MySQL Bugs: #113709: StrXfrmTest.ChineseUTF8MB4 failing with an AddressSanitizer error

Bug #113709	StrXfrmTest.ChineseUTF8MB4 failing with an AddressSanitizer error
Submitted:	22 Jan 12:24	Modified:	16 Oct 12:37
Reporter:	Laurynas Biveinis (OCA)	Email Updates:
Status:	Duplicate	Impact on me:	None
Category:	MySQL Server: Charsets	Severity:	S3 (Non-critical)
Version:	8.0.36	OS:	MacOS (12.4.1)
Assigned to:		CPU Architecture:	Any

Description:
./runtime_output_directory/merge_small_tests-t
[ RUN      ] StrXfrmTest.ChineseUTF8MB4
=================================================================
==64952==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x000107cafe90 at pc 0x000100ed3240 bp 0x00016f9795b0 sp 0x00016f9795a8
READ of size 2 at 0x000107cafe90 thread T0
    #0 0x100ed323c in modify_all_zh_pages(Reorder_param*, MY_UCA_INFO*, int) ctype-uca.cc:4180
    #1 0x100ec12ac in init_weight_level(CHARSET_INFO*, MY_CHARSET_LOADER*, MY_COLL_RULES*, int, MY_UCA_INFO*, MY_UCA_INFO const*, bool) ctype-uca.cc:4289
    #2 0x100ebbf2c in create_tailoring(CHARSET_INFO*, MY_CHARSET_LOADER*) ctype-uca.cc:4798
    #3 0x100da2bd4 in get_internal_charset(MY_CHARSET_LOADER*, unsigned int, int) charset.cc:555
    #4 0x100da3208 in my_collation_get_by_name(MY_CHARSET_LOADER*, char const*, int) charset.cc:606
    #5 0x100c584dc in strnxfrm_unittest::(anonymous namespace)::init_collation(char const*) strings_strnxfrm-t.cc:93
    #6 0x100c634d8 in strnxfrm_unittest::StrXfrmTest_ChineseUTF8MB4_Test::TestBody() strings_strnxfrm-t.cc:1785
    #7 0x1010a78f4 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) gtest.cc:2635
    #8 0x1010a750c in testing::Test::Run() gtest.cc:2674
    #9 0x1010a9dd0 in testing::TestInfo::Run() gtest.cc:2853
    #10 0x1010ad388 in testing::TestSuite::Run() gtest.cc:3012
    #11 0x1010cde48 in testing::internal::UnitTestImpl::RunAllTests() gtest.cc:5870
    #12 0x1010cce78 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) gtest.cc:2635
    #13 0x1010cca24 in testing::UnitTest::Run() gtest.cc:5444
    #14 0x100d90a68 in main gunit_test_main.cc:150
    #15 0x185d350dc  (<unknown module>)

0x000107cafe90 is located 0 bytes after 3600-byte region [0x000107caf080,0x000107cafe90)
allocated by thread T0 here:
    #0 0x10410f244 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x53244)
    #1 0x100e14ff4 in my_once_alloc(unsigned long, int) my_once.cc:80
    #2 0x100ed0fcc in my_uca_copy_page(CHARSET_INFO*, MY_CHARSET_LOADER*, MY_UCA_INFO const*, MY_UCA_INFO*, unsigned long) ctype-uca.cc:3728
    #3 0x100ec0fa4 in init_weight_level(CHARSET_INFO*, MY_CHARSET_LOADER*, MY_COLL_RULES*, int, MY_UCA_INFO*, MY_UCA_INFO const*, bool) ctype-uca.cc:4286
    #4 0x100ebbf2c in create_tailoring(CHARSET_INFO*, MY_CHARSET_LOADER*) ctype-uca.cc:4798
    #5 0x100da2bd4 in get_internal_charset(MY_CHARSET_LOADER*, unsigned int, int) charset.cc:555
    #6 0x100da3208 in my_collation_get_by_name(MY_CHARSET_LOADER*, char const*, int) charset.cc:606
    #7 0x100c584dc in strnxfrm_unittest::(anonymous namespace)::init_collation(char const*) strings_strnxfrm-t.cc:93
    #8 0x100c634d8 in strnxfrm_unittest::StrXfrmTest_ChineseUTF8MB4_Test::TestBody() strings_strnxfrm-t.cc:1785
    #9 0x1010a78f4 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) gtest.cc:2635
    #10 0x1010a750c in testing::Test::Run() gtest.cc:2674
    #11 0x1010a9dd0 in testing::TestInfo::Run() gtest.cc:2853
    #12 0x1010ad388 in testing::TestSuite::Run() gtest.cc:3012
    #13 0x1010cde48 in testing::internal::UnitTestImpl::RunAllTests() gtest.cc:5870
    #14 0x1010cce78 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) gtest.cc:2635
    #15 0x1010cca24 in testing::UnitTest::Run() gtest.cc:5444
    #16 0x100d90a68 in main gunit_test_main.cc:150
    #17 0x185d350dc  (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow ctype-uca.cc:4180 in modify_all_zh_pages(Reorder_param*, MY_UCA_INFO*, int)
Shadow bytes around the buggy address:
  0x000107cafc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000107cafc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000107cafd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000107cafd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000107cafe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x000107cafe80: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x000107caff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x000107caff80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x000107cb0000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x000107cb0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000107cb0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==64952==ABORTING

How to repeat:
CMake options used are
-DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DCMAKE_BUILD_TYPE=Debug -DWITH_DEBUG=ON -DMYSQL_MAINTAINER_MODE=ON -DDOWNLOAD_BOOST=ON -DWITH_BOOST=~/vilniusdb/mysql-boost/ -DWITH_SYSTEM_LIBS=ON -DFORCE_COLORED_OUTPUT=ON -DCMAKE_C_FLAGS_DEBUG=-g -DCMAKE_CXX_FLAGS_DEBUG=-g -DCMAKE_CXX_FLAGS_RELEASE=-O2 -g -DNDEBUG -Wno-unused-variable -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON

Hello Laurynas,

Thank you for the report and feedback!

regards,
Umesh

Test results - 8.0.36

Attachment: 113709_8.0.36 (application/octet-stream, text), 285.64 KiB.

duplicate of
Bug #109540 	heap-buffer-overflow in StrXfrmTest.ChineseUTF8MB4 gunit test

8.0.40 still has this heap-buffer-overflow error as "won't fix" for 8.0 series.