[
https://issues.apache.org/jira/browse/IMPALA-15377?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117849#comment-18117849
]
ASF subversion and git services commented on IMPALA-15377:
----------------------------------------------------------
Commit 7845bcc2239ba948eb8f2f2dc6bc89b7857fcf09 in impala's branch
refs/heads/master from Michael Smith
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=7845bcc22 ]
IMPALA-15377: Fix ASAN heap-buffer-overflow in ParquetDeltaEncoder for empty
pages
ParquetDeltaEncoder::FinalizePage() unconditionally wrote a page header
even when zero values had been written (total_value_count_ == 0), using an
uninitialized first_value_ and requiring more space than WorstCaseOutputSize(0)
(which returns 0) reserves. This caused a heap-buffer-overflow write in
BitWriter::PutAligned via WriteHeader, hit by
ParquetDeltaLengthByteArrayDecoderTest.EmptyPage on ASAN builds.
Make FinalizePage() return 0 immediately for an empty page instead of writing
a header, matching the WorstCaseOutputSize(0) == 0 contract.
Change-Id: I52aaff63ab76dd25ceeb6a7d840d4c483cf518b1
Assisted-by: Claude Sonnet 5 (GitHub Copilot)
Reviewed-on: http://gerrit.cloudera.org:8080/24892
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> ASAN heap-buffer-overflow in ParquetDeltaEncoder for empty pages
> ----------------------------------------------------------------
>
> Key: IMPALA-15377
> URL: https://issues.apache.org/jira/browse/IMPALA-15377
> Project: IMPALA
> Issue Type: Bug
> Components: Backend
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 5.0.0
>
>
> {{ParquetDeltaEncoder::FinalizePage()}} unconditionally writes a page header
> even when zero values have been written (\{{total_value_count_ == 0}}), using
> an uninitialized {{first_value_}} and requiring more space than
> {{WorstCaseOutputSize(0) }}(which returns 0) reserves. This caused a
> heap-buffer-overflow write in BitWriter::PutAligned via WriteHeader, hit by
> ParquetDeltaLengthByteArrayDecoderTest.EmptyPage on ASAN builds with newer
> Clang versions.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
