xiaokang opened a new pull request, #241:
URL: https://github.com/apache/doris-thirdparty/pull/241
It should only the length passed from argument, instead of `length + 1`,
which may cause ASAN global-buffer-overflow.
```
void init(const void *_value, int32_t _length, bool copyData = true)
override {
const size_t length = _length;
this->pos = 0;
if (copyData) {
T *tmp = (T *) this->value;
if (tmp == NULL || !this->ownValue) {
tmp = _CL_NEWARRAY(T, length + 1);
this->buffer_size = length;
} else if (length > this->buffer_size || length <
(this->buffer_size / 2)) {//expand, or shrink
tmp = (T *) realloc(tmp, sizeof(T) * (length + 1));
this->buffer_size = length;
}
memcpy(tmp, _value, length + 1); ///////////////// THIS IS THE
BUGGY LINE //////////
this->value = tmp;
} else {
if (ownValue && this->value != NULL) {
_CLDELETE_LARRAY((T *) this->value);
}
this->value = (T *)_value;
this->buffer_size = 0;
}
this->m_size = length;
this->ownValue = copyData;
};
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For additional commands, e-mail: commits-h...@doris.apache.org
