Bug #85994 Out-of-bounds read in mysqld.cc fix_paths

• Submitted: 19 Apr 2017 2:39
• Modified: 24 Apr 2017 18:01
• Reporter: Laurynas Biveinis (OCA)
• Status: Closed
• Category: MySQL Server: Options
• Severity: S3 (Non-critical)
• Version: 8.0.1
• OS: Any
• CPU Architecture: Any

[19 Apr 2017 2:39] Laurynas Biveinis

Description:
cmake ... -DWITH_DEBUG=ON -DWITH_ASAN=ON
./mtr --debug-server undo_space_id --big-test
...
innodb_undo.undo_space_id                [ fail ]
        Test ended at 2017-04-19 05:35:04

CURRENT_TEST: innodb_undo.undo_space_id
mysqltest: At line 29: command "$NEW_CMD" failed

Output from before failure:
exec of '/home/laurynas/obj-8.0-asan-debug-openssl/sql/mysqld-debug --no-defaults --initialize-insecure --plugin-dir=/home/laurynas/obj-8.0-asan-debug-openssl/plugin_output_directory --lc_messages_dir=/home/laurynas/obj-8.0-asan-debug-openssl/sql/share --basedir= --datadir=/home/laurynas/obj-8.0-asan-debug-openssl/mysql-test/var/tmp/datadir1/data --debug=d,innodb_undo_upgrade --innodb_log_file_size=5M --innodb_log_files_in_group=2 --init-file=/home/laurynas/obj-8.0-asan-debug-openssl/mysql-test/var/tmp/boot.sql --innodb_undo_tablespaces=2 --secure-file-priv="" </dev/null>>/home/laurynas/obj-8.0-asan-debug-openssl/mysql-test/var/tmp/bootstrap.log 2>&1' failed, error: 256, status: 1, errno: 0

var/tmp/bootstrap.log contains

=================================================================
==1301==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55b97ab287ff at pc 0x55b976beb486 bp 0x7ffe73598290 sp 0x7ffe73598280
READ of size 1 at 0x55b97ab287ff thread T0
    #0 0x55b976beb485 in fix_paths /home/laurynas/mysql-server/sql/mysqld.cc:8984
    #1 0x55b976bf5b7d in get_options /home/laurynas/mysql-server/sql/mysqld.cc:8641
    #2 0x55b976bf5b7d in init_common_variables() /home/laurynas/mysql-server/sql/mysqld.cc:3298
    #3 0x55b976bfb311 in mysqld_main(int, char**) /home/laurynas/mysql-server/sql/mysqld.cc:5293
    #4 0x55b976be5208 in main /home/laurynas/mysql-server/sql/main.cc:25
    #5 0x7f4aa2dcf3f0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x203f0)
    #6 0x55b976be50f9 in _start (/home/laurynas/obj-8.0-asan-debug-openssl/sql/mysqld-debug+0xe9c0f9)

0x55b97ab287ff is located 1 bytes to the left of global variable 'mysql_home' defined in '/home/laurynas/mysql-server/sql/mysqld.cc:1006:6' (0x55b97ab28800) of size 512
0x55b97ab287ff is located 31 bytes to the right of global variable 'pidfile_name' defined in '/home/laurynas/mysql-server/sql/mysqld.cc:1006:29' (0x55b97ab285e0) of size 512
SUMMARY: AddressSanitizer: global-buffer-overflow /home/laurynas/mysql-server/sql/mysqld.cc:8984 in fix_paths
...

How to repeat:
See above

[19 Apr 2017 5:50] MySQL Verification Team

Hello Laurynas,

Thank you for the report.

Thanks,
Umesh

[24 Apr 2017 18:01] Paul DuBois

Posted by developer:
 
Noted in 8.0.2 changelog.

mysqld misbehaved if compiled with AddressSanitizer enabled and
invoked with --basedir= (that is, with an empty option value).