MDEV-38861 heap-use-after-free in Prepared_statement::execute()

DROP PROCEDURE and CREATE OR REPLACE PROCEDURE executed from inside the
routine itself removed it from the SP cache. sp_head::destroy() then freed
the memory root that the running sp_head, its LEX and its instructions
live in, and the caller kept using them.

Skip the removal while the routine is being executed. sp_cache_invalidate()
above has already bumped the cache version, so the stale entry is removed by
the next lookup, after IS_INVOKED has been cleared.

Author: KhaledR57

mysql-test/main/sp-bugs.result

@@ -400,6 +400,69 @@ DROP FUNCTION f;
 # End of 10.5 tests
 #
 #
+# MDEV-38861 heap-use-after-free in Prepared_statement::execute()
+#
+# A routine must not be removed from the SP cache while it is executing.
+#
+# DROP of the running routine
+create procedure p0()
+begin
+prepare stmt from "drop procedure p0";
+execute stmt;
+end$$
+call p0();
+call p0();
+ERROR 42000: PROCEDURE test.p0 does not exist
+deallocate prepare stmt;
+# CREATE OR REPLACE of the running routine
+create procedure p0()
+begin
+prepare stmt from "create or replace procedure p0() begin select 1 as replaced; end";
+execute stmt;
+end$$
+call p0();
+call p0();
+replaced
+1
+deallocate prepare stmt;
+drop procedure p0;
+# Recursive call after the self-DROP, with the default recursion depth
+set @save_depth=@@max_sp_recursion_depth;
+set @@max_sp_recursion_depth=0;
+create procedure p0()
+begin
+prepare stmt from "drop procedure p0";
+execute stmt;
+call p0();
+end$$
+call p0();
+ERROR HY000: Recursive limit 0 (as set by the max_sp_recursion_depth variable) was exceeded for routine p0
+call p0();
+ERROR 42000: PROCEDURE test.p0 does not exist
+deallocate prepare stmt;
+set @@max_sp_recursion_depth=@save_depth;
+# DROP of the caller, which then keeps running
+create procedure outer_p()
+begin
+call inner_p();
+select 'outer survived' as state;
+end$$
+create procedure inner_p()
+begin
+prepare stmt from "drop procedure outer_p";
+execute stmt;
+end$$
+call outer_p();
+state
+outer survived
+call outer_p();
+ERROR 42000: PROCEDURE test.outer_p does not exist
+deallocate prepare stmt;
+drop procedure inner_p;
+#
+# End of 11.4 tests
+#
+#
 # MDEV-36876 Crash during the Item_subselect::init - outer_select is NULL
 #
 # Vectors are not allowed for SOME/ANY

mysql-test/main/sp-bugs.test

@@ -438,6 +438,79 @@ DROP FUNCTION f;
 --echo # End of 10.5 tests
 --echo #
 
+--echo #
+--echo # MDEV-38861 heap-use-after-free in Prepared_statement::execute()
+--echo #
+--echo # A routine must not be removed from the SP cache while it is executing.
+--echo #
+
+--echo # DROP of the running routine
+delimiter $$;
+create procedure p0()
+begin
+  prepare stmt from "drop procedure p0";
+  execute stmt;
+end$$
+delimiter ;$$
+call p0();
+--error ER_SP_DOES_NOT_EXIST
+call p0();
+deallocate prepare stmt;
+
+--echo # CREATE OR REPLACE of the running routine
+delimiter $$;
+create procedure p0()
+begin
+  prepare stmt from "create or replace procedure p0() begin select 1 as replaced; end";
+  execute stmt;
+end$$
+delimiter ;$$
+call p0();
+call p0();
+deallocate prepare stmt;
+drop procedure p0;
+
+--echo # Recursive call after the self-DROP, with the default recursion depth
+set @save_depth=@@max_sp_recursion_depth;
+set @@max_sp_recursion_depth=0;
+delimiter $$;
+create procedure p0()
+begin
+  prepare stmt from "drop procedure p0";
+  execute stmt;
+  call p0();
+end$$
+delimiter ;$$
+--error ER_SP_RECURSION_LIMIT
+call p0();
+--error ER_SP_DOES_NOT_EXIST
+call p0();
+deallocate prepare stmt;
+set @@max_sp_recursion_depth=@save_depth;
+
+--echo # DROP of the caller, which then keeps running
+delimiter $$;
+create procedure outer_p()
+begin
+  call inner_p();
+  select 'outer survived' as state;
+end$$
+create procedure inner_p()
+begin
+  prepare stmt from "drop procedure outer_p";
+  execute stmt;
+end$$
+delimiter ;$$
+call outer_p();
+--error ER_SP_DOES_NOT_EXIST
+call outer_p();
+deallocate prepare stmt;
+drop procedure inner_p;
+
+--echo #
+--echo # End of 11.4 tests
+--echo #
+
 --echo #
 --echo # MDEV-36876 Crash during the Item_subselect::init - outer_select is NULL
 --echo #

mysql-test/suite/compat/oracle/r/sp-package.result

@@ -3381,3 +3381,42 @@ DROP TABLE t1;
 DROP FUNCTION f1_deterministic;
 DROP FUNCTION f2_not_deterministic;
 DROP PACKAGE pkg1;
+#
+# MDEV-38861 heap-use-after-free in Prepared_statement::execute()
+#
+SET sql_mode=ORACLE;
+# DROP PACKAGE BODY of the running package
+CREATE PACKAGE pkg AS
+PROCEDURE p1;
+END$$
+CREATE PACKAGE BODY pkg AS
+PROCEDURE p1 AS
+BEGIN
+EXECUTE IMMEDIATE 'DROP PACKAGE BODY pkg';
+SELECT 'body survived' AS state;
+END;
+END$$
+CALL pkg.p1();
+state
+body survived
+CALL pkg.p1();
+ERROR 42000: PROCEDURE test.pkg.p1 does not exist
+DROP PACKAGE pkg;
+# CREATE OR REPLACE PACKAGE BODY of the running package
+CREATE PACKAGE pkg AS
+PROCEDURE p1;
+END$$
+CREATE PACKAGE BODY pkg AS
+PROCEDURE p1 AS
+BEGIN
+EXECUTE IMMEDIATE 'CREATE OR REPLACE PACKAGE BODY pkg AS PROCEDURE p1 AS BEGIN SELECT ''replaced'' AS state; END; END';
+SELECT 'body survived' AS state;
+END;
+END$$
+CALL pkg.p1();
+state
+body survived
+CALL pkg.p1();
+state
+replaced
+DROP PACKAGE pkg;

mysql-test/suite/compat/oracle/t/sp-package.test

@@ -3109,3 +3109,44 @@ DROP TABLE t1;
 DROP FUNCTION f1_deterministic;
 DROP FUNCTION f2_not_deterministic;
 DROP PACKAGE pkg1;
+
+--echo #
+--echo # MDEV-38861 heap-use-after-free in Prepared_statement::execute()
+--echo #
+
+SET sql_mode=ORACLE;
+
+--echo # DROP PACKAGE BODY of the running package
+DELIMITER $$;
+CREATE PACKAGE pkg AS
+  PROCEDURE p1;
+END$$
+CREATE PACKAGE BODY pkg AS
+  PROCEDURE p1 AS
+  BEGIN
+    EXECUTE IMMEDIATE 'DROP PACKAGE BODY pkg';
+    SELECT 'body survived' AS state;
+  END;
+END$$
+DELIMITER ;$$
+CALL pkg.p1();
+--error ER_SP_DOES_NOT_EXIST
+CALL pkg.p1();
+DROP PACKAGE pkg;
+
+--echo # CREATE OR REPLACE PACKAGE BODY of the running package
+DELIMITER $$;
+CREATE PACKAGE pkg AS
+  PROCEDURE p1;
+END$$
+CREATE PACKAGE BODY pkg AS
+  PROCEDURE p1 AS
+  BEGIN
+    EXECUTE IMMEDIATE 'CREATE OR REPLACE PACKAGE BODY pkg AS PROCEDURE p1 AS BEGIN SELECT ''replaced'' AS state; END; END';
+    SELECT 'body survived' AS state;
+  END;
+END$$
+DELIMITER ;$$
+CALL pkg.p1();
+CALL pkg.p1();
+DROP PACKAGE pkg;

sql/sp.cc

@@ -1148,7 +1148,8 @@ Sp_handler::sp_drop_routine_internal(THD *thd,
   sp_head *sp;
   sp_cache **spc= get_cache(thd);
   DBUG_ASSERT(spc);
-  if ((sp= sp_cache_lookup(spc, name)))
+  /* Removing a running routine would free the LEX being executed */
+  if ((sp= sp_cache_lookup(spc, name)) && !sp->is_invoked())
     sp_cache_remove(spc, &sp);
   /* Drop statistics for this stored program from performance schema. */
   MYSQL_DROP_SP(type(), name->m_db.str, static_cast<uint>(name->m_db.length),