This is an automated email from the ASF dual-hosted git repository.
tuhaihe pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
The following commit(s) were added to refs/heads/main by this push:
new 48f8f026a7f Fix use-after-free in CXformSplitWindowFunc
48f8f026a7f is described below
commit 48f8f026a7feca538738a96ab5b23c27e8dffaf1
Author: zhangwenchao <[email protected]>
AuthorDate: Mon Jun 22 18:51:34 2026 +0800
Fix use-after-free in CXformSplitWindowFunc
CXformSplitWindowFunc::Transform() builds a local and a global
CLogicalSequenceProject, and each constructor takes ownership of one
reference to the window's distribution spec (pds), order specs
(pdrgpos) and frames (pdrgpwf). Only a single AddRef() was issued for
each object, so once both SequenceProjects and the original are
released the reference count underflows and the objects are freed
while still in use.
The dangling memory later surfaces as a corrupt (unaligned) scalar
DXL node while translating a table scan filter, crashing the
coordinator with SIGSEGV at CTranslatorDXLToScalar.cpp:111 during
DXL-to-PlStmt translation. This reproduces on window-function queries
(e.g. TPC-DS query 44) when optimizer_force_split_window_function is
on; the transform is only enabled under that GUC, which is why the
crash disappears when it is off.
Add the missing AddRef() for pds, pdrgpos and pdrgpwf before building
the global SequenceProject, and for the Select operator and its scalar
comparison before reusing them in the global Select, so every owner
holds its own reference.
---
.../gporca/libgpopt/src/xforms/CXformSplitWindowFunc.cpp | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/src/backend/gporca/libgpopt/src/xforms/CXformSplitWindowFunc.cpp
b/src/backend/gporca/libgpopt/src/xforms/CXformSplitWindowFunc.cpp
index 92a310101bc..be1c5efa278 100644
--- a/src/backend/gporca/libgpopt/src/xforms/CXformSplitWindowFunc.cpp
+++ b/src/backend/gporca/libgpopt/src/xforms/CXformSplitWindowFunc.cpp
@@ -375,6 +375,16 @@ CXformSplitWindowFunc::Transform(CXformContext *pxfctxt,
CXformResult *pxfres,
CExpression *pexprLocalSelect =
GPOS_NEW(mp) CExpression(mp, pSelectCopy, pexprLocal,
pexprScalarCmp);
+ // the global SequenceProject below takes ownership of one reference
each to
+ // pds, pdrgpos and pdrgpwf, just like the local SequenceProject above.
Only
+ // a single AddRef() was issued for each of them, so add the matching
+ // references here; otherwise the reference count underflows, these
objects
+ // are freed while still in use, and the dangling memory later crashes
the
+ // DXL-to-PlStmt translation (use-after-free)
+ pds->AddRef();
+ pdrgpos->AddRef();
+ pdrgpwf->AddRef();
+
CExpression *pexprGlobal = GPOS_NEW(mp)
CExpression(mp,
GPOS_NEW(mp) CLogicalSequenceProject(
@@ -382,6 +392,9 @@ CXformSplitWindowFunc::Transform(CXformContext *pxfctxt,
CXformResult *pxfres,
pdrgpos, pdrgpwf),
pexprLocalSelect,
pexprProjectListGlobal);
+ pexpr->Pop()->AddRef();
+ pexprScalarCmp->AddRef();
+
CExpression *pexprGlobalSelect =
GPOS_NEW(mp) CExpression(mp, pexpr->Pop(), pexprGlobal,
pexprScalarCmp);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
