(impala) branch master updated: IMPALA-14859: Fix crashes in parquet-column-chunk-reader.cc

[cs...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

csringhofer pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git


The following commit(s) were added to refs/heads/master by this push:
     new 59504bd7c IMPALA-14859: Fix crashes in parquet-column-chunk-reader.cc
59504bd7c is described below

commit 59504bd7ca7845bf88ea03a671840dee62baf981
Author: Balazs Hevele <bh...@cloudera.com>
AuthorDate: Thu Mar 26 08:08:48 2026 +0100

    IMPALA-14859: Fix crashes in parquet-column-chunk-reader.cc
    
    If running out of memory when trying to uncompress dictionary page
    buffer during parquet read, there was a crash, because there was an
    assumption that dict_page_pool_ failed to allocate it, but
    dict_page_pool_ is not initialized in this case, so there is a nullptr
    dereference.
    The error was fixed by only referencing dict_page_pool_ in the path
    where it is valid, and reverting the other path to reference parent's
    dictionary_pool_, which always exists.
    
    The error was introduced in IMPALA-14794
    with commit 49f0ab1d09541f960cee12e9a5e6aa38ec21565a
    
    Change-Id: I7e6b4e17c627baf97dee04cdfb9c63cdc0dad3b5
    Reviewed-on: http://gerrit.cloudera.org:8080/24140
    Tested-by: Impala Public Jenkins <im...@cloudera.com>
    Reviewed-by: Csaba Ringhofer <cs...@cloudera.com>
---
 be/src/exec/parquet/parquet-column-chunk-reader.cc | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/be/src/exec/parquet/parquet-column-chunk-reader.cc b/be/src/exec/parquet/parquet-column-chunk-reader.cc
index 5c2f9101c..9522a443c 100644
--- a/be/src/exec/parquet/parquet-column-chunk-reader.cc
+++ b/be/src/exec/parquet/parquet-column-chunk-reader.cc
@@ -181,18 +181,26 @@ Status ParquetColumnChunkReader::ReadDictionaryData(ScopedBuffer* uncompressed_b
       // the last row batch.
       dict_page_pool_.reset(new MemPool(parent_->scan_node_->mem_tracker()));
       *dict_values = dict_page_pool_->TryAllocate(buffer_size); // case 1.
-    } else if (uncompressed_buffer->TryAllocate(buffer_size)) {
-      *dict_values = uncompressed_buffer->buffer(); // case 2
-    }
-    if (UNLIKELY(*dict_values == nullptr)) {
-      string details = Substitute(PARQUET_PAGE_MEM_LIMIT_EXCEEDED, "InitDictionary",
-          buffer_size, "dictionary");
-      return dict_page_pool_->mem_tracker()->MemLimitExceeded(
+      if (UNLIKELY(*dict_values == nullptr)) {
+        string details = Substitute(PARQUET_PAGE_MEM_LIMIT_EXCEEDED, "InitDictionary",
+            buffer_size, "dictionary");
+        return dict_page_pool_->mem_tracker()->MemLimitExceeded(
+            parent_->state_, details, buffer_size);
+      }
+    } else {
+      if (LIKELY(uncompressed_buffer->TryAllocate(buffer_size))) {
+        *dict_values = uncompressed_buffer->buffer(); // case 2
+      } else {
+        string details = Substitute(PARQUET_PAGE_MEM_LIMIT_EXCEEDED, "InitDictionary",
+            buffer_size, "uncompressed dictionary");
+        return parent_->dictionary_pool_->mem_tracker()->MemLimitExceeded(
                parent_->state_, details, buffer_size);
+      }
     }
   } else {
     *dict_values = data; // case 3.
   }
+  DCHECK(*dict_values != nullptr);
 
   if (decompressor_.get() != nullptr) {
     int uncompressed_size = current_page_header.uncompressed_page_size;