(orc) branch main updated: ORC-2028: [C++] Fix ReadRangeCache uses freed memory

[gangwu]

This is an automated email from the ASF dual-hosted git repository.

gangwu pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/orc.git


The following commit(s) were added to refs/heads/main by this push:
     new d49249cb9 ORC-2028: [C++] Fix ReadRangeCache uses freed memory
d49249cb9 is described below

commit d49249cb95d65f9808a3bf8d21d1b0fa6d16d3a9
Author: Zehua Zou <41586196+huah...@users.noreply.github.com>
AuthorDate: Fri Oct 17 22:23:27 2025 +0800

    ORC-2028: [C++] Fix ReadRangeCache uses freed memory
    
    ### What changes were proposed in this pull request?
    
    If a `Buffer` is used in coroutine, it will be released after the coroutine 
finishes.
    
    ### Why are the changes needed?
    
    If `Buffer` is release before the coroutine finishes, coroutine will try to 
write data to freed memory and cause panic.
    
    ### How was this patch tested?
    
    Tested in private repo by ASan.
    
    ### Was this patch authored or co-authored using generative AI tooling?
    
    No.
    
    Closes #2445 from HuaHuaY/fix_issue_2028.
    
    Lead-authored-by: Zehua Zou <41586196+huah...@users.noreply.github.com>
    Co-authored-by: Zehua Zou <zehuazou2...@gmail.com>
    Signed-off-by: Gang Wu <ust...@gmail.com>
---
 c++/src/io/Cache.cc | 9 +++++++++
 c++/src/io/Cache.hh | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/c++/src/io/Cache.cc b/c++/src/io/Cache.cc
index 39f63fdd2..723435eaa 100644
--- a/c++/src/io/Cache.cc
+++ b/c++/src/io/Cache.cc
@@ -104,6 +104,12 @@ namespace orc {
     return combiner.coalesce(std::move(ranges));
   }
 
+  ReadRangeCache::~ReadRangeCache() {
+    for (auto& entry : entries_) {
+      entry.future.wait();
+    }
+  };
+
   void ReadRangeCache::cache(std::vector<ReadRange> ranges) {
     ranges = ReadRangeCombiner::coalesceReadRanges(std::move(ranges), 
options_.holeSizeLimit,
                                                    options_.rangeSizeLimit);
@@ -153,6 +159,9 @@ namespace orc {
                                [](const RangeCacheEntry& entry, uint64_t 
offset) {
                                  return entry.range.offset + 
entry.range.length <= offset;
                                });
+    for (auto iter = entries_.begin(); iter != it; ++iter) {
+      iter->future.wait();
+    }
     entries_.erase(entries_.begin(), it);
   }
 
diff --git a/c++/src/io/Cache.hh b/c++/src/io/Cache.hh
index 7fc79718a..746f7a43a 100644
--- a/c++/src/io/Cache.hh
+++ b/c++/src/io/Cache.hh
@@ -94,7 +94,7 @@ namespace orc {
           memoryPool_(memoryPool),
           metrics_(metrics) {}
 
-    ~ReadRangeCache() = default;
+    ~ReadRangeCache();
 
     /// Cache the given ranges in the background.
     ///