-
Notifications
You must be signed in to change notification settings - Fork 8.3k
signed integer overflow in FunctionDateOrDateTimeAddInterval #19579
Copy link
Copy link
Closed
Labels
fuzzProblem found by one of the fuzzersProblem found by one of the fuzzersminorPriority: minorPriority: minor
Description
UBsan
SELECT tuple(toDateTime(number) + 9223372036854775807) FROM numbers(1023)../src/Functions/FunctionDateOrDateTimeAddInterval.h:73:18: runtime error: signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long'
#0 0x16301fd9 in void DB::Adder<DB::AddSecondsImpl>::vectorConstant<DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul>, DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul> >(DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul> const&, DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul>&, long, DateLUTImpl const&) const (/workspace/clickhouse+0x16301fd9)
#1 0x162fe96b in DB::DateTimeAddIntervalImpl<DB::DataTypeDateTime, DB::DataTypeDateTime, DB::AddSecondsImpl>::execute(DB::AddSecondsImpl, std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&) (/workspace/clickhouse+0x162fe96b)
#2 0x162fd0ad in DB::FunctionDateOrDateTimeAddInterval<DB::AddSecondsImpl>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x162fd0ad)
#3 0x11f41cc6 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x11f41cc6)
#4 0x129f3e1b in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f3e1b)
#5 0x129f4d3d in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f4d3d)
#6 0x127e59b4 in DB::IFunctionBase::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x127e59b4)
#7 0x12eb3155 in DB::FunctionBinaryArithmetic<DB::PlusImpl, DB::NamePlus, true>::executeDateTimeIntervalPlusMinus(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, std::__1::shared_ptr<DB::IFunctionOverloadResolver> const&) const (/workspace/clickhouse+0x12eb3155)
#8 0x12eb1f83 in DB::FunctionBinaryArithmetic<DB::PlusImpl, DB::NamePlus, true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x12eb1f83)
#9 0x12eb149b in DB::FunctionBinaryArithmeticWithConstants<DB::PlusImpl, DB::NamePlus, true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x12eb149b)
#10 0x11f41cc6 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x11f41cc6)
#11 0x129f3e1b in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f3e1b)
#12 0x129f4d3d in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f4d3d)
#13 0x1a01f303 in DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:333:56
#14 0x1a01e81f in DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:449:13
#15 0x1b5bbd3d in DB::ExpressionTransform::transform(DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:25:17
#16 0x1ac783b1 in DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:42:9
#17 0x1b3a4c8f in DB::ISimpleTransform::work() obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:89:9
#18 0x1b3f4758 in DB::executeJob(DB::IProcessor*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:79:20
#19 0x1b3f4646 in DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:96:13
#20 0x1b3f4646 in decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
#21 0x1b3f3053 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
#22 0x1b3f3053 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
#23 0x1b3f3053 in DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:580:17
#24 0x1b3f1929 in DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:473:5
#25 0x1b3f1929 in DB::PipelineExecutor::executeImpl(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:807:9
#26 0x1b3f13ea in DB::PipelineExecutor::execute(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:395:9
#27 0x1b403deb in DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:79:24
#28 0x1b403d46 in DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:101:13
#29 0x1b403d46 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1
#30 0x1b403c01 in decltype(auto) std::__1::__apply_tuple_impl<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1
#31 0x1b403c01 in decltype(auto) std::__1::apply<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1
#32 0x1b403c01 in ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:178:13
#33 0x1b403c01 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
#34 0xe3f974e in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
#35 0xe3f974e in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:247:17
#36 0xe3fd425 in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:124:73
#37 0xe3fd425 in decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
#38 0xe3fd425 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5
#39 0xe3fd425 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5
#40 0x7f3ba325e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
#41 0x7f3ba3185292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
From #19253
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
fuzzProblem found by one of the fuzzersProblem found by one of the fuzzersminorPriority: minorPriority: minor