[doris] branch branch-1.1-lts updated: [fix](expr) avoid crashing caused by big depth of expression tree (#17346)

[yiguolei]

This is an automated email from the ASF dual-hosted git repository.

yiguolei pushed a commit to branch branch-1.1-lts
in repository https://gitbox.apache.org/repos/asf/doris.git


The following commit(s) were added to refs/heads/branch-1.1-lts by this push:
     new 4fa566f896 [fix](expr) avoid crashing caused by big depth of 
expression tree (#17346)
4fa566f896 is described below

commit 4fa566f8967c7e1ca2a8cf73c36f2cecc56af552
Author: Jerry Hu <mrh...@gmail.com>
AuthorDate: Thu Mar 2 21:50:35 2023 +0800

    [fix](expr) avoid crashing caused by big depth of expression tree (#17346)
---
 be/src/common/config.h           |  3 +++
 be/src/vec/exprs/vexpr.cpp       | 13 +++++++++++--
 be/src/vec/exprs/vexpr_context.h |  3 +++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/be/src/common/config.h b/be/src/common/config.h
index ba117fe1af..762802c957 100644
--- a/be/src/common/config.h
+++ b/be/src/common/config.h
@@ -745,6 +745,9 @@ CONF_mInt32(max_fragment_start_wait_time_seconds, "30");
 
 // limit the queue of pending batches which will be sent by a single 
nodechannel
 CONF_mInt64(nodechannel_pending_queue_max_bytes, "67108864");
+
+// max depth of expression tree allowed.
+CONF_Int32(max_depth_of_expr_tree, "200");
 } // namespace config
 
 } // namespace doris
diff --git a/be/src/vec/exprs/vexpr.cpp b/be/src/vec/exprs/vexpr.cpp
index a8a04d8d0d..6fbdfb1fa7 100644
--- a/be/src/vec/exprs/vexpr.cpp
+++ b/be/src/vec/exprs/vexpr.cpp
@@ -28,10 +28,10 @@
 #include "vec/exprs/vcompound_pred.h"
 #include "vec/exprs/vectorized_fn_call.h"
 #include "vec/exprs/vin_predicate.h"
-#include "vec/exprs/vtuple_is_null_predicate.h"
+#include "vec/exprs/vinfo_func.h"
 #include "vec/exprs/vliteral.h"
 #include "vec/exprs/vslot_ref.h"
-#include "vec/exprs/vinfo_func.h"
+#include "vec/exprs/vtuple_is_null_predicate.h"
 
 namespace doris::vectorized {
 using doris::Status;
@@ -62,9 +62,18 @@ VExpr::VExpr(const TypeDescriptor& type, bool is_slotref, 
bool is_nullable)
 }
 
 Status VExpr::prepare(RuntimeState* state, const RowDescriptor& row_desc, 
VExprContext* context) {
+    ++context->_depth_num;
+    if (context->_depth_num > config::max_depth_of_expr_tree) {
+        return Status::InternalError(
+                fmt::format("The depth of the expression tree is too big, make 
it less than {}",
+                            config::max_depth_of_expr_tree));
+    }
+
     for (int i = 0; i < _children.size(); ++i) {
         RETURN_IF_ERROR(_children[i]->prepare(state, row_desc, context));
     }
+
+    --context->_depth_num;
     return Status::OK();
 }
 
diff --git a/be/src/vec/exprs/vexpr_context.h b/be/src/vec/exprs/vexpr_context.h
index 54b47d7d1b..5e606d9c79 100644
--- a/be/src/vec/exprs/vexpr_context.h
+++ b/be/src/vec/exprs/vexpr_context.h
@@ -92,5 +92,8 @@ private:
     std::unique_ptr<MemPool> _pool;
 
     int _last_result_column_id;
+
+    /// The depth of expression-tree.
+    int _depth_num = 0;
 };
 } // namespace doris::vectorized


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For additional commands, e-mail: commits-h...@doris.apache.org