Skip to content

Sparse canonicalization panics on an out-of-bounds patch index (BitBufferMut::set) #8821

Closed

Description

@lorenzhs

What happened?

Another fuzzer panic:

thread 'tokio-rt-worker' (568293) panicked at .../vortex-buffer/src/bit/buf_mut.rs:352:9:
index 402653634 exceeds len 1024
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: vortex_array::arrays::bool::patch::<impl vortex_array::array::typed::Array<vortex_array::arrays::bool::vtable::Bool>>::patch
   3: vortex_array::validity::Validity::patch
   4: vortex_array::arrays::primitive::array::patch::<impl vortex_array::array::typed::Array<vortex_array::arrays::primitive::vtable::Primitive>>::patch
   5: vortex_sparse::canonical::execute_sparse_primitives
   6: vortex_sparse::canonical::execute_sparse
   7: <vortex_sparse::Sparse as vortex_array::array::vtable::VTable>::execute
   8: <vortex_array::array::typed::ArrayData<V> as vortex_array::array::DynArrayData>::execute_unchecked
   9: <vortex_array::canonical::Canonical as vortex_array::executor::Executable>::execute
  10: vortex_array::canonical::<impl vortex_array::executor::Executable for vortex_array::array::typed::Array<vortex_array::arrays::primitive::vtable::Primitive>>::execute
  11: vortex_arrow::executor::primitive::to_arrow_primitive
  12: vortex_arrow::executor::execute_arrow_naive
  13: vortex_arrow::session::ArrowSession::execute_arrow
  14: vortex_arrow::executor::struct_::create_from_fields
  15: vortex_arrow::executor::struct_::to_arrow_struct
  16: vortex_arrow::executor::execute_arrow_naive
  17: vortex_arrow::session::ArrowSession::execute_arrow
  18: vortex_layout::scan::scan_builder::ScanBuilder<A>::map::{{closure}}
  19: vortex_layout::scan::tasks::split_exec::{{closure}}
  20: <tracing::instrument::Instrumented<T> as core::future::future::Future>::poll
  21: tokio::runtime::task::raw::poll
  22: tokio::runtime::scheduler::multi_thread::worker::Context::run_task
  23: tokio::runtime::scheduler::multi_thread::worker::run
  24: tokio::runtime::task::raw::poll

Steps to reproduce

This one's a bit big to base64-dump it here (34kB / 46kB once base64'd), so I uploaded it to https://4z2.de/fuzz3.vortex instead. sha256sum is 25bbe98c74680e7fcd9387f8b13da7b69737edd6dd8bf390de58c082585b62bf. Just run vx query --sql 'select * from data' fuzz3.vortex on it (or use duckdb)

Environment

develop as of 3975895

Additional context

No response

Activity

  1. lorenzhs commented on Jul 17, 2026

    @lorenzhs
    ContributorAuthor

    This is triggerable via a few different paths, there's also this one: http://4z2.de/fuzz3b.vortex (sha256sum: ac4adab47dc37636b6f6e57e2c1849c923cff4e57ffd12e7c135e887aca8b4ea)

    thread 'tokio-rt-worker' (583267) panicked at .../vortex-array/src/arrays/primitive/array/patch.rs:129:9:
    index out of bounds: the len is 1024 but the index is 288230376151712349
    stack backtrace:
       0: __rustc::rust_begin_unwind
       1: core::panicking::panic_fmt
       2: core::panicking::panic_bounds_check
       3: vortex_alp::alp::decompress::decompress_chunked_core
       4: <vortex_alp::alp::array::ALP as vortex_array::array::vtable::VTable>::execute
       5: <vortex_array::array::typed::ArrayData<V> as vortex_array::array::DynArrayData>::execute_unchecked
       6: <vortex_array::canonical::Canonical as vortex_array::executor::Executable>::execute
       7: vortex_array::canonical::<impl vortex_array::executor::Executable for vortex_array::array::typed::Array<vortex_array::arrays::primitive::vtable::Primitive>>::execute
       8: vortex_arrow::executor::primitive::to_arrow_primitive
       9: vortex_arrow::executor::execute_arrow_naive
      10: vortex_arrow::session::ArrowSession::execute_arrow
      11: vortex_arrow::executor::struct_::create_from_fields
      12: vortex_arrow::executor::struct_::to_arrow_struct
      13: vortex_arrow::executor::execute_arrow_naive
      14: vortex_arrow::session::ArrowSession::execute_arrow
      15: vortex_layout::scan::scan_builder::ScanBuilder<A>::map::{{closure}}
      16: vortex_layout::scan::tasks::split_exec::{{closure}}
      17: <tracing::instrument::Instrumented<T> as core::future::future::Future>::poll
      18: tokio::runtime::task::raw::poll
      19: tokio::runtime::scheduler::multi_thread::worker::Context::run_task
      20: tokio::runtime::scheduler::multi_thread::worker::run
      21: tokio::runtime::task::raw::poll
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugA bug issue

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions