-
Notifications
You must be signed in to change notification settings - Fork 8.3k
arrayReverseFill: OOB access in PODArray #12263
Copy link
Copy link
Closed
Labels
bugConfirmed user-visible misbehaviour in official releaseConfirmed user-visible misbehaviour in official releasecrashCrash / segfault / abortCrash / segfault / abortfuzzProblem found by one of the fuzzersProblem found by one of the fuzzers
Description
SELECT arrayReverseFill(x -> (x < 10), [])
clickhouse-server: /home/akuzm/ch4/ch/src/Common/PODArray.h:342: const T &DB::PODArray<char8_t, 4096, Allocator<false, false>, 15, 16>::operator[](ssize_t) const [T = char8_t, initial_bytes = 4096, TAllocator = Allocator<false, false>, pad_right_ = 15, pad_left_ = 16]:
Assertion `(n >= (static_cast<ssize_t>(pad_left_) ? -1 : 0)) && (n <= static_cast<ssize_t>(this->size()))' failed.
2020.07.07 19:28:08.540578 [ 550727 ] {} <Trace> BaseDaemon: Received signal 6
2020.07.07 19:28:08.541237 [ 550799 ] {} <Fatal> BaseDaemon: ########################################
2020.07.07 19:28:08.542558 [ 550799 ] {} <Fatal> BaseDaemon: (version 20.6.1.1, build id: F176DE2A5C050ABF) (from thread 550787) (query_id: ba23b9b8-1c51-400c-88e0-8db4293edfbc) Received signal Aborted (6)
2020.07.07 19:28:08.542940 [ 550799 ] {} <Fatal> BaseDaemon:
2020.07.07 19:28:08.543265 [ 550799 ] {} <Fatal> BaseDaemon: Stack trace: 0x7fe6a5f1218b 0x7fe6a5ef1859 0x7fe6a5ef1729 0x7fe6a5f02f36 0x7fe6a4bf7d5d 0x7fe692353899 0x7fe692351ade 0x7fe69fd6bb6f 0x7fe6a0598e6b 0x7fe6a0599f3d 0x7fe6993c3753 0x7fe6993c6e83 0x7fe6950ffe4c 0x7fe697bc63c5 0x7fe695b99ea8 0x7fe6959c01ac 0x7fe6959c0120 0x7fe6959c00dd 0x7fe6959c008d 0x7fe6959c005d 0x7fe6959bf1ae 0x7fe6aa638ac5 0x7fe6aa638a65 0x7fe6959bd935 0x7fe6959be147 0x7fe6959bc680 0x7fe6959bbeca 0x7fe6959ea0fd
2020.07.07 19:28:08.543793 [ 550799 ] {} <Fatal> BaseDaemon: 4. /build/glibc-YYA7BZ/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51: raise @ 0x4618b in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.31.so
2020.07.07 19:28:08.544194 [ 550799 ] {} <Fatal> BaseDaemon: 5. /build/glibc-YYA7BZ/glibc-2.31/stdlib/abort.c:81: abort @ 0x25859 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.31.so
2020.07.07 19:28:08.544654 [ 550799 ] {} <Fatal> BaseDaemon: 6. /build/glibc-YYA7BZ/glibc-2.31/intl/loadmsgcat.c:509: _nl_load_domain.cold @ 0x25729 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.31.so
2020.07.07 19:28:08.545035 [ 550799 ] {} <Fatal> BaseDaemon: 7. ? @ 0x36f36 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.31.so
2020.07.07 19:28:08.546215 [ 550799 ] {} <Fatal> BaseDaemon: 8. /home/akuzm/ch4/ch/src/Common/PODArray.h:0: DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 15ul, 16ul>::operator[](long) const @ 0x24bad5d in /home/akuzm/ch4/build-clang10/src/AggregateFunctions/libclickhouse_aggregate_functionsd.so
2020.07.07 19:28:08.548311 [ 550799 ] {} <Fatal> BaseDaemon: 9. /home/akuzm/ch4/ch/src/Functions/array/arrayFill.cpp:52: DB::ArrayFillImpl<true>::execute(DB::ColumnArray const&, COW<DB::IColumn>::immutable_ptr<DB::IColumn>) @ 0x69f899 in /home/akuzm/ch4/build-clang10/src/Functions/array/libclickhouse_functions_arrayd.so
2020.07.07 19:28:08.550037 [ 550799 ] {} <Fatal> BaseDaemon: 10. /home/akuzm/ch4/ch/src/Functions/array/FunctionArrayMapped.h:232: DB::FunctionArrayMapped<DB::ArrayFillImpl<true>, DB::NameArrayReverseFill>::executeImpl(DB::Block&, std::__1::vector<unsigned long, std::__1::allocator<unsigned long> > const&, unsigned long, unsigned long) @ 0x69dade in /home/akuzm/ch4/build-clang10/src/Functions/array/libclickhouse_functions_arrayd.so
2020.07.07 19:28:08.550646 [ 550799 ] {} <Fatal> BaseDaemon: 11. /home/akuzm/ch4/ch/src/Functions/IFunctionAdaptors.h:152: DB::DefaultExecutable::execute(DB::Block&, std::__1::vector<unsigned long, std::__1::allocator<unsigned long> > const&, unsigned long, unsigned long) @ 0x2891b6f in /home/akuzm/ch4/build-clang10/src/Functions/libclickhouse_functionsd.so
2020.07.07 19:28:08.552150 [ 550799 ] {} <Fatal> BaseDaemon: 12. /home/akuzm/ch4/ch/src/Functions/IFunction.cpp:326: DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(DB::Block&, std::__1::vector<unsigned long, std::__1::allocator<unsigned long> > const&, unsigned long, unsigned long, bool) @ 0x30bee6b in /home/akuzm/ch4/build-clang10/src/Functions/libclickhouse_functionsd.so
2020.07.07 19:28:08.553665 [ 550799 ] {} <Fatal> BaseDaemon: 13. /home/akuzm/ch4/ch/src/Functions/IFunction.cpp:486: DB::ExecutableFunctionAdaptor::execute(DB::Block&, std::__1::vector<unsigned long, std::__1::allocator<unsigned long> > const&, unsigned long, unsigned long, bool) @ 0x30bff3d in /home/akuzm/ch4/build-clang10/src/Functions/libclickhouse_functionsd.so
2020.07.07 19:28:08.554765 [ 550799 ] {} <Fatal> BaseDaemon: 14. /home/akuzm/ch4/ch/src/Interpreters/ExpressionActions.cpp:365: DB::ExpressionAction::execute(DB::Block&, bool) const @ 0x1173753 in /home/akuzm/ch4/build-clang10/src/libclickhouse_interpretersd.so
2020.07.07 19:28:08.555913 [ 550799 ] {} <Fatal> BaseDaemon: 15. /home/akuzm/ch4/ch/src/Interpreters/ExpressionActions.cpp:684: DB::ExpressionActions::execute(DB::Block&, bool) const @ 0x1176e83 in /home/akuzm/ch4/build-clang10/src/libclickhouse_interpretersd.so
2020.07.07 19:28:08.556863 [ 550799 ] {} <Fatal> BaseDaemon: 16. /home/akuzm/ch4/ch/src/Processors/Transforms/ExpressionTransform.cpp:41: DB::ExpressionTransform::transform(DB::Chunk&) @ 0x232e4c in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_transformsd.so
2020.07.07 19:28:08.559718 [ 550799 ] {} <Fatal> BaseDaemon: 17. /home/akuzm/ch4/ch/src/Processors/ISimpleTransform.h:43: DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) @ 0xa623c5 in /home/akuzm/ch4/build-clang10/src/libclickhouse_storagesd.so
2020.07.07 19:28:08.560129 [ 550799 ] {} <Fatal> BaseDaemon: 18. /home/akuzm/ch4/ch/src/Processors/ISimpleTransform.cpp:89: DB::ISimpleTransform::work() @ 0x186ea8 in /home/akuzm/ch4/build-clang10/src/libclickhouse_processorsd.so
2020.07.07 19:28:08.560481 [ 550799 ] {} <Fatal> BaseDaemon: 19. /home/akuzm/ch4/ch/src/Processors/Executors/PipelineExecutor.cpp:155: DB::executeJob(DB::IProcessor*) @ 0x13f1ac in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.560798 [ 550799 ] {} <Fatal> BaseDaemon: 20. /home/akuzm/ch4/ch/src/Processors/Executors/PipelineExecutor.cpp:172: DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1::operator()() const @ 0x13f120 in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.561157 [ 550799 ] {} <Fatal> BaseDaemon: 21. /home/akuzm/ch4/ch/contrib/libcxx/include/type_traits:3519: decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1&>(DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1&) @ 0x13f0dd in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.561492 [ 550799 ] {} <Fatal> BaseDaemon: 22. /home/akuzm/ch4/ch/contrib/libcxx/include/__functional_base:349: void std::__1::__invoke_void_return_wrapper<void>::__call<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1&>(DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1&) @ 0x13f08d in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.561816 [ 550799 ] {} <Fatal> BaseDaemon: 23. /home/akuzm/ch4/ch/contrib/libcxx/include/functional:1540: std::__1::__function::__alloc_func<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1, std::__1::allocator<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1>, void ()>::operator()() @ 0x13f05d in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.562156 [ 550799 ] {} <Fatal> BaseDaemon: 24. /home/akuzm/ch4/ch/contrib/libcxx/include/functional:1714: std::__1::__function::__func<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1, std::__1::allocator<DB::PipelineExecutor::addJob(DB::PipelineExecutor::ExecutionState*)::$_1>, void ()>::operator()() @ 0x13e1ae in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.563696 [ 550799 ] {} <Fatal> BaseDaemon: 25. /home/akuzm/ch4/ch/contrib/libcxx/include/functional:1867: std::__1::__function::__value_func<void ()>::operator()() const @ 0x1cdac5 in /home/akuzm/ch4/build-clang10/programs/server/libclickhouse-server-libd.so
2020.07.07 19:28:08.565434 [ 550799 ] {} <Fatal> BaseDaemon: 26. /home/akuzm/ch4/ch/contrib/libcxx/include/functional:2473: std::__1::function<void ()>::operator()() const @ 0x1cda65 in /home/akuzm/ch4/build-clang10/programs/server/libclickhouse-server-libd.so
2020.07.07 19:28:08.565906 [ 550799 ] {} <Fatal> BaseDaemon: 27. /home/akuzm/ch4/ch/src/Processors/Executors/PipelineExecutor.cpp:633: DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) @ 0x13c935 in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.566327 [ 550799 ] {} <Fatal> BaseDaemon: 28. /home/akuzm/ch4/ch/src/Processors/Executors/PipelineExecutor.cpp:546: DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) @ 0x13d147 in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.566605 [ 550799 ] {} <Fatal> BaseDaemon: 29. /home/akuzm/ch4/ch/src/Processors/Executors/PipelineExecutor.cpp:812: DB::PipelineExecutor::executeImpl(unsigned long) @ 0x13b680 in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.566868 [ 550799 ] {} <Fatal> BaseDaemon: 30. /home/akuzm/ch4/ch/src/Processors/Executors/PipelineExecutor.cpp:479: DB::PipelineExecutor::execute(unsigned long) @ 0x13aeca in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
2020.07.07 19:28:08.567167 [ 550799 ] {} <Fatal> BaseDaemon: 31. /home/akuzm/ch4/ch/src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:79: DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) @ 0x1690fd in /home/akuzm/ch4/build-clang10/src/libclickhouse_processors_executorsd.so
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugConfirmed user-visible misbehaviour in official releaseConfirmed user-visible misbehaviour in official releasecrashCrash / segfault / abortCrash / segfault / abortfuzzProblem found by one of the fuzzersProblem found by one of the fuzzers