This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 16fc34e0cb2 [fix](mysql buffer) fix buffer overflow of output complex
type columns (#56922)
16fc34e0cb2 is described below
commit 16fc34e0cb2086302070d2a65b2d0662f7ff4cbb
Author: TengJianPing <[email protected]>
AuthorDate: Tue Oct 14 12:00:44 2025 +0800
[fix](mysql buffer) fix buffer overflow of output complex type columns
(#56922)
---
be/src/util/mysql_row_buffer.cpp | 11 +----------
be/src/util/mysql_row_buffer.h | 7 ++-----
be/test/util/mysql_row_buffer_test.cpp | 29 +++++++++++++++++++++++++++++
3 files changed, 32 insertions(+), 15 deletions(-)
diff --git a/be/src/util/mysql_row_buffer.cpp b/be/src/util/mysql_row_buffer.cpp
index 9ee00a398db..657f99d5514 100644
--- a/be/src/util/mysql_row_buffer.cpp
+++ b/be/src/util/mysql_row_buffer.cpp
@@ -109,7 +109,7 @@ void MysqlRowBuffer<is_binary_format>::open_dynamic_mode() {
// if _pos now exactly at the end of _buf memory,
// we should reserve 1 byte for _dynamic_mode flag byte to avoid *pos
= 254
// cause _dynamic_mode flag byte be overwritten
- reserve(1);
+ reserve(1 + 8);
*_pos++ = NEXT_EIGHT_BYTE; // *_pos = 254 ; _pos++
// write length when dynamic mode close
_len_pos = (_pos - _buf);
@@ -545,15 +545,6 @@ int MysqlRowBuffer<is_binary_format>::push_null() {
return 0;
}
-template <bool is_binary_format>
-char* MysqlRowBuffer<is_binary_format>::reserved(int64_t size) {
- reserve(size);
- char* old_buf = _pos;
- _pos += size;
-
- return old_buf;
-}
-
template class MysqlRowBuffer<true>;
template class MysqlRowBuffer<false>;
diff --git a/be/src/util/mysql_row_buffer.h b/be/src/util/mysql_row_buffer.h
index fbf8870c5fb..bcb6246f93b 100644
--- a/be/src/util/mysql_row_buffer.h
+++ b/be/src/util/mysql_row_buffer.h
@@ -85,10 +85,6 @@ public:
template <typename DateType>
int push_vec_datetime(DateType& data, int scale = -1);
- // this function reserved size, change the pos step size, return old pos
- // Becareful when use the returned pointer.
- char* reserved(int64_t size);
-
const char* buf() const { return _buf; }
const char* pos() const { return _pos; }
int64_t length() const { return _pos - _buf; }
@@ -139,12 +135,13 @@ private:
char* _pos = nullptr;
char* _buf = nullptr;
int64_t _buf_size;
- char _default_buf[4096];
int _dynamic_mode;
uint64_t _len_pos;
uint32_t _field_pos = 0;
uint32_t _field_count = 0;
+
+ char _default_buf[4096];
};
} // namespace doris
diff --git a/be/test/util/mysql_row_buffer_test.cpp
b/be/test/util/mysql_row_buffer_test.cpp
index bec0a0a3925..7f81d0031a0 100644
--- a/be/test/util/mysql_row_buffer_test.cpp
+++ b/be/test/util/mysql_row_buffer_test.cpp
@@ -115,6 +115,35 @@ TEST(MysqlRowBufferTest, dynamic_mode) {
EXPECT_EQ(0, strncmp(buf + 43, "test", 4));
}
+TEST(MysqlRowBufferTest, dynamic_mode_mix) {
+ MysqlRowBuffer mrb;
+ int count = 585;
+ // Each small int -32767 will occupy 7 bytes, 585 * 7 = 4095
+ for (int i = 0; i < count; ++i) {
+ mrb.push_smallint(-32767);
+ }
+
+ mrb.open_dynamic_mode();
+ mrb.push_string("{", 1);
+ mrb.close_dynamic_mode();
+
+ // 4095 + 9 + 1
+ EXPECT_EQ(4105, mrb.length());
+
+ const char* buf = mrb.buf();
+ for (int i = 0; i < count; ++i) {
+ EXPECT_EQ(6, *((uint8_t*)(buf)));
+ ++buf;
+ EXPECT_EQ(0, strncmp(buf, "-32767", 6));
+ buf += 6;
+ }
+ EXPECT_EQ(254, *((uint8_t*)(buf)));
+ ++buf;
+ EXPECT_EQ(1, *((int64_t*)(buf)));
+ buf += 8;
+ EXPECT_EQ(0, strncmp(buf, "{", 1));
+}
+
TEST(MysqlRowBufferTest, TestBinaryTimeCompressedEncoding) {
MysqlRowBuffer<true> buffer;
const char* buf = nullptr;
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
