sahvx655-wq opened a new pull request, #64091: URL: https://github.com/apache/doris/pull/64091
reading the lz4 block path: remaining_output_len is computed once per large block and then handed to LZ4_decompress_safe as the destination capacity for every small block. output_ptr advances per small block but that capacity never moves with it, so from the second small block on the decompress is told it has the full large-block space starting at an already advanced pointer. a crafted lz4block stream from a csv load then writes past the line reader output buffer. capacity now tracks output_ptr. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
