Michael Ho has uploaded a new patch set (#3). Change subject: IMPALA-3854: Fix use-after-free in HdfsTextScanner::Close() ......................................................................
IMPALA-3854: Fix use-after-free in HdfsTextScanner::Close() A recent commit changed the ownership of the Stream object to its owning ScannerContext. After that change, a Stream object will be destroyed in ScannerContext::ReleaseCompletedResources() if the parameter 'done' is true. That usually happens in the Close() function of a scanner. However, for the text scanner, the Stream object can be destroyed after handling compressed data before Close() is called. In that case, the cached handle to the Stream object is invalid when it's referenced in Close() to access the compression codec of the Stream object. This change fixes the above problem by using the existing field 'decompression_type_' in Close() which contains the compression codec of the Stream object. ScannerContext::ReleaseCompletedResources() will not delete the stream objects anymore. Instead, a new function ScannerContext::ReleaseAllStreams() is added for that purpose. This avoids other use-after-free problems in the code. Change-Id: Ia88f6285563ff669ae215af22ed2d45e5398adae --- M be/src/exec/hdfs-parquet-scanner.cc M be/src/exec/hdfs-scan-node.cc M be/src/exec/hdfs-scanner.cc M be/src/exec/hdfs-text-scanner.cc M be/src/exec/scanner-context.cc M be/src/exec/scanner-context.h 6 files changed, 25 insertions(+), 18 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala refs/changes/30/3630/3 -- To view, visit http://gerrit.cloudera.org:8080/3630 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ia88f6285563ff669ae215af22ed2d45e5398adae Gerrit-PatchSet: 3 Gerrit-Project: Impala Gerrit-Branch: cdh5-trunk Gerrit-Owner: Michael Ho <[email protected]> Gerrit-Reviewer: Alex Behm <[email protected]> Gerrit-Reviewer: Michael Ho <[email protected]>
