Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24635 )
Change subject: IMPALA-15221: Harden VARIANT decoding against corrupt input ...................................................................... Patch Set 1: (13 comments) gerrit-auto-critic failed. You can reproduce it locally using command: python3 bin/jenkins/critique-gerrit-review.py --dryrun To run it, you might need a virtual env with Python3's venv installed. http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.h File be/src/runtime/variant-value.h: http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.h@170 PS1, Line 170: // Scalar accessors. Each returns false (leaving '*out' unchanged) if the value is not of line too long (91 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.h@182 PS1, Line 182: // Object access. Each returns false if this value is not a well-formed object (corrupt or line too long (92 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.h@183 PS1, Line 183: // truncated header/offset table), if 'index' is out of range, or if the requested field's line too long (92 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.h@209 PS1, Line 209: // Reads a primitive value of type T from the payload at data_ + offset (default offset is line too long (92 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.h@228 PS1, Line 228: // guaranteed to lie within the value buffer once the corresponding Parse*() returns true. line too long (92 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.cc File be/src/runtime/variant-value.cc: http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.cc@334 PS1, Line 334: uint32_t next_offset = ReadUint(layout.offsets + (index + 1) * offset_size, offset_size); line too long (91 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.cc@337 PS1, Line 337: *result = VariantValue(layout.data + field_offset, next_offset - field_offset, metadata_); line too long (92 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.cc@393 PS1, Line 393: uint32_t next_offset = ReadUint(layout.offsets + (index + 1) * offset_size, offset_size); line too long (91 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.cc@581 PS1, Line 581: if (UNLIKELY(!val.ReadValue(µs))) return Status("Malformed variant TIMESTAMP"); line too long (94 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/runtime/variant-value.cc@598 PS1, Line 598: if (UNLIKELY(!val.ReadValue(&nanos))) return Status("Malformed variant TIMESTAMP"); line too long (93 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/util/variant-util-test.cc File be/src/util/variant-util-test.cc: http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/util/variant-util-test.cc@868 PS1, Line 868: { vector<uint8_t> d = {0x02, 0x00, 0x00}; EXPECT_FALSE(m.Init(d.data(), d.size()).ok()); } line too long (92 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/util/variant-util-test.cc@873 PS1, Line 873: // Integer-overflow attempt: offset_size=4, dict_size=0xFFFFFFFF, short blob. With 32-bit line too long (91 > 90) http://gerrit.cloudera.org:8080/#/c/24635/1/be/src/util/variant-util-test.cc@874 PS1, Line 874: // math (dict_size+1)*offset_size wraps to 0 and the length check would wrongly pass; the line too long (91 > 90) -- To view, visit http://gerrit.cloudera.org:8080/24635 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I3a22bb16cd05854a9afb56ebd27806ac52670bca Gerrit-Change-Number: 24635 Gerrit-PatchSet: 1 Gerrit-Owner: Zoltan Borok-Nagy <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Comment-Date: Fri, 24 Jul 2026 14:55:26 +0000 Gerrit-HasComments: Yes
