Skip to content

QuantileExact.h:240:120: runtime error: signed integer overflow #29166

@tavplubix

Description

@tavplubix

https://clickhouse-test-reports.s3.yandex.net/29061/6bc6ef8f2e1a3c4c1ad8a4e8adfe9e647e47dc6c/fuzzer_ubsan/report.html#fail1


../src/AggregateFunctions/QuantileExact.h:240:120: runtime error: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'

    #0 0xd86fec3 in DB::QuantileExactInclusive<int>::getManyFloat(double const*, unsigned long const*, unsigned long, double*) obj-x86_64-linux-gnu/../src/AggregateFunctions/QuantileExact.h:240:120
    #1 0xd86cf76 in DB::AggregateFunctionQuantile<int, DB::QuantileExactInclusive<int>, DB::NameQuantilesExactInclusive, false, double, true>::insertResultInto(char*, DB::IColumn&, DB::Arena*) const obj-x86_64-linux-gnu/../src/AggregateFunctions/AggregateFunctionQuantile.h:172:22
    #2 0x1b2a0e19 in void DB::Aggregator::insertAggregatesIntoColumns<char*>(char*&, std::__1::vector<COW<DB::IColumn>::mutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::mutable_ptr<DB::IColumn> > >&, DB::Arena*) const obj-x86_64-linux-gnu/../src/Interpreters/Aggregator.cpp:1337:44
    #3 0x1b13ffd3 in DB::Aggregator::prepareBlockAndFillWithoutKey(DB::AggregatedDataVariants&, bool, bool) const::$_0::operator()(std::__1::vector<COW<DB::IColumn>::mutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::mutable_ptr<DB::IColumn> > >&, std::__1::vector<DB::PODArray<char*, 4096ul, Allocator<false, false>, 15ul, 16ul>*, std::__1::allocator<DB::PODArray<char*, 4096ul, Allocator<false, false>, 15ul, 16ul>*> >&, std::__1::vector<COW<DB::IColumn>::mutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::mutable_ptr<DB::IColumn> > >&, bool) const obj-x86_64-linux-gnu/../src/Interpreters/Aggregator.cpp:1672:17
    #4 0x1b13ffd3 in DB::Block DB::Aggregator::prepareBlockAndFill<DB::Aggregator::prepareBlockAndFillWithoutKey(DB::AggregatedDataVariants&, bool, bool) const::$_0&>(DB::AggregatedDataVariants&, bool, unsigned long, DB::Aggregator::prepareBlockAndFillWithoutKey(DB::AggregatedDataVariants&, bool, bool) const::$_0&) const obj-x86_64-linux-gnu/../src/Interpreters/Aggregator.cpp:1581:5
    #5 0x1b13ee10 in DB::Aggregator::prepareBlockAndFillWithoutKey(DB::AggregatedDataVariants&, bool, bool) const obj-x86_64-linux-gnu/../src/Interpreters/Aggregator.cpp:1681:19
    #6 0x1c517ebe in DB::ConvertingAggregatedToChunksTransform::initialize() obj-x86_64-linux-gnu/../src/Processors/Transforms/AggregatingTransform.cpp:341:45
    #7 0x1c274778 in DB::executeJob(DB::IProcessor*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:88:20
    #8 0x1c274666 in DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:105:13
    #9 0x1c274666 in decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #10 0x1c272c07 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
    #11 0x1c272c07 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #12 0x1c272c07 in DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:597:17
    #13 0x1c275049 in DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:485:5
    #14 0x1c275049 in DB::PipelineExecutor::executeImpl(unsigned long)::$_4::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:788:21
    #15 0x1c275049 in decltype(std::__1::forward<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&>(fp)()) std::__1::__invoke_constexpr<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1
    #16 0x1c274f22 in decltype(auto) std::__1::__apply_tuple_impl<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1
    #17 0x1c274f22 in decltype(auto) std::__1::apply<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1
    #18 0x1c274f22 in ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:188:13
    #19 0x1c274f22 in decltype(std::__1::forward<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'()&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #20 0xc7100f9 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
    #21 0xc7100f9 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #22 0xc7100f9 in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:274:17
    #23 0xc712b01 in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:139:73
    #24 0xc712b01 in decltype(std::__1::forward<void>(fp)()) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(void&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #25 0xc712b01 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5
    #26 0xc712b01 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5
    #27 0x7f23e14e7608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
    #28 0x7f23e140e292 in __clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../src/AggregateFunctions/QuantileExact.h:240:120 in 

Metadata

Metadata

Assignees

Labels

testingSpecial issue with list of bugs found by CI

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions