Skip to content

arrayStringConcat | arrayMap + ubsan #19376

@nikitamikhaylov

Description

@nikitamikhaylov

Describe the bug
Sanitizer died without any info (except stacktrace) of what happened.

How to reproduce

SELECT arrayStringConcat(arrayMap(x -> transform(x, [1025, -9223372036854775808, 65537, 257, 1048576, 10, 7, 1048575, 65536], ['yandex', 'googlegooglegooglegoogle', 'test', '', '', 'hello', 'world', '', 'xyz'], ''), arrayMap(x -> (x % -inf), range(number))), '')
FROM system.numbers
LIMIT 1025

Error message and/or stacktrace

[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.162550 [ 144 ] <Fatal> BaseDaemon: ########################################
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.162651 [ 144 ] <Fatal> BaseDaemon: (version 21.1.1.5710, build id: BD338362C5B02B66ADA8E69227E73F4708363058) (from thread 131) (query_id: fe7de6de-0452-4024-b847-ebba579e6f7d) Received signal Unknown signal (-3)
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.162690 [ 144 ] <Fatal> BaseDaemon: Sanitizer trap.
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.162766 [ 144 ] <Fatal> BaseDaemon: Stack trace: 0xdfee3e5 0xe2177f6 0xdfb24d6 0xdfbff6f 0x163825e6 0x162230fd 0x16207226 0x117e9897 0x12298a2c 0x1229994e 0x198be4d4 0x198bdac0 0x198bfc6f 0x19f791cd 0x12298a2c 0x1229994e 0x1208b365 0x1a2db3eb 0x171aece7 0x117e9897 0x12298a2c 0x1229994e 0x198be4d4 0x198bdac0 0x1ae59a4e 0x1a512392 0x1ac42b80 0x1ac924b9 0x1ac923a7 0x1ac90db4 0x1ac8f68a 0x1ac8f14b
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.162919 [ 144 ] <Fatal> BaseDaemon: 0. ./obj-x86_64-linux-gnu/../src/Common/StackTrace.cpp:293: StackTrace::StackTrace() @ 0xdfee3e5 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.163296 [ 144 ] <Fatal> BaseDaemon: 1. ./obj-x86_64-linux-gnu/../base/daemon/BaseDaemon.cpp:380: sanitizerDeathCallback() @ 0xe2177f6 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.168024 [ 144 ] <Fatal> BaseDaemon: 2. __sanitizer::Die() @ 0xdfb24d6 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.172536 [ 144 ] <Fatal> BaseDaemon: 3. ? @ 0xdfbff6f in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.177022 [ 144 ] <Fatal> BaseDaemon: 4. bool DB::(anonymous namespace)::FunctionTransform::executeNumToStringWithConstDefault<double>(DB::ColumnVector<double> const*, DB::IColumn*) const @ 0x163825e6 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.181373 [ 144 ] <Fatal> BaseDaemon: 5. bool DB::(anonymous namespace)::FunctionTransform::executeNum<double>(DB::IColumn const*, DB::IColumn*, DB::IColumn const*) const @ 0x162230fd in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.185769 [ 144 ] <Fatal> BaseDaemon: 6. DB::(anonymous namespace)::FunctionTransform::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x16207226 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.190142 [ 144 ] <Fatal> BaseDaemon: 7. DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x117e9897 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.194494 [ 144 ] <Fatal> BaseDaemon: 8. DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x12298a2c in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.198877 [ 144 ] <Fatal> BaseDaemon: 9. DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x1229994e in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.201029 [ 144 ] <Fatal> BaseDaemon: 10. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:0: DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) @ 0x198be4d4 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.203286 [ 144 ] <Fatal> BaseDaemon: 11. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:0: DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const @ 0x198bdac0 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.205471 [ 144 ] <Fatal> BaseDaemon: 12. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/vector:658: DB::ExpressionActions::execute(DB::Block&, bool) const @ 0x198bfc6f in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.209455 [ 144 ] <Fatal> BaseDaemon: 13. ./obj-x86_64-linux-gnu/../src/Functions/FunctionsMiscellaneous.h:50: DB::ExecutableFunctionExpression::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x19f791cd in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.213803 [ 144 ] <Fatal> BaseDaemon: 14. DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x12298a2c in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.218142 [ 144 ] <Fatal> BaseDaemon: 15. DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x1229994e in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.222477 [ 144 ] <Fatal> BaseDaemon: 16. DB::IFunctionBase::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x1208b365 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.225109 [ 144 ] <Fatal> BaseDaemon: 17. ./obj-x86_64-linux-gnu/../src/Columns/ColumnFunction.cpp:0: DB::ColumnFunction::reduce() const @ 0x1a2db3eb in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.229410 [ 144 ] <Fatal> BaseDaemon: 18. DB::FunctionArrayMapped<DB::ArrayMapImpl, DB::NameArrayMap>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x171aece7 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.233809 [ 144 ] <Fatal> BaseDaemon: 19. DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x117e9897 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.238142 [ 144 ] <Fatal> BaseDaemon: 20. DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x12298a2c in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.242587 [ 144 ] <Fatal> BaseDaemon: 21. DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x1229994e in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.244760 [ 144 ] <Fatal> BaseDaemon: 22. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:0: DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) @ 0x198be4d4 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.246956 [ 144 ] <Fatal> BaseDaemon: 23. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:0: DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const @ 0x198bdac0 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.250224 [ 144 ] <Fatal> BaseDaemon: 24. ./obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:0: DB::ExpressionTransform::transform(DB::Chunk&) @ 0x1ae59a4e in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.254092 [ 144 ] <Fatal> BaseDaemon: 25. ./obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:43: DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) @ 0x1a512392 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.257255 [ 144 ] <Fatal> BaseDaemon: 26. ./obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:99: DB::ISimpleTransform::work() @ 0x1ac42b80 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.260526 [ 144 ] <Fatal> BaseDaemon: 27. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:87: DB::executeJob(DB::IProcessor*) @ 0x1ac924b9 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.263750 [ 144 ] <Fatal> BaseDaemon: 28. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:99: decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) @ 0x1ac923a7 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.266915 [ 144 ] <Fatal> BaseDaemon: 29. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:0: DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) @ 0x1ac90db4 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.270057 [ 144 ] <Fatal> BaseDaemon: 30. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:0: DB::PipelineExecutor::executeImpl(unsigned long) @ 0x1ac8f68a in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.273207 [ 144 ] <Fatal> BaseDaemon: 31. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:398: DB::PipelineExecutor::execute(unsigned long) @ 0x1ac8f14b in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.01.18 08:09:43.536362 [ 144 ] <Fatal> BaseDaemon: Calculated checksum of the binary: 0DCC252AE8A764B28A0843DACDC5AC66. There is no information about the reference checksum.
Error on processing query 'SELECT arrayStringConcat(arrayMap(x -> transform(x, [1025, -9223372036854775808, 65537, 257, 1048576, 10, 7, 1048575, 65536], ['yandex', 'googlegooglegooglegoogle', 'test', '', '', 'hello', 'world', '', 'xyz'], ''), arrayMap(x -> (x % -inf), range(number))), '') FROM system.numbers LIMIT 1025': Code: 32, e.displayText() = DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000, Stack trace (when copying this message, always include the lines below):

0. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/exception:133: Poco::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int) @ 0x1b9e1d12 in /workspace/clickhouse
1. ./obj-x86_64-linux-gnu/../src/Common/Exception.cpp:55: DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int) @ 0xdfcffd4 in /workspace/clickhouse
2. ./obj-x86_64-linux-gnu/../src/IO/VarInt.h:0: DB::throwReadAfterEOF() @ 0xdfe9969 in /workspace/clickhouse
3. ./obj-x86_64-linux-gnu/../src/IO/VarInt.h:133: void DB::readVarUIntImpl<false>(unsigned long&, DB::ReadBuffer&) @ 0xe0163ef in /workspace/clickhouse
4. ./obj-x86_64-linux-gnu/../src/Client/Connection.cpp:0: DB::Connection::receivePacket(std::__1::function<void (Poco::Net::Socket&)>) @ 0x1aa90486 in /workspace/clickhouse
5. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::receiveAndProcessPacket(bool) @ 0xe0e3442 in /workspace/clickhouse
6. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::receiveResult() @ 0xe0ea012 in /workspace/clickhouse
7. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::processOrdinaryQuery() @ 0xe0d2e08 in /workspace/clickhouse
8. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::processParsedSingleQuery() @ 0xe0cf7f7 in /workspace/clickhouse
9. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::processWithFuzzing(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) @ 0xe0ca31b in /workspace/clickhouse
10. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:988: DB::Client::processMultiQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) @ 0xe0cc28d in /workspace/clickhouse
11. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::nonInteractive() @ 0xe0be0bf in /workspace/clickhouse
12. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:709: DB::Client::mainImpl() @ 0xe0b67dd in /workspace/clickhouse
13. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: DB::Client::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) @ 0xe0afbcb in /workspace/clickhouse
14. ./obj-x86_64-linux-gnu/../contrib/poco/Util/src/Application.cpp:0: Poco::Util::Application::run() @ 0x1b96c0ca in /workspace/clickhouse
15. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:0: mainEntryClickHouseClient(int, char**) @ 0xe0a3804 in /workspace/clickhouse
16. ./obj-x86_64-linux-gnu/../programs/main.cpp:0: main @ 0xdfc4014 in /workspace/clickhouse
17. /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:344: __libc_start_main @ 0x21bf7 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.27.so
18. _start @ 0xdfa212e in /workspace/clickhouse
 (version 21.1.1.5710)

https://clickhouse-test-reports.s3.yandex.net/18788/6a78b10e0b1ef3e341dfc7959ef24b7dede0dc1d/fuzzer_ubsan/fuzzer.log

Metadata

Metadata

Labels

fuzzProblem found by one of the fuzzerstestingSpecial issue with list of bugs found by CI

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions