linrrzqqq opened a new pull request, #66909:
URL: https://github.com/apache/doris/pull/66909

   ### What problem does this PR solve?
   
   Problem Summary:
   
   `multi_match_any` compiles each pattern array and stores the result in a 
process-wide, direct-mapped cache.
   
   The previous implementation retained the cache entry's shared_ptr only while 
preparing the regex database and scratch space. The subsequent scan used a 
**raw** `Regexps*`. If another concurrent request inserted a different pattern 
array into the same cache bucket, the old cache entry could be replaced and 
destroyed while it was still being scanned, resulting in a use-after-free.
   
   This change keeps the cache entry's shared_ptr alive for the entire hs_scan 
operation. Cache eviction can still replace the global entry, but the compiled 
database is not destroyed until all active scans have completed.
   
   ### Release note
   
   Fix a potential use-after-free in multi_match_any when concurrent pattern 
arrays collide in the compiled-regex cache.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to