Skip to content

Commit b6910ff

Browse files
committed
[Bug](function) fix to_ipv6 cause stack-buffer-overflow error (apache#53713)
Problem Summary: memcpy(dst, &result, sizeof(result)); when use memcpy, it's size if sizeof(result), so use int64 maybe overflow of dst ``` ==3524968==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f18404e1d73 at pc 0x559e2c162b01 bp 0x7f18439e5dc0 sp 0x7f18439e5db8 WRITE of size 8 at 0x7f18404e1d73 thread T1265 (brpc_light) #0 0x559e2c162b00 in bool doris::vectorized::parse_ipv4<char const, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'()>(char const*&, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'(), unsigned char*, long) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:165:5 apache#1 0x559e2c161eb3 in bool doris::vectorized::parse_ipv6<char const, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'()>(char const*&, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'(), unsigned char*, int) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:416:18 apache#2 0x559e2c160c44 in doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:467:9 apache#3 0x559e2c160c44 in doris::vectorized::parse_ipv6_whole(char const*, char const*, unsigned char*) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:475:12 apache#4 0x559e2c160c44 in doris::IPv6Value::from_string(unsigned __int128&, char const*, unsigned long) /mnt/disk8/zhangsida/doris/be/src/vec/runtime/ipv6_value.h:71:16 apache#5 0x559e4fdb05f3 in doris::vectorized::FunctionToIP<(doris::vectorized::IPConvertExceptionMode)0, (doris::PrimitiveType)37>::execute_impl(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function_ip.h:1180:21 apache#6 0x559e4c233b1e in doris::vectorized::DefaultExecutable::execute_impl(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.h:447:26 apache#7 0x559e4eebcef3 in doris::vectorized::PreparedFunctionImpl::_execute_skipped_constant_deal(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp apache#8 0x559e4eeb68c4 in doris::vectorized::PreparedFunctionImpl::default_implementation_for_constant_arguments(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool, bool*) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp:168:5 apache#9 0x559e4eeb8fc4 in doris::vectorized::PreparedFunctionImpl::execute_without_low_cardinality_columns(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp:237:5 ```
1 parent daa97ed commit b6910ff

File tree

2 files changed

+4
-6
lines changed

2 files changed

+4
-6
lines changed

be/src/vec/common/format_ip.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -124,12 +124,12 @@ inline void format_ipv4(const unsigned char* src, char*& dst, uint8_t mask_tail_
124124
*/
125125
template <typename T, typename EOFfunction>
126126
requires(std::is_same<typename std::remove_cv<T>::type, char>::value)
127-
inline bool parse_ipv4(T*& src, EOFfunction eof, unsigned char* dst, int64_t first_octet = -1) {
127+
inline bool parse_ipv4(T*& src, EOFfunction eof, unsigned char* dst, int32_t first_octet = -1) {
128128
if (src == nullptr || first_octet > IPV4_MAX_OCTET_VALUE) {
129129
return false;
130130
}
131131

132-
int64_t result = 0;
132+
UInt32 result = 0;
133133
int offset = (IPV4_BINARY_LENGTH - 1) * IPV4_OCTET_BITS;
134134
if (first_octet >= 0) {
135135
result |= first_octet << offset;
@@ -141,7 +141,7 @@ inline bool parse_ipv4(T*& src, EOFfunction eof, unsigned char* dst, int64_t fir
141141
return false;
142142
}
143143

144-
int64_t value = 0;
144+
UInt32 value = 0;
145145
size_t len = 0;
146146
while (is_numeric_ascii(*src) && len <= 3) {
147147
value = value * DECIMAL_BASE + (*src - '0');

be/src/vec/functions/function_ip.h

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -150,10 +150,8 @@ ColumnPtr convert_to_ipv4(ColumnPtr column, const PaddedPODArray<UInt8>* null_ma
150150
vec_null_map_to = &col_null_map_to->get_data();
151151
}
152152

153-
auto col_res = ToColumn::create();
154-
153+
auto col_res = ToColumn::create(column_size, 0);
155154
auto& vec_res = col_res->get_data();
156-
vec_res.resize(column_size);
157155

158156
const ColumnString::Chars& vec_src = column_string->get_chars();
159157
const ColumnString::Offsets& offsets_src = column_string->get_offsets();

0 commit comments

Comments
 (0)