Memory corruption in test_quick_select() in maria-5.1-wl21
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
Fix Released
|
Critical
|
Igor Babaev |
Bug Description
backtrace:
#8 0x006f5b9d in __libc_message () from /lib/libc.so.6
#9 0x006fbfe1 in malloc_printerr () from /lib/libc.so.6
#10 0x08716681 in my_no_flags_free (ptr=0xaf43440) at my_malloc.c:72
#11 0x087174f2 in free_root (root=0x9f965800, MyFlags=0) at my_alloc.c:364
#12 0x0837be32 in SQL_SELECT:
force_
#13 0x082e7b1b in get_quick_
#14 0x082e98d9 in make_join_
#15 0x082e2067 in JOIN::optimize (this=0xaf5aef8) at sql_select.cc:1029
#16 0x082e7843 in mysql_select (thd=0xae518d0, rref_pointer_
group=0x0, having=0x0, proc_param=0x0, select_
#17 0x0830cd08 in mysql_explain_union (thd=0xae518d0, unit=0xae52be0, result=0xaf42b20) at sql_select.cc:17200
#18 0x08286c4c in execute_
#19 0x0827d736 in mysql_execute_
#20 0x08288e46 in mysql_parse (thd=0xae518d0, rawbuf=0xaf4beb8 "EXPLAIN SELECT f2 FROM t1 WHERE ( f2 IN ( 1 , 255 ) OR f2 = 8 ) AND f1 IN ( 0 , 74 )",
length=84, found_semicolon
#21 0x0827b222 in dispatch_command (command=COM_QUERY, thd=0xae518d0, packet=0xaf0a629 "", packet_length=84) at sql_parse.cc:1269
#22 0x0827a47f in do_command (thd=0xae518d0) at sql_parse.cc:895
#23 0x08277490 in handle_
#24 0x00821919 in start_thread () from /lib/libpthread
#25 0x0076acce in clone () from /lib/libc.so.6
testcase:
--source include/
SET SESSION optimizer_
CREATE TABLE t1 (f1 int, f2 int, PRIMARY KEY (f2), KEY (f1)) ENGINE=InnoDB;
INSERT INTO t1 VALUES ('2','5'
SELECT f2 FROM t1 WHERE ( f2 IN ( 1 , 255 ) OR f2 = 8 ) AND f1 IN ( 0 , 74 );
Related branches
Changed in maria: | |
importance: | Undecided → Critical |
status: | New → Confirmed |
status: | Confirmed → In Progress |
Changed in maria: | |
status: | In Progress → Fix Committed |
Changed in maria: | |
status: | Fix Committed → Fix Released |
Valgrind warnings:
==19248== Invalid write of size 1 strmem. c:629) index_intersect (PARAM* , SEL_TREE*, double) (opt_range.cc:5351) :test_quick_ select( THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool) (opt_range.cc:3067) record_ count(THD* , SQL_SELECT*, st_table*, Bitmap<64u> const*, unsigned long long) (sql_select. cc:2600) statistics( JOIN*, TABLE_LIST*, Item*, st_dynamic_array*) (sql_select. cc:3037) cc:1029) lex_unit* , st_select_lex*) (sql_select. cc:2538) sqlcom_ select( THD*, TABLE_LIST*) (sql_parse.cc:5166) command( THD*) (sql_parse.cc:2340) command( enum_server_ command, THD*, char*, unsigned int) (sql_parse.cc:1269) one_connection (sql_connect. cc:1138) -2.12.1. so) 2.12.1. so) malloc. c:195) search_ best_index_ intersect( PARAM*, SEL_TREE*, st_common_ index_intersect ion_info* , st_partial_ index_intersect ion_info* , double) (opt_range.cc:4995) index_intersect (PARAM* , SEL_TREE*, double) (opt_range.cc:5339) :test_quick_ select( THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool) (opt_range.cc:3067) record_ count(THD* , SQL_SELECT*, st_table*, Bitmap<64u> const*, unsigned long long) (sql_select. cc:2600) statistics( JOIN*, TABLE_LIST*, Item*, st_dynamic_array*) (sql_select. cc:3037) cc:1029) lex_unit* , st_select_lex*) (sql_select. cc:2538) sqlcom_ select( THD*, TABLE_LIST*) (sql_parse.cc:5166) command( THD*) (sql_parse.cc:2340)
==19248== at 0x40081BD: memmove (mc_replace_
==19248== by 0x838021D: get_best_
==19248== by 0x837BB8E: SQL_SELECT:
==19248== by 0x82E7B1A: get_quick_
==19248== by 0x82E98D8: make_join_
==19248== by 0x82E2066: JOIN::optimize() (sql_select.
==19248== by 0x82E7842: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_
==19248== by 0x82DFF48: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:280)
==19248== by 0x8286DD9: execute_
==19248== by 0x827D735: mysql_execute_
==19248== by 0x8288E45: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6092)
==19248== by 0x827B221: dispatch_
==19248== by 0x827A47E: do_command(THD*) (sql_parse.cc:895)
==19248== by 0x827748F: handle_
==19248== by 0x821918: start_thread (in /lib/libpthread
==19248== by 0x76ACCD: clone (in /lib/libc-
==19248== Address 0x52d26b7 is 3 bytes after a block of size 20 alloc'd
==19248== at 0x4005BDC: malloc (vg_replace_
==19248== by 0x87164F3: my_malloc (my_malloc.c:38)
==19248== by 0x87170F6: alloc_root (my_alloc.c:165)
==19248== by 0x837F54A: prepare_
==19248== by 0x838015A: get_best_
==19248== by 0x837BB8E: SQL_SELECT:
==19248== by 0x82E7B1A: get_quick_
==19248== by 0x82E98D8: make_join_
==19248== by 0x82E2066: JOIN::optimize() (sql_select.
==19248== by 0x82E7842: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_
==19248== by 0x82DFF48: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:280)
==19248== by 0x8286DD9: execute_
==19248== by 0x827D735: mysql_execute_
==19248== by 0x8288...