substring_index may lead tiflash crash in some corner cases

[windtalker]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

For substring_index(string, delim, count)
if the string contains n delims, where n >= 1 and n < count, and the string end with delim, then

tiflash/dbms/src/Functions/FunctionsString.cpp

Lines 5223 to 5233 in 9929b19

	while (pos < end)
	{
	const UInt8 * match = delim_searcher->search(pos, end - pos);
	--count;
	if (match == end || count == 0)
	{
	copyDataToResult(res_data, res_offset, begin, match);
	break;
	}
	pos = match + delim_size;
	}

When finding the last match of delim, if (match == end || count == 0) is false, so pos is updated to match + delim_size, since the string ends with delim, pos is actually equal to end, which makes pos < end false, and the function returns without calling copyDataToResult. This will make the result corrupt since copyDataToResult is expected to be called for every input row.

A simple reproduce is

mysql> drop table test;
Query OK, 0 rows affected (0.61 sec)

mysql> create table test(value varchar(512));
Query OK, 0 rows affected (0.25 sec)

mysql> insert into test values('aaa:bbb:');
Query OK, 1 row affected (0.03 sec)

mysql> insert into test select * from test;
Query OK, 1 row affected (0.01 sec)
Records: 1  Duplicates: 0  Warnings: 0

mysql> insert into test select * from test;
Query OK, 2 rows affected (0.01 sec)
Records: 2  Duplicates: 0  Warnings: 0

mysql> insert into test select * from test;
Query OK, 4 rows affected (0.02 sec)
Records: 4  Duplicates: 0  Warnings: 0

mysql> insert into test select * from test;
Query OK, 8 rows affected (0.02 sec)
Records: 8  Duplicates: 0  Warnings: 0

mysql> insert into test select * from test;
Query OK, 16 rows affected (0.04 sec)
Records: 16  Duplicates: 0  Warnings: 0

mysql> alter table test set tiflash replica 1;
Query OK, 0 rows affected (0.34 sec)

mysql> select aaa from ( select SUBSTRING_INDEX( SUBSTRING_INDEX( SUBSTRING_INDEX(value, ',', 1), ':', 3 ), ':', -1 ) as aaa from test ) tb_1 where aaa is not null;
ERROR 1105 (HY000): rpc error: code = Unavailable desc = error reading from server: EOF

2. What did you expect to see? (Required)

3. What did you see instead (Required)

4. What is your TiFlash version? (Required)