branch-3.1: [Bug](function) fix bitmap_from_base64 function cause heap-buffer-overflow error #53018 #53045
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…rflow error (#53018) ### What problem does this PR solve? Problem Summary: ``` ==2403213==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506001097220 at pc 0x55837edd7fe9 bp 0x7f7efe2dc830 sp 0x7f7efe2dbff8 READ of size 63 at 0x506001097220 thread T1262 (brpc_light) #0 0x55837edd7fe8 in strlen (/mnt/disk8/zhangsida/doris/output/be/lib/doris_be+0x2c8d7fe8) (BuildId: 5acbe48773972a88) #1 0x5583bd3ff969 in fmt::v7::detail::buffer_appender<char> fmt::v7::detail::write<char, fmt::v7::detail::buffer_appender<char>>(fmt::v7::detail::buffer_appender<char>, char const*) (/mnt/disk8/zhangsida/doris/output/be/lib/doris_be+0x6aeff969) (BuildId: 5acbe48773972a88) #2 0x5583bd41640e in char const* fmt::v7::detail::parse_replacement_field<char, fmt::v7::detail::format_handler<fmt::v7::detail::buffer_appender<char>, char, fmt::v7::basic_format_context<fmt::v7::detail::buffer_appender<char>, char>>&>(char const*, char const*, fmt::v7::detail::format_handler<fmt::v7::detail::buffer_appender<char>, char, fmt::v7::basic_format_context<fmt::v7::detail::buffer_appender<char>, char>>&) (/mnt/disk8/zhangsida/doris/output/be/lib/doris_be+0x6af1640e) (BuildId: 5acbe48773972a88) #3 0x5583bd416c7f in void fmt::v7::detail::vformat_to<char>(fmt::v7::detail::buffer<char>&, fmt::v7::basic_string_view<char>, fmt::v7::basic_format_args<fmt::v7::basic_format_context<fmt::v7::detail::buffer_appender<fmt::v7::type_identity<char>::type>, fmt::v7::type_identity<char>::type>>, fmt::v7::detail::locale_ref) (/mnt/disk8/zhangsida/doris/output/be/lib/doris_be+0x6af16c7f) (BuildId: 5acbe48773972a88) #4 0x5583bd3f74aa in fmt::v7::detail::vformat[abi:cxx11](fmt::v7::basic_string_view<char>, fmt::v7::format_args) (/mnt/disk8/zhangsida/doris/output/be/lib/doris_be+0x6aef74aa) (BuildId: 5acbe48773972a88) #5 0x5583a6b4d3bb in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> fmt::v7::format<char [45], char const*&, char>(char const (&) [45], char const*&) /mnt/disk8/zhangsida/doris/thirdparty/installed/include/fmt/core.h:2076:10 #6 0x5583a6b4d3bb in doris::vectorized::BitmapFromBase64::vector(doris::vectorized::PODArray<unsigned char, 4096ul, doris::Allocator<false, false, false, doris::NoTrackingDefaultMemoryAllocator>, 16ul, 15ul> const&, doris::vectorized::PODArray<unsigned int, 4096ul, doris::Allocator<false, false, false, doris::NoTrackingDefaultMemoryAllocator>, 16ul, 15ul> const&, std::vector<doris::BitmapValue, std::allocator<doris::BitmapValue>>&, doris::vectorized::PODArray<unsigned char, 4096ul, doris::Allocator<false, false, false, doris::NoTrackingDefaultMemoryAllocator>, 16ul, 15ul>&, unsigned long) /mnt/disk8/zhangsida/doris/be/src/vec/functions/function_bitmap.cpp:310:29 #7 0x5583a6b4b93b in doris::vectorized::FunctionBitmapAlwaysNull<doris::vectorized::BitmapFromBase64>::execute_impl(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function_bitmap.cpp:381:13 #8 0x5583a02062ef in doris::vectorized::DefaultExecutable::execute_impl(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.h:459:26 #9 0x5583a49d77e3 in doris::vectorized::PreparedFunctionImpl::_execute_skipped_constant_deal(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp #10 0x5583a49d0bf8 in doris::vectorized::PreparedFunctionImpl::default_implementation_for_constant_arguments(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool, bool*) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp:168:5 #11 0x5583a49d3324 in doris::vectorized::PreparedFunctionImpl::execute_without_low_cardinality_columns(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp:237:5 ```
Contributor
|
run buildall |
TPC-H: Total hot run time: 40098 ms |
TPC-DS: Total hot run time: 191366 ms |
ClickBench: Total hot run time: 29.69 s |
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
morrySnow
approved these changes
Jul 11, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-picked from #53018