MySQL Bugs: #121170: MySQL 9.7.2 -DWITH_DEBUG=ON -DWITH_ASAN=ON detects heap-buffer-overflow in DbugVfprintf

Bug #121170	MySQL 9.7.2 -DWITH_DEBUG=ON -DWITH_ASAN=ON detects heap-buffer-overflow in DbugVfprintf
Submitted:	26 Aug 0:57	Modified:	26 Aug 7:47
Reporter:	Tsubasa Tanaka (OCA)	Email Updates:
Status:	Open	Impact on me:	None
Category:	MySQL Server: Replication	Severity:	S6 (Debug Builds)
Version:	9.7.2	OS:	Oracle Linux (8.10)
Assigned to:		CPU Architecture:	x86

Description:
MySQL 9.7.2 -DWITH_DEBUG=ON -DWITH_ASAN=ON fails specific query by "heap-buffer-overflow in DbugVfprintf"

How to repeat:
cmake -DCMAKE_INSTALL_PREFIX=/usr/mysql/9.7.2-debug -DMINIMAL_RELWITHDEBINFO=OFF -DWITH_DEBUG=ON -DWITH_ASAN=ON ../mysql-9.7.2
make install

cd /usr/mysql/9.7.2-debug
bin/mysqld --initialize-insecure
bin/mysqld --debug --daemonize

bin/mysql -uroot

create database d1;
use d1
CREATE TABLE `t1` (
  `id` int NOT NULL AUTO_INCREMENT,  `k` int NOT NULL DEFAULT 0,   `c` char(120) NOT NULL DEFAULT '', `pad` longblob, PRIMARY KEY (`id`),
  KEY `k_1` (`k`)
);

insert into t1 (k, pad) select rand() * 100, repeat(substring(TABLE_NAME, 1, 1), 500000) from information_schema.columns where TABLE_SCHEMA='mysql' order by TABLE_NAME limit 100;  -- This leads to "ERROR 2013 (HY000): Lost connection to MySQL server during query"

==errorlog===
==574994==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c317b2467d1 at pc 0x7f217efba373 bp 0x7b216aa058b0 sp 0x7b216aa05028
READ of size 217 at 0x7c317b2467d1 thread T46 (connection)
    #0 0x7f217efba372 in printf_common(void*, char const*, __va_list_tag*) (/lib64/libasan.so.8+0x90372) (BuildId: 47824b00b928cd4a7f2ba1502b583ca8aaa58129)
    #1 0x7f217efdcacc in vfprintf (/lib64/libasan.so.8+0xb2acc) (BuildId: 47824b00b928cd4a7f2ba1502b583ca8aaa58129)
    #2 0x000005e99741 in DbugVfprintf /usr/mysql/src/mysql-9.7.2/mysys/dbug.cc:1355
    #3 0x000005e9fa87 in _db_doprnt_(char const*, ...) /usr/mysql/src/mysql-9.7.2/mysys/dbug.cc:1340
    #4 0x0000056b3fbb in Rows_query_log_event::Rows_query_log_event(THD*, char const*, unsigned long) /usr/mysql/src/mysql-9.7.2/sql/log_event.h:3803
    #5 0x0000056b1229 in THD::binlog_write_table_map(TABLE*, bool, bool) /usr/mysql/src/mysql-9.7.2/sql/binlog.cc:8608
    #6 0x000003d45290 in write_locked_table_maps /usr/mysql/src/mysql-9.7.2/sql/handler.cc:7992
    #7 0x000003d45d11 in binlog_log_row(TABLE*, unsigned char const*, unsigned char const*, bool (*)(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)) /usr/mysql/src/mysql-9.7.2/sql/handler.cc:8109
    #8 0x000003d464fe in handler::ha_write_row(unsigned char*) /usr/mysql/src/mysql-9.7.2/sql/handler.cc:8219
    #9 0x00000441d5f7 in write_record(THD*, TABLE*, COPY_INFO*, COPY_INFO*) /usr/mysql/src/mysql-9.7.2/sql/sql_insert.cc:2191
    #10 0x00000442021e in Query_result_insert::send_data(THD*, mem_root_deque<Item*> const&) /usr/mysql/src/mysql-9.7.2/sql/sql_insert.cc:2420
    #11 0x000003879ace in Query_expression::ExecuteIteratorQuery(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_union.cc:1153
    #12 0x000003879e63 in Query_expression::execute(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_union.cc:1200
    #13 0x000003730186 in Sql_cmd_dml::execute_inner(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_select.cc:1153
    #14 0x00000373133d in Sql_cmd_dml::execute(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_select.cc:798
    #15 0x000003622dab in mysql_execute_command(THD*, bool) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:3803
    #16 0x00000362a927 in dispatch_sql_command(THD*, Parser_state*, bool) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:5441
    #17 0x00000362d3f8 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:2152
    #18 0x000003630632 in do_command(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:1491
    #19 0x000003a22247 in handle_connection /usr/mysql/src/mysql-9.7.2/sql/conn_handler/connection_handler_per_thread.cc:304
    #20 0x0000072f6cfa in pfs_spawn_thread /usr/mysql/src/mysql-9.7.2/storage/perfschema/pfs.cc:3067
    #21 0x7f217ef537a9 in asan_thread_start(void*) (/lib64/libasan.so.8+0x297a9) (BuildId: 47824b00b928cd4a7f2ba1502b583ca8aaa58129)
    #22 0x7f217ed121d9 in start_thread (/lib64/libpthread.so.0+0x81d9) (BuildId: 23f7c25f88c13e25a270d402f2ad4c017ee4b51d)
    #23 0x7f217bf4e952 in clone (/lib64/libc.so.6+0x39952) (BuildId: 948366c8d0869e35d8f17ce103b9da4152bf88fb)

0x7c317b2467d1 is located 0 bytes after 209-byte region [0x7c317b246700,0x7c317b2467d1)
allocated by thread T46 (connection) here:
    #0 0x7f217f014f2b in malloc (/lib64/libasan.so.8+0xeaf2b) (BuildId: 47824b00b928cd4a7f2ba1502b583ca8aaa58129)
    #1 0x000005ee970c in redirecting_allocator /usr/mysql/src/mysql-9.7.2/mysys/my_malloc.cc:278
    #2 0x000005ee9b9c in my_raw_malloc<redirecting_allocator> /usr/mysql/src/mysql-9.7.2/mysys/my_malloc.cc:385
    #3 0x000005ee9d07 in my_internal_malloc<redirecting_allocator> /usr/mysql/src/mysql-9.7.2/mysys/my_malloc.cc:371
    #4 0x000005ee9e00 in my_malloc(unsigned int, unsigned long, int) /usr/mysql/src/mysql-9.7.2/mysys/my_malloc.cc:385
    #5 0x0000056b3d83 in Rows_query_log_event::Rows_query_log_event(THD*, char const*, unsigned long) /usr/mysql/src/mysql-9.7.2/sql/log_event.h:3787
    #6 0x0000056b1229 in THD::binlog_write_table_map(TABLE*, bool, bool) /usr/mysql/src/mysql-9.7.2/sql/binlog.cc:8608
    #7 0x000003d45290 in write_locked_table_maps /usr/mysql/src/mysql-9.7.2/sql/handler.cc:7992
    #8 0x000003d45d11 in binlog_log_row(TABLE*, unsigned char const*, unsigned char const*, bool (*)(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)) /usr/mysql/src/mysql-9.7.2/sql/handler.cc:8109
    #9 0x000003d464fe in handler::ha_write_row(unsigned char*) /usr/mysql/src/mysql-9.7.2/sql/handler.cc:8219
    #10 0x00000441d5f7 in write_record(THD*, TABLE*, COPY_INFO*, COPY_INFO*) /usr/mysql/src/mysql-9.7.2/sql/sql_insert.cc:2191
    #11 0x00000442021e in Query_result_insert::send_data(THD*, mem_root_deque<Item*> const&) /usr/mysql/src/mysql-9.7.2/sql/sql_insert.cc:2420
    #12 0x000003879ace in Query_expression::ExecuteIteratorQuery(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_union.cc:1153
    #13 0x000003879e63 in Query_expression::execute(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_union.cc:1200
    #14 0x000003730186 in Sql_cmd_dml::execute_inner(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_select.cc:1153
    #15 0x00000373133d in Sql_cmd_dml::execute(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_select.cc:798
    #16 0x000003622dab in mysql_execute_command(THD*, bool) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:3803
    #17 0x00000362a927 in dispatch_sql_command(THD*, Parser_state*, bool) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:5441
    #18 0x00000362d3f8 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:2152
    #19 0x000003630632 in do_command(THD*) /usr/mysql/src/mysql-9.7.2/sql/sql_parse.cc:1491
    #20 0x000003a22247 in handle_connection /usr/mysql/src/mysql-9.7.2/sql/conn_handler/connection_handler_per_thread.cc:304
    #21 0x0000072f6cfa in pfs_spawn_thread /usr/mysql/src/mysql-9.7.2/storage/perfschema/pfs.cc:3067
    #22 0x7f217ef537a9 in asan_thread_start(void*) (/lib64/libasan.so.8+0x297a9) (BuildId: 47824b00b928cd4a7f2ba1502b583ca8aaa58129)

Thread T46 (connection) created by T0 here:
    #0 0x7f217f00bf6a in pthread_create (/lib64/libasan.so.8+0xe1f6a) (BuildId: 47824b00b928cd4a7f2ba1502b583ca8aaa58129)
    #1 0x000005ef07c8 in my_thread_create(my_thread_handle*, pthread_attr_t const*, void* (*)(void*), void*) /usr/mysql/src/mysql-9.7.2/mysys/my_thread.cc:75
    #2 0x0000072f6b01 in pfs_spawn_thread_vc(unsigned int, unsigned int, my_thread_handle*, pthread_attr_t const*, void* (*)(void*), void*) /usr/mysql/src/mysql-9.7.2/storage/perfschema/pfs.cc:3116
    #3 0x000003a21193 in inline_mysql_thread_create /usr/mysql/src/mysql-9.7.2/include/mysql/psi/mysql_thread.h:140
    #4 0x000003a2264c in Per_thread_connection_handler::add_connection(Channel_info*) /usr/mysql/src/mysql-9.7.2/sql/conn_handler/connection_handler_per_thread.cc:421
    #5 0x000003c5b72d in Connection_handler_manager::process_new_connection(Channel_info*) /usr/mysql/src/mysql-9.7.2/sql/conn_handler/connection_handler_manager.cc:265
    #6 0x0000032dcbda in Connection_acceptor<Mysqld_socket_listener>::connection_event_loop() /usr/mysql/src/mysql-9.7.2/sql/conn_handler/connection_acceptor.h:66
    #7 0x0000032d7113 in mysqld_main(int, char**) /usr/mysql/src/mysql-9.7.2/sql/mysqld.cc:10267
    #8 0x0000032a841e in main /usr/mysql/src/mysql-9.7.2/sql/main.cc:26
    #9 0x7f217bf4f924 in __libc_start_main (/lib64/libc.so.6+0x3a924) (BuildId: 948366c8d0869e35d8f17ce103b9da4152bf88fb)

SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/mysql/src/mysql-9.7.2/mysys/dbug.cc:1355 in DbugVfprintf
Shadow bytes around the buggy address:
  0x7c317b246500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c317b246580: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c317b246600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c317b246680: 00 00 00 00 02 fa fa fa fa fa fa fa fa fa fa fa
  0x7c317b246700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7c317b246780: 00 00 00 00 00 00 00 00 00 00[01]fa fa fa fa fa
  0x7c317b246800: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c317b246880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c317b246900: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c317b246980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c317b246a00: 00 00 00 00 00 00 00 00 00 00 00 00 02 fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==574994==ABORTING

Sorry, previous "How to repeat" is affected by my my.cnf.

Minimal "How to repeat" is

```
bin/mysqld --no-defaults --initialize-insecure
bin/mysqld --no-defaults --debug --daemonize --binlog_rows_query_log_events

bin/mysql -uroot

create database d1;
use d1
CREATE TABLE `t1` (
  `id` int NOT NULL AUTO_INCREMENT,  `k` int NOT NULL DEFAULT 0,   `c` char(120) NOT NULL DEFAULT '', `pad` longblob, PRIMARY KEY (`id`),
  KEY `k_1` (`k`)
);

insert into t1 (k, pad) select rand() * 100, repeat(substring(TABLE_NAME, 1, 1), 500000) from information_schema.columns where TABLE_SCHEMA='mysql' order by TABLE_NAME limit 100;
```