(impala) 02/05: IMPALA-15532: Incorrect result in Instr() function when start position overflows 32-bit integer

[jo...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git

commit a659ffeb2c2463cc32287664919b0dd76b1f875b
Author: Jiyoung Yoo <ji...@cloudera.com>
AuthorDate: Thu Oct 8 18:50:07 2026 -0700

    IMPALA-15532: Incorrect result in Instr() function when start position overflows 32-bit integer
    
    In the Instr() string function, passing a 64-bit integer as the 'position'
    argument could cause integer overflow when implicitly converted to a
    32-bit integer type. As a result, when the start position exceeded the
    string bounds, it wrapped around and returned an incorrect non-zero index
    instead of returning '0' (not found).
    
    This patch fixes the issue by adding an early boundary check against
    the string length using 64-bit comparisons before entering the search logic.
    If the start position exceeds the positive or negative length of the string,
    StringFunctions::Instr() immediately returns 0.
    
    Testing:
    - Added unit tests in expr-test
    
    Change-Id: Ie023f75612b8db3ed2c73ff4760583e32dfe77c0
    Reviewed-on: http://gerrit.cloudera.org:8080/25079
    Tested-by: Impala Public Jenkins <im...@cloudera.com>
    Reviewed-by: Yida Wu <wy...@gmail.com>
---
 be/src/exprs/expr-test.cc           | 7 +++++++
 be/src/exprs/string-functions-ir.cc | 5 +++++
 2 files changed, 12 insertions(+)

diff --git a/be/src/exprs/expr-test.cc b/be/src/exprs/expr-test.cc
index b0fcc8b85..4bc57916b 100644
--- a/be/src/exprs/expr-test.cc
+++ b/be/src/exprs/expr-test.cc
@@ -4924,6 +4924,11 @@ TEST_P(ExprTest, StringFunctions) {
   TestValue("instr('corporate floor', 'or', -14)", TYPE_INT, 2);
   TestValue("instr('corporate floor', 'or', -15)", TYPE_INT, 0);
 
+  TestValue("instr('corporate floor', 'or', 4294967297)", TYPE_INT, 0);
+  TestValue("instr('corporate floor', 'or', -4294967294)", TYPE_INT, 0);
+  TestValue("instr('corporate floor', 'or', -9223372036854775807 - 1)", TYPE_INT, 0);
+  TestValue("instr('corporate floor', 'or', -4294967294, 2)", TYPE_INT, 0);
+
   TestValue("instr('corporate floor', 'or', 0, 1)", TYPE_INT, 0);
   TestValue("instr('corporate floor', 'or', 14, 1)", TYPE_INT, 14);
   TestValue("instr('corporate floor', 'or', 15, 1)", TYPE_INT, 0);
@@ -11202,6 +11207,8 @@ TEST_P(ExprTest, Utf8Test) {
   TestValue("instr('最快的SQL引擎', 'SQL', -5)", TYPE_INT, 4);
   TestValue("instr('最快的SQL引擎', 'SQL', -6)", TYPE_INT, 0);
   TestValue("instr('最快的SQL引擎', 'SQL', -600)", TYPE_INT, 0);
+  TestValue("instr('最快的SQL引擎', 'SQL', 4294967300)", TYPE_INT, 0);
+  TestValue("instr('最快的SQL引擎', 'SQL', -4294967300)", TYPE_INT, 0);
   TestValue("instr('最快的SQL引擎跑SQL', '引擎', 1)", TYPE_INT, 7);
   TestValue("instr('最快的SQL引擎跑SQL', '引擎', 7)", TYPE_INT, 7);
   TestValue("instr('最快的SQL引擎跑SQL', '引擎', 8)", TYPE_INT, 0);
diff --git a/be/src/exprs/string-functions-ir.cc b/be/src/exprs/string-functions-ir.cc
index cba110bce..246256dd9 100644
--- a/be/src/exprs/string-functions-ir.cc
+++ b/be/src/exprs/string-functions-ir.cc
@@ -908,6 +908,11 @@ IR_ALWAYS_INLINE IntVal StringFunctions::Instr(FunctionContext* context,
   }
   if (start_position.val == 0) return IntVal(0);
 
+  if (start_position.val > static_cast<int64_t>(str.len)
+      || start_position.val < -static_cast<int64_t>(str.len)) {
+    return IntVal(0);
+  }
+
   bool utf8_mode = context->impl()->GetConstFnAttr(FunctionContextImpl::UTF8_MODE);
   StringValue haystack = StringValue::FromStringVal(str);
   StringValue::SimpleString haystack_s = haystack.ToSimpleString();