Fuzzer #3113: Lead Lag Shift

Don't shift more default values than actually exist. fixes: duckdb/duckdb-fuzzer#3113
hawkfish · Aug 6, 2024 · 755d711 · 755d711
1 parent aef7bf2
commit 755d711
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/src/execution/window_executor.cpp b/src/execution/window_executor.cpp
@@ -1682,9 +1682,10 @@ void WindowLeadLagExecutor::EvaluateInternal(WindowExecutorGlobalState &gstate,
 				i += width;
 				row_idx += width;
 			} else if (wexpr.default_expr) {
-				llstate.leadlag_default.CopyCell(result, i, delta);
-				i += delta;
-				row_idx += delta;
+				const auto width = MinValue(delta, count - i);
+				llstate.leadlag_default.CopyCell(result, i, width);
+				i += width;
+				row_idx += width;
 			} else {
 				for (idx_t nulls = MinValue(delta, count - i); nulls--; ++i, ++row_idx) {
 					FlatVector::SetNull(result, i, true);

diff --git a/test/fuzzer/sqlsmith/window-leadlag-overflow.test b/test/fuzzer/sqlsmith/window-leadlag-overflow.test
@@ -10,3 +10,6 @@ SELECT lag(c16, COLUMNS(*)) OVER (ROWS BETWEEN 1768 FOLLOWING AND UNBOUNDED FOLL
 FROM all_types AS t42(c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31, c32, c33, c34, c35, c36, c37, c38, c39, c40, c41)
 ----
 Overflow in subtraction
+
+statement ok
+SELECT lead('1e668c84-6cbc-4d41-843e-970c17446f9e', 8479, 3087) OVER (PARTITION BY 9136)