Bug #79402 | slave connecting may cause heap-use-after-free on rpl_multi_source_slave_files | ||
---|---|---|---|
Submitted: | 25 Nov 2015 5:42 | Modified: | 24 May 2017 9:54 |
Reporter: | Laurynas Biveinis (OCA) | Email Updates: | |
Status: | Closed | Impact on me: | |
Category: | MySQL Server: Replication | Severity: | S2 (Serious) |
Version: | 5.7.9 | OS: | Any |
Assigned to: | CPU Architecture: | Any | |
Tags: | asan |
[25 Nov 2015 5:42]
Laurynas Biveinis
[25 Nov 2015 10:35]
MySQL Verification Team
Thank you for the bug report. Verified as described: ================================================================= ==10613==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070004254f0 at pc 0x00010ea37f8d bp 0x700000bcc720 sp 0x700000bcbed8 READ of size 46 at 0x6070004254f0 thread T130 ==10613==atos returned: An admin user name and password is required to enter Developer Mode. 2015-11-25T10:33:28.031433Z 140 [Note] Slave SQL thread for channel 'channel_1' initialized, starting replication in log 'master-bin.000001' at position 154, relay log './relaylog-msr-channel_1.000002' position: 369 #0 0x10ea37f8c in wrap_strlen (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x3cf8c) #1 0x10b1cd44b in my_strdup (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100f5644b) #2 0x10afb9d2b in mysql_options (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100d42d2b) #3 0x10b1389e2 in connect_to_master(THD*, st_mysql*, Master_info*, bool, bool) (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100ec19e2) #4 0x10b123eab in safe_connect(THD*, st_mysql*, Master_info*) (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100eaceab) #5 0x10b116fe1 in handle_slave_io (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100e9ffe1) #6 0x10b8d9c30 in pfs_spawn_thread (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x101662c30) #7 0x7fff933929b0 in _pthread_body (/usr/lib/system/libsystem_pthread.dylib+0x39b0) #8 0x7fff9339292d in _pthread_start (/usr/lib/system/libsystem_pthread.dylib+0x392d) #9 0x7fff93390384 in thread_start (/usr/lib/system/libsystem_pthread.dylib+0x1384) 0x6070004254f0 is located 32 bytes inside of 78-byte region [0x6070004254d0,0x60700042551e) freed by thread T128 here: #0 0x10ea3dd79 in wrap_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x42d79) #1 0x10b1cd359 in my_raw_free (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100f56359) #2 0x10afc1f1f in mysql_close_free_options (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100d4af1f) #3 0x10afc23d0 in mysql_close (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100d4b3d0) #4 0x10b11721b in handle_slave_io (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x100ea021b) #5 0x10b8d9c30 in pfs_spawn_thread (/Users/miguel/mysql-5.7.9/sql/mysqld-debug+0x101662c30) #6 0x7fff933929b0 in _pthread_body (/usr/lib/system/libsystem_pthread.dylib+0x39b0) #7 0x7fff9339292d in _pthread_start (/usr/lib/system/libsystem_pthread.dylib+0x392d) #8 0x7fff93390384 in thread_start (/usr/lib/system/libsystem_pthread.dylib+0x1384) <CUT>
[24 May 2017 9:54]
Erlend Dahl
This has been fixed in 8.0.2.