[
https://issues.apache.org/jira/browse/IMPALA-15378?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117610#comment-18117610
]
ASF subversion and git services commented on IMPALA-15378:
----------------------------------------------------------
Commit af856f584e8a9ecaec406dcecc804cfc4b383a38 in impala's branch
refs/heads/master from Michael Smith
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=af856f584 ]
IMPALA-15378: Fix OOB read in OrcSchemaResolver::ResolveColumnByName
TranslateColPaths() can legitimately return an empty
table_col_path/file_col_path pair: when the table is full ACID but
the underlying file is not, and col_path refers only to the
synthetic ACID "row" pseudo-column, neither schema has a
corresponding node, so nothing is pushed to either output path.
ResolveColumnByName() did not account for this and unconditionally
indexed table_path[0], reading out of bounds on the empty vector
(caught by libstdc++'s _GLIBCXX_ASSERTIONS, aborting impalad).
ResolveColumnByPosition() already handles this correctly since its
loop naturally no-ops on an empty path.
Add the same empty-path guard to ResolveColumnByName(), leaving
*node as root_ and *missing_field as false, matching
ResolveColumnByPosition()'s behavior.
Change-Id: Ia269c7cebc88f6bf1d7269316beab438ecd803ba
Assisted-by: Claude Sonnet 5 (GitHub Copilot)
Reviewed-on: http://gerrit.cloudera.org:8080/24891
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> OOB read in OrcSchemaResolver::ResolveColumnByName
> --------------------------------------------------
>
> Key: IMPALA-15378
> URL: https://issues.apache.org/jira/browse/IMPALA-15378
> Project: IMPALA
> Issue Type: Bug
> Components: Backend
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
>
> TranslateColPaths() can legitimately return an empty
> table_col_path/file_col_path pair: when the table is full ACID but the
> underlying file is not, and col_path refers only to the synthetic ACID "row"
> pseudo-column, neither schema has a corresponding node, so nothing is pushed
> to either output path. ResolveColumnByName() does not account for this and
> unconditionally indexes table_path[0], reading out of bounds on the empty
> vector
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
