a9c1 in JOIN_TAB_SCAN::next() /10.4/src/sql/sql_join_cache.cc:3532
 
    #40 0x55e184725071 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2358
 
    #41 0x55e184723f9e in JOIN_CACHE::join_records(bool) /10.4/src/sql/sql_join_cache.cc:2173
 
    #42 0x55e1843be307 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20685
 
    #43 0x55e1843bea91 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867
 
    #44 0x55e1843bd191 in do_select /10.4/src/sql/sql_select.cc:20445
 
    #45 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #46 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #47 0x55e18434c3df in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/src/sql/sql_select.cc:4846
 
    #48 0x55e18431cc55 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/src/sql/sql_select.cc:442
 
    #49 0x55e184283c5b in execute_sqlcom_select /10.4/src/sql/sql_parse.cc:6475
 
    #50 0x55e1842713d2 in mysql_execute_command(THD*) /10.4/src/sql/sql_parse.cc:3978
 
    #51 0x55e18428d1d6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/src/sql/sql_parse.cc:8014
 
    #52 0x55e184263562 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/src/sql/sql_parse.cc:1857
 
    #53 0x55e18426008d in do_command(THD*) /10.4/src/sql/sql_parse.cc:1378
 
    #54 0x55e18467467d in do_handle_one_connection(CONNECT*) /10.4/src/sql/sql_connect.cc:1419
 
    #55 0x55e184673f21 in handle_one_connection /10.4/src/sql/sql_connect.cc:1323
 
    #56 0x55e185311baf in pfs_spawn_thread /10.4/src/storage/perfschema/pfs.cc:1869
 
    #57 0x7f3303b8b608 in start_thread /build/glibc-BHL3KM/glibc-2.31/nptl/pthread_create.c:477
 
    #58 0x7f330375c132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x6290002ee288 is located 136 bytes inside of 16512-byte region [0x6290002ee200,0x6290002f2280)
 
freed by thread T27 here:
 
    #0 0x7f330418940f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
 
    #1 0x55e185617686 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.4/src/storage/innobase/mem/mem0mem.cc:416
 
    #2 0x55e18578933f in mem_heap_free /10.4/src/storage/innobase/include/mem0mem.inl:417
 
    #3 0x55e185790918 in row_mysql_prebuilt_free_blob_heap(row_prebuilt_t*) /10.4/src/storage/innobase/row/row0mysql.cc:137
 
    #4 0x55e185820a61 in row_sel_store_mysql_rec /10.4/src/storage/innobase/row/row0sel.cc:3106
 
    #5 0x55e185830dfc in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /10.4/src/storage/innobase/row/row0sel.cc:5589
 
    #6 0x55e185429b2a in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /10.4/src/storage/innobase/handler/ha_innodb.cc:9678
 
    #7 0x55e18542ab59 in ha_innobase::rnd_next(unsigned char*) /10.4/src/storage/innobase/handler/ha_innodb.cc:9888
 
    #8 0x55e184a4d2a7 in handler::ha_rnd_next(unsigned char*) /10.4/src/sql/handler.cc:2904
 
    #9 0x55e184e87fce in rr_sequential(READ_RECORD*) /10.4/src/sql/records.cc:485
 
    #10 0x55e1840b65c1 in READ_RECORD::read_record() /10.4/src/sql/records.h:70
 
    #11 0x55e1843bf568 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20941
 
    #12 0x55e1843bd08b in do_select /10.4/src/sql/sql_select.cc:20443
 
    #13 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #14 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #15 0x55e184c9a9b4 in subselect_hash_sj_engine::exec() /10.4/src/sql/item_subselect.cc:5594
 
    #16 0x55e184c6b391 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #17 0x55e184c6c995 in Item_in_subselect::exec() /10.4/src/sql/item_subselect.cc:938
 
    #18 0x55e184c77f70 in Item_in_subselect::val_bool() /10.4/src/sql/item_subselect.cc:1886
 
    #19 0x55e183fac951 in Item::val_bool_result() /10.4/src/sql/item.h:1562
 
    #20 0x55e184b0e8f7 in Item_in_optimizer::val_int() /10.4/src/sql/item_cmpfunc.cc:1673
 
    #21 0x55e1845681ca in SQL_SELECT::skip_record(THD*) /10.4/src/sql/opt_range.h:1665
 
    #22 0x55e18472a9c1 in JOIN_TAB_SCAN::next() /10.4/src/sql/sql_join_cache.cc:3532
 
    #23 0x55e184725071 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2358
 
    #24 0x55e184723f9e in JOIN_CACHE::join_records(bool) /10.4/src/sql/sql_join_cache.cc:2173
 
    #25 0x55e1843be307 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20685
 
    #26 0x55e1843bea91 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867
 
    #27 0x55e1843bd191 in do_select /10.4/src/sql/sql_select.cc:20445
 
    #28 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #29 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f3304189808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x55e185616a83 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.4/src/storage/innobase/mem/mem0mem.cc:277
 
    #2 0x55e185809138 in mem_heap_create_func /10.4/src/storage/innobase/include/mem0mem.inl:375
 
    #3 0x55e185820322 in row_sel_store_mysql_field /10.4/src/storage/innobase/row/row0sel.cc:3047
 
    #4 0x55e185821447 in row_sel_store_mysql_rec /10.4/src/storage/innobase/row/row0sel.cc:3178
 
    #5 0x55e185830dfc in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /10.4/src/storage/innobase/row/row0sel.cc:5589
 
    #6 0x55e185429b2a in ha_innobase::general_fetch(unsigned char*, unsigned int, unsigned int) /10.4/src/storage/innobase/handler/ha_innodb.cc:9678
 
    #7 0x55e18542ab59 in ha_innobase::rnd_next(unsigned char*) /10.4/src/storage/innobase/handler/ha_innodb.cc:9888
 
    #8 0x55e184a4d2a7 in handler::ha_rnd_next(unsigned char*) /10.4/src/sql/handler.cc:2904
 
    #9 0x55e184e87fce in rr_sequential(READ_RECORD*) /10.4/src/sql/records.cc:485
 
    #10 0x55e1840b65c1 in READ_RECORD::read_record() /10.4/src/sql/records.h:70
 
    #11 0x55e1843bf568 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20941
 
    #12 0x55e1843bd08b in do_select /10.4/src/sql/sql_select.cc:20443
 
    #13 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #14 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
    #15 0x55e184c9a9b4 in subselect_hash_sj_engine::exec() /10.4/src/sql/item_subselect.cc:5594
 
    #16 0x55e184c6b391 in Item_subselect::exec() /10.4/src/sql/item_subselect.cc:758
 
    #17 0x55e184c6c995 in Item_in_subselect::exec() /10.4/src/sql/item_subselect.cc:938
 
    #18 0x55e184c77f70 in Item_in_subselect::val_bool() /10.4/src/sql/item_subselect.cc:1886
 
    #19 0x55e183fac951 in Item::val_bool_result() /10.4/src/sql/item.h:1562
 
    #20 0x55e184b0e8f7 in Item_in_optimizer::val_int() /10.4/src/sql/item_cmpfunc.cc:1673
 
    #21 0x55e1845681ca in SQL_SELECT::skip_record(THD*) /10.4/src/sql/opt_range.h:1665
 
    #22 0x55e18472a9c1 in JOIN_TAB_SCAN::next() /10.4/src/sql/sql_join_cache.cc:3532
 
    #23 0x55e184725071 in JOIN_CACHE::join_matching_records(bool) /10.4/src/sql/sql_join_cache.cc:2358
 
    #24 0x55e184723f9e in JOIN_CACHE::join_records(bool) /10.4/src/sql/sql_join_cache.cc:2173
 
    #25 0x55e1843be307 in sub_select_cache(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20685
 
    #26 0x55e1843bea91 in sub_select(JOIN*, st_join_table*, bool) /10.4/src/sql/sql_select.cc:20867
 
    #27 0x55e1843bd191 in do_select /10.4/src/sql/sql_select.cc:20445
 
    #28 0x55e18434abd3 in JOIN::exec_inner() /10.4/src/sql/sql_select.cc:4625
 
    #29 0x55e184348203 in JOIN::exec() /10.4/src/sql/sql_select.cc:4407
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f33040b6815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x55e185311fa0 in spawn_thread_v1 /10.4/src/storage/perfschema/pfs.cc:1919
 
    #2 0x55e183f58f71 in inline_mysql_thread_create /10.4/src/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55e183f71161 in create_thread_to_handle_connection(CONNECT*) /10.4/src/sql/mysqld.cc:6296
 
    #4 0x55e183f718fc in create_new_thread(CONNECT*) /10.4/src/sql/mysqld.cc:6366
 
    #5 0x55e183f71de2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.4/src/sql/mysqld.cc:6464
 
    #6 0x55e183f72c9e in handle_connections_sockets() /10.4/src/sql/mysqld.cc:6622
 
    #7 0x55e183f70866 in mysqld_main(int, char**) /10.4/src/sql/mysqld.cc:5954
 
    #8 0x55e183f56f3c in main /10.4/src/sql/main.cc:25
 
    #9 0x7f3303661082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /10.4/src/strings/dtoa.c:1378 in my_strtod_int
 
Shadow bytes around the buggy address:
 
  0x0c5280055c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280055c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280055c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280055c30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5280055c40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c5280055c50: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280055c60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280055c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280055c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280055c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280055ca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==692855==ABORTING
 
----------SERVER LOG END-------------
 
 

Generated at Thu Feb 08 10:33:47 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.