Skip to content

signed integer overflow in FunctionDateOrDateTimeAddInterval #19579

@KochetovNicolai

Description

@KochetovNicolai

UBsan

SELECT tuple(toDateTime(number) + 9223372036854775807) FROM numbers(1023)
../src/Functions/FunctionDateOrDateTimeAddInterval.h:73:18: runtime error: signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long'
    #0 0x16301fd9 in void DB::Adder<DB::AddSecondsImpl>::vectorConstant<DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul>, DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul> >(DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul> const&, DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul>&, long, DateLUTImpl const&) const (/workspace/clickhouse+0x16301fd9)
    #1 0x162fe96b in DB::DateTimeAddIntervalImpl<DB::DataTypeDateTime, DB::DataTypeDateTime, DB::AddSecondsImpl>::execute(DB::AddSecondsImpl, std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&) (/workspace/clickhouse+0x162fe96b)
    #2 0x162fd0ad in DB::FunctionDateOrDateTimeAddInterval<DB::AddSecondsImpl>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x162fd0ad)
    #3 0x11f41cc6 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x11f41cc6)
    #4 0x129f3e1b in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f3e1b)
    #5 0x129f4d3d in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f4d3d)
    #6 0x127e59b4 in DB::IFunctionBase::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x127e59b4)
    #7 0x12eb3155 in DB::FunctionBinaryArithmetic<DB::PlusImpl, DB::NamePlus, true>::executeDateTimeIntervalPlusMinus(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, std::__1::shared_ptr<DB::IFunctionOverloadResolver> const&) const (/workspace/clickhouse+0x12eb3155)
    #8 0x12eb1f83 in DB::FunctionBinaryArithmetic<DB::PlusImpl, DB::NamePlus, true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x12eb1f83)
    #9 0x12eb149b in DB::FunctionBinaryArithmeticWithConstants<DB::PlusImpl, DB::NamePlus, true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x12eb149b)
    #10 0x11f41cc6 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x11f41cc6)
    #11 0x129f3e1b in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f3e1b)
    #12 0x129f4d3d in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f4d3d)
    #13 0x1a01f303 in DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:333:56
    #14 0x1a01e81f in DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:449:13
    #15 0x1b5bbd3d in DB::ExpressionTransform::transform(DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:25:17
    #16 0x1ac783b1 in DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:42:9
    #17 0x1b3a4c8f in DB::ISimpleTransform::work() obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:89:9
    #18 0x1b3f4758 in DB::executeJob(DB::IProcessor*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:79:20
    #19 0x1b3f4646 in DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:96:13
    #20 0x1b3f4646 in decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #21 0x1b3f3053 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
    #22 0x1b3f3053 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #23 0x1b3f3053 in DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:580:17
    #24 0x1b3f1929 in DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:473:5
    #25 0x1b3f1929 in DB::PipelineExecutor::executeImpl(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:807:9
    #26 0x1b3f13ea in DB::PipelineExecutor::execute(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:395:9
    #27 0x1b403deb in DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:79:24
    #28 0x1b403d46 in DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:101:13
    #29 0x1b403d46 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1
    #30 0x1b403c01 in decltype(auto) std::__1::__apply_tuple_impl<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1
    #31 0x1b403c01 in decltype(auto) std::__1::apply<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1
    #32 0x1b403c01 in ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:178:13
    #33 0x1b403c01 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #34 0xe3f974e in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #35 0xe3f974e in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:247:17
    #36 0xe3fd425 in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:124:73
    #37 0xe3fd425 in decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #38 0xe3fd425 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5
    #39 0xe3fd425 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5
    #40 0x7f3ba325e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
    #41 0x7f3ba3185292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

From #19253

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzzProblem found by one of the fuzzersminorPriority: minor

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions