Backport #89139 to 25.8: Fix potential heap-use-after-free in projections analysis after #72102

robot-clickhouse · robot-clickhouse · commit b73cc9919880 · 2025-11-04T18:15:04.000Z
diff --git a/src/Storages/MergeTree/MergeTreeData.cpp b/src/Storages/MergeTree/MergeTreeData.cpp
@@ -8175,7 +8175,8 @@ Block MergeTreeData::getMinMaxCountProjectionBlock(
         {
             for (const auto & part : real_parts)
             {
-                const auto & primary_key_column = *part->getIndex()->at(0);
+                auto index = part->getIndex();
+                const auto & primary_key_column = *index->at(0);
                 auto & min_column = assert_cast<ColumnAggregateFunction &>(*partition_minmax_count_columns[pos]);
                 insert(min_column, primary_key_column[0]);
             }
@@ -8186,7 +8187,8 @@ Block MergeTreeData::getMinMaxCountProjectionBlock(
         {
             for (const auto & part : real_parts)
             {
-                const auto & primary_key_column = *part->getIndex()->at(0);
+                auto index = part->getIndex();
+                const auto & primary_key_column = *index->at(0);
                 auto & max_column = assert_cast<ColumnAggregateFunction &>(*partition_minmax_count_columns[pos]);
                 insert(max_column, primary_key_column[primary_key_column.size() - 1]);
             }

Original file line number	Diff line number	Diff line change
`@@ -8175,7 +8175,8 @@ Block MergeTreeData::getMinMaxCountProjectionBlock(`
`8175`	`8175`	`{`
`8176`	`8176`	`for (const auto & part : real_parts)`
`8177`	`8177`	`{`
`8178`		`- const auto & primary_key_column = *part->getIndex()->at(0);`
	`8178`	`+ auto index = part->getIndex();`
	`8179`	`+ const auto & primary_key_column = *index->at(0);`
`8179`	`8180`	`auto & min_column = assert_cast<ColumnAggregateFunction &>(*partition_minmax_count_columns[pos]);`
`8180`	`8181`	`insert(min_column, primary_key_column[0]);`
`8181`	`8182`	`}`
`@@ -8186,7 +8187,8 @@ Block MergeTreeData::getMinMaxCountProjectionBlock(`
`8186`	`8187`	`{`
`8187`	`8188`	`for (const auto & part : real_parts)`
`8188`	`8189`	`{`
`8189`		`- const auto & primary_key_column = *part->getIndex()->at(0);`
	`8190`	`+ auto index = part->getIndex();`
	`8191`	`+ const auto & primary_key_column = *index->at(0);`
`8190`	`8192`	`auto & max_column = assert_cast<ColumnAggregateFunction &>(*partition_minmax_count_columns[pos]);`
`8191`	`8193`	`insert(max_column, primary_key_column[primary_key_column.size() - 1]);`
`8192`	`8194`	`}`