You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by mo...@apache.org on 2022/09/21 17:35:13 UTC

[doris] 04/08: [Bugfix](stack_over_flow) fix be may core dump because of stack-buffer-overflow when TBrokerOpenReaderResponse too large (#12658)

This is an automated email from the ASF dual-hosted git repository.

morningman pushed a commit to branch branch-1.1-lts
in repository https://gitbox.apache.org/repos/asf/doris.git

commit b852acd9f658017cd0453266e4fc11ae915bf5b5
Author: Zhengguo Yang <ya...@gmail.com>
AuthorDate: Fri Sep 16 20:57:22 2022 +0800

    [Bugfix](stack_over_flow) fix be may core dump because of stack-buffer-overflow when TBrokerOpenReaderResponse too large (#12658)
---
 be/src/exec/broker_reader.cpp    | 18 ++++++++++--------
 be/src/exprs/bitmap_function.cpp | 17 +++++++++++++----
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/be/src/exec/broker_reader.cpp b/be/src/exec/broker_reader.cpp
index ab78b5c6c3..aea301aa98 100644
--- a/be/src/exec/broker_reader.cpp
+++ b/be/src/exec/broker_reader.cpp
@@ -27,6 +27,7 @@
 #include "runtime/exec_env.h"
 #include "util/monotime.h"
 #include "util/thrift_util.h"
+#include "util/defer_op.h"
 
 namespace doris {
 
@@ -78,7 +79,8 @@ Status BrokerReader::open() {
     request.__set_clientId(client_id(_env, broker_addr));
     request.__set_properties(_properties);
 
-    TBrokerOpenReaderResponse response;
+	TBrokerOpenReaderResponse* response = new TBrokerOpenReaderResponse();
+    Defer del_reponse {[&] { delete response; }};
     try {
         Status status;
         BrokerServiceConnection client(client_cache(_env), broker_addr,
@@ -90,11 +92,11 @@ Status BrokerReader::open() {
         }
 
         try {
-            client->openReader(response, request);
+            client->openReader(*response, request);
         } catch (apache::thrift::transport::TTransportException& e) {
             SleepFor(MonoDelta::FromSeconds(1));
             RETURN_IF_ERROR(client.reopen());
-            client->openReader(response, request);
+            client->openReader(*response, request);
         }
     } catch (apache::thrift::TException& e) {
         std::stringstream ss;
@@ -103,21 +105,21 @@ Status BrokerReader::open() {
         return Status::ThriftRpcError(ss.str());
     }
 
-    if (response.opStatus.statusCode != TBrokerOperationStatusCode::OK) {
+    if (response->opStatus.statusCode != TBrokerOperationStatusCode::OK) {
         std::stringstream ss;
         ss << "Open broker reader failed, broker:" << broker_addr
-           << " failed:" << response.opStatus.message;
+           << " failed:" << response->opStatus.message;
         LOG(WARNING) << ss.str();
         return Status::InternalError(ss.str());
     }
     // TODO(cmy): The file size is no longer got from openReader() method.
     // But leave the code here for compatibility.
     // This will be removed later.
-    if (response.__isset.size) {
-        _file_size = response.size;
+    if (response.->__isset.size) {
+        _file_size = response->size;
     }
 
-    _fd = response.fd;
+    _fd = response->fd;
     _is_fd_valid = true;
     return Status::OK();
 }
diff --git a/be/src/exprs/bitmap_function.cpp b/be/src/exprs/bitmap_function.cpp
index e45f7244b9..4fa1383eec 100644
--- a/be/src/exprs/bitmap_function.cpp
+++ b/be/src/exprs/bitmap_function.cpp
@@ -822,10 +822,19 @@ void BitmapFunctions::orthogonal_bitmap_count_merge(FunctionContext* context, co
 // finalize for ORTHOGONAL_BITMAP_UNION_COUNT(bitmap)
 BigIntVal BitmapFunctions::orthogonal_bitmap_count_finalize(FunctionContext* context,
                                                             const StringVal& src) {
-    auto* pval = reinterpret_cast<int64_t*>(src.ptr);
-    int64_t result = *pval;
-    delete pval;
-    return result;
+    if (src.is_null) {
+        return BigIntVal::null();
+    } else if (src.len == sizeof(int64_t)) {
+        auto* pval = reinterpret_cast<int64_t*>(src.ptr);
+        BigIntVal result = BigIntVal(*pval);
+        delete pval;
+        return result;
+    } else {
+        auto src_bitmap = reinterpret_cast<BitmapValue*>(src.ptr);
+        BigIntVal result = BigIntVal(src_bitmap->cardinality());
+        delete src_bitmap;
+        return result;
+    }
 }
 
 // This is a serialize function for orthogonal_bitmap_intersect_count(bitmap,t,t).


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org