freemandealer opened a new issue, #14319: URL: https://github.com/apache/doris/issues/14319
### Search before asking - [X] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues. ### Version updated master branch ### What's Wrong? ``` heap-buffer-overflow on address 0x602000631cb6 at pc 0x55fd3cc7aad2 bp 0x7f1a9c77b0c0 sp 0x7f1a9c77b0b0 READ of size 1 at 0x602000631cb6 thread T111 (_scanner_scan) #0 0x55fd3cc7aad1 in unsigned short doris::InListPredicateBase<(doris::PrimitiveType)23, (doris::PredicateType)7>::_base_evaluate<true, false>(doris::vectorized::IColumn const*, doris::vectorized::PODArray<unsigned char, 4096ul, Allocator<false, false>, 15ul, 16ul> const*, unsigned short*, unsigned short) const /mnt/disk1/yuejing/projects/doris/be/src/olap/in_list_predicate.h:423 #1 0x55fd3cb266be in doris::InListPredicateBase<(doris::PrimitiveType)23, (doris::PredicateType)7>::evaluate(doris::vectorized::IColumn const&, unsigned short*, unsigned short) const /mnt/disk1/yuejing/projects/doris/be/src/olap/in_list_predicate.h:201 #2 0x55fd3d81cba3 in doris::segment_v2::SegmentIterator::_evaluate_short_circuit_predicate(unsigned short*, unsigned short) /mnt/disk1/yuejing/projects/doris/be/src/olap/rowset/segment_v2/segment_iterator.cpp:1040 #3 0x55fd3d81ecb5 in doris::segment_v2::SegmentIterator::next_batch(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/olap/rowset/segment_v2/segment_iterator.cpp:1142 #4 0x55fd3e3a1e01 in doris::BetaRowsetReader::next_block(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/olap/rowset/beta_rowset_reader.cpp:276 #5 0x55fd477a402d in doris::vectorized::VCollectIterator::Level0Iterator::next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:261 #6 0x55fd477a87db in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:527 #7 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #8 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #9 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #10 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #11 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #12 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #13 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #14 0x55fd477a59de in doris::vectorized::VCollectIterator::Level1Iterator::next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:353 #15 0x55fd477a2400 in doris::vectorized::VCollectIterator::next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:181 #16 0x55fd47785f36 in doris::vectorized::BlockReader::_direct_next_block(doris::vectorized::Block*, doris::MemPool*, doris::ObjectPool*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/block_reader.cpp:167 #17 0x55fd3c92d308 in doris::vectorized::BlockReader::next_block_with_aggregation(doris::vectorized::Block*, doris::MemPool*, doris::ObjectPool*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/block_reader.h:45 #18 0x55fd47b07962 in doris::vectorized::NewOlapScanner::_get_block_impl(doris::RuntimeState*, doris::vectorized::Block*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/new_olap_scanner.cpp:309 #19 0x55fd479de258 in doris::vectorized::VScanner::get_block(doris::RuntimeState*, doris::vectorized::Block*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/vscanner.cpp:53 #20 0x55fd479b6b7f in doris::vectorized::ScannerScheduler::_scanner_scan(doris::vectorized::ScannerScheduler*, doris::vectorized::ScannerContext*, doris::vectorized::VScanner*) /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/scanner_scheduler.cpp:243 #21 0x55fd479b4852 in operator() /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/scanner_scheduler.cpp:146 #22 0x55fd479b8d71 in __invoke_impl<void, doris::vectorized::ScannerScheduler::_schedule_scanners(doris::vectorized::ScannerContext*)::<lambda()>&> /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:61 #23 0x55fd479b89e9 in __invoke_r<void, doris::vectorized::ScannerScheduler::_schedule_scanners(doris::vectorized::ScannerContext*)::<lambda()>&> /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:111 #24 0x55fd479b8456 in _M_invoke /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/std_function.h:291 #25 0x55fd3e4e26c3 in std::function<void ()>::operator()() const /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/std_function.h:560 #26 0x55fd3f03bb1d in doris::FunctionRunnable::run() /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:45 #27 0x55fd3f036969 in doris::ThreadPool::dispatch_thread() /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:534 #28 0x55fd3f0582eb in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:74 #29 0x55fd3f057b8a in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:96 #30 0x55fd3f056f29 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/functional:420 #31 0x55fd3f055a3a in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/functional:503 #32 0x55fd3f05262b in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:61 #33 0x55fd3f04fae3 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:111 #34 0x55fd3f04ade2 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()> >::_M_invoke(std::_Any_data const&) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/std_function.h:291 #35 0x55fd3e4e26c3 in std::function<void ()>::operator()() const /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/std_function.h:560 #36 0x55fd3f01660d in doris::Thread::supervise_thread(void*) /mnt/disk1/yuejing/projects/doris/be/src/util/thread.cpp:454 #37 0x7f1b67792608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477 #38 0x7f1b678cc132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) 0x602000631cb6 is located 0 bytes to the right of 6-byte region [0x602000631cb0,0x602000631cb6) allocated by thread T111 (_scanner_scan) here: #0 0x55fd3c10d707 in operator new(unsigned long) (/home/ubuntu/doris/output/be/lib/doris_be+0xca3d707) #1 0x55fd3caabbcf in __gnu_cxx::new_allocator<unsigned char>::allocate(unsigned long, void const*) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/ext/new_allocator.h:121 #2 0x55fd3ca872d0 in std::allocator_traits<std::allocator<unsigned char> >::allocate(std::allocator<unsigned char>&, unsigned long) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/alloc_traits.h:460 #3 0x55fd3ca69a2f in std::_Vector_base<unsigned char, std::allocator<unsigned char> >::_M_allocate(unsigned long) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/stl_vector.h:346 #4 0x55fd3ca5e2c8 in std::vector<unsigned char, std::allocator<unsigned char> >::_M_default_append(unsigned long) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/vector.tcc:635 #5 0x55fd3ca572f0 in std::vector<unsigned char, std::allocator<unsigned char> >::resize(unsigned long) /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/stl_vector.h:940 #6 0x55fd3ca4f8af in doris::vectorized::ColumnDictionary<int>::Dictionary::find_codes(phmap::flat_hash_set<doris::StringValue, phmap::Hash<doris::StringValue>, phmap::EqualTo<doris::StringValue>, std::allocator<doris::StringValue> > const&, std::vector<unsigned char, std::allocator<unsigned char> >&) const /mnt/disk1/yuejing/projects/doris/be/src/vec/columns/column_dictionary.h:386 #7 0x55fd3ca4e836 in doris::vectorized::ColumnDictionary<int>::find_codes(phmap::flat_hash_set<doris::StringValue, phmap::Hash<doris::StringValue>, phmap::EqualTo<doris::StringValue>, std::allocator<doris::StringValue> > const&, std::vector<unsigned char, std::allocator<unsigned char> >&) const /mnt/disk1/yuejing/projects/doris/be/src/vec/columns/column_dictionary.h:262 #8 0x55fd3cc7a96b in unsigned short doris::InListPredicateBase<(doris::PrimitiveType)23, (doris::PredicateType)7>::_base_evaluate<true, false>(doris::vectorized::IColumn const*, doris::vectorized::PODArray<unsigned char, 4096ul, Allocator<false, false>, 15ul, 16ul> const*, unsigned short*, unsigned short) const /mnt/disk1/yuejing/projects/doris/be/src/olap/in_list_predicate.h:408 #9 0x55fd3cb266be in doris::InListPredicateBase<(doris::PrimitiveType)23, (doris::PredicateType)7>::evaluate(doris::vectorized::IColumn const&, unsigned short*, unsigned short) const /mnt/disk1/yuejing/projects/doris/be/src/olap/in_list_predicate.h:201 #10 0x55fd3d81cba3 in doris::segment_v2::SegmentIterator::_evaluate_short_circuit_predicate(unsigned short*, unsigned short) /mnt/disk1/yuejing/projects/doris/be/src/olap/rowset/segment_v2/segment_iterator.cpp:1040 #11 0x55fd3d81ecb5 in doris::segment_v2::SegmentIterator::next_batch(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/olap/rowset/segment_v2/segment_iterator.cpp:1142 #12 0x55fd3e3a1e01 in doris::BetaRowsetReader::next_block(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/olap/rowset/beta_rowset_reader.cpp:276 #13 0x55fd477a402d in doris::vectorized::VCollectIterator::Level0Iterator::next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:261 #14 0x55fd477a87db in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:527 #15 0x55fd477a8a81 in doris::vectorized::VCollectIterator::Level1Iterator::_normal_next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:536 #16 0x55fd477a59de in doris::vectorized::VCollectIterator::Level1Iterator::next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:353 #17 0x55fd477a2400 in doris::vectorized::VCollectIterator::next(doris::vectorized::Block*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/vcollect_iterator.cpp:181 #18 0x55fd47785f36 in doris::vectorized::BlockReader::_direct_next_block(doris::vectorized::Block*, doris::MemPool*, doris::ObjectPool*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/block_reader.cpp:167 #19 0x55fd3c92d308 in doris::vectorized::BlockReader::next_block_with_aggregation(doris::vectorized::Block*, doris::MemPool*, doris::ObjectPool*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/olap/block_reader.h:45 #20 0x55fd47b07962 in doris::vectorized::NewOlapScanner::_get_block_impl(doris::RuntimeState*, doris::vectorized::Block*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/new_olap_scanner.cpp:309 #21 0x55fd479de258 in doris::vectorized::VScanner::get_block(doris::RuntimeState*, doris::vectorized::Block*, bool*) /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/vscanner.cpp:53 #22 0x55fd479b6b7f in doris::vectorized::ScannerScheduler::_scanner_scan(doris::vectorized::ScannerScheduler*, doris::vectorized::ScannerContext*, doris::vectorized::VScanner*) /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/scanner_scheduler.cpp:243 #23 0x55fd479b4852 in operator() /mnt/disk1/yuejing/projects/doris/be/src/vec/exec/scan/scanner_scheduler.cpp:146 #24 0x55fd479b8d71 in __invoke_impl<void, doris::vectorized::ScannerScheduler::_schedule_scanners(doris::vectorized::ScannerContext*)::<lambda()>&> /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:61 #25 0x55fd479b89e9 in __invoke_r<void, doris::vectorized::ScannerScheduler::_schedule_scanners(doris::vectorized::ScannerContext*)::<lambda()>&> /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/invoke.h:111 #26 0x55fd479b8456 in _M_invoke /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/std_function.h:291 #27 0x55fd3e4e26c3 in std::function<void ()>::operator()() const /mnt/disk1/yuejing/projects/ldb_toolchain/include/c++/11/bits/std_function.h:560 #28 0x55fd3f03bb1d in doris::FunctionRunnable::run() /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:45 #29 0x55fd3f036969 in doris::ThreadPool::dispatch_thread() /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:534 Thread T111 (_scanner_scan) created by T0 here: #0 0x55fd3c0b0061 in __interceptor_pthread_create (/home/ubuntu/doris/output/be/lib/doris_be+0xc9e0061) #1 0x55fd3f015965 in doris::Thread::start_thread(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::function<void ()> const&, unsigned long, scoped_refptr<doris::Thread>*) /mnt/disk1/yuejing/projects/doris/be/src/util/thread.cpp:408 #2 0x55fd3f0403d3 in doris::Status doris::Thread::create<void (doris::ThreadPool::*)(), doris::ThreadPool*>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, void (doris::ThreadPool::* const&)(), doris::ThreadPool* const&, scoped_refptr<doris::Thread>*) /mnt/disk1/yuejing/projects/doris/be/src/util/thread.h:57 #3 0x55fd3f0381b0 in doris::ThreadPool::create_thread() /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:603 #4 0x55fd3f031c1f in doris::ThreadPool::init() /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:262 #5 0x55fd3f02e460 in doris::ThreadPoolBuilder::build(std::unique_ptr<doris::ThreadPool, std::default_delete<doris::ThreadPool> >*) const /mnt/disk1/yuejing/projects/doris/be/src/util/threadpool.cpp:77 #6 0x55fd3e4c5c3b in doris::ExecEnv::_init(std::vector<doris::StorePath, std::allocator<doris::StorePath> > const&) /mnt/disk1/yuejing/projects/doris/be/src/runtime/exec_env_init.cpp:121 #7 0x55fd3e4c4c31 in doris::ExecEnv::init(doris::ExecEnv*, std::vector<doris::StorePath, std::allocator<doris::StorePath> > const&) /mnt/disk1/yuejing/projects/doris/be/src/runtime/exec_env_init.cpp:76 #8 0x55fd3c15ce5e in main /mnt/disk1/yuejing/projects/doris/be/src/service/doris_main.cpp:398 #9 0x7f1b677d1082 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/disk1/yuejing/projects/doris/be/src/olap/in_list_predicate.h:423 in unsigned short doris::InListPredicateBase<(doris::PrimitiveType)23, (doris::PredicateType)7>::_base_evaluate<true, false>(doris::vectorized::IColumn const*, doris::vectorized::PODArray<unsigned char, 4096ul, Allocator<false, false>, 15ul, 16ul> const*, unsigned short*, unsigned short) const Shadow bytes around the buggy address: 0x0c04800be340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c04800be350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fd fd 0x0c04800be360: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c04800be370: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c04800be380: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd =>0x0c04800be390: fa fa fd fd fa fa[06]fa fa fa 01 fa fa fa fd fd 0x0c04800be3a0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c04800be3b0: fa fa fa fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c04800be3c0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd 0x0c04800be3d0: fa fa fd fa fa fa fa fa fa fa fa fa fa fa fd fd 0x0c04800be3e0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa ``` ### What You Expected? successfully return result without crash ### How to Reproduce? create a table with nullable column `c_string` insert data, c_string column could be: ``` NULL a abc ``` query: ``` select c_string from test where c_string in ('a','abc'); ``` that will blow doris be away ### Anything Else? _No response_ ### Are you willing to submit PR? - [X] Yes I am willing to submit a PR! ### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org For additional commands, e-mail: commits-h...@doris.apache.org
