Baymine opened a new issue, #66033: URL: https://github.com/apache/doris/issues/66033
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues. ### Version master / 4.0 ### What's Wrong? When the `explode_bitmap` table function processes a bitmap whose cardinality exceeds `INT_MAX` (more than ~2.1 billion elements), the BE crashes with a core dump. In `VExplodeBitmapTableFunction::get_value` (be/src/exprs/table_function/vexplode_bitmap.cpp) the number of rows to emit is computed as: max_step = std::min(max_step, (int)(_cur_size - _cur_offset)); `_cur_size` (the bitmap cardinality) and `_cur_offset` are both `int64_t`. When `_cur_size - _cur_offset` is larger than `INT_MAX`, the C-style `(int)` cast overflows and produces a negative `max_step`. That negative value then flows into `target->resize(origin_size + max_step)`, underflowing the size computation and crashing the BE. ### What You Expected? `explode_bitmap` should correctly explode very large bitmaps (or at minimum not crash the BE) instead of overflowing the row-count computation. ### How to Reproduce? Call `explode_bitmap` on a `BITMAP` whose cardinality exceeds `INT_MAX` (~2.1 billion distinct values). Note this needs a very large bitmap (~16GB of memory) to actually trip the overflow, so it is hard to reproduce on modest hardware; the defect is evident from the code path regardless. ### Anything Else? The `std::min` should be evaluated in `int64_t` space and only cast back to `int` once it is provably within range. ### Are you willing to submit PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
