This is an automated email from the ASF dual-hosted git repository. morningman pushed a commit to branch branch-1.1-lts in repository https://gitbox.apache.org/repos/asf/doris.git
commit 19a610d1e70f854a29d09f6ceaa4d1a5e3b764ea Author: AlexYue <[email protected]> AuthorDate: Wed Sep 21 09:19:38 2022 +0800 [Bugfix](string_functions) rearrange code to avoid global buffer overflow in FindInSetOp::execute (#12677) --- be/src/vec/functions/function_string.cpp | 2 +- .../tpch_sf1/function/test_find_in_set.out | 4 +++ .../tpch_sf1/function/test_find_in_set.groovy | 30 ++++++++++++++++++++++ 3 files changed, 35 insertions(+), 1 deletion(-) diff --git a/be/src/vec/functions/function_string.cpp b/be/src/vec/functions/function_string.cpp index 730a6e4742..1ea4d3d3a6 100644 --- a/be/src/vec/functions/function_string.cpp +++ b/be/src/vec/functions/function_string.cpp @@ -153,7 +153,7 @@ struct FindInSetOp { do { end = start; // Position end. - while (strr[end] != ',' && end < strr.length()) { + while (end < strr.length() && strr[end] != ',') { ++end; } diff --git a/regression-test/data/tpch_sf1_p1/tpch_sf1/function/test_find_in_set.out b/regression-test/data/tpch_sf1_p1/tpch_sf1/function/test_find_in_set.out new file mode 100644 index 0000000000..c92ff08e08 --- /dev/null +++ b/regression-test/data/tpch_sf1_p1/tpch_sf1/function/test_find_in_set.out @@ -0,0 +1,4 @@ +-- This file is automatically generated. You should know what you did if you want to edit this +-- !select -- +0 + diff --git a/regression-test/suites/tpch_sf1_p1/tpch_sf1/function/test_find_in_set.groovy b/regression-test/suites/tpch_sf1_p1/tpch_sf1/function/test_find_in_set.groovy new file mode 100644 index 0000000000..5c66757001 --- /dev/null +++ b/regression-test/suites/tpch_sf1_p1/tpch_sf1/function/test_find_in_set.groovy @@ -0,0 +1,30 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// There once exists a bug that when passing a too long string +// along with an empty one to find_in_set, BE + +suite("test_find_in_set") { + + qt_select """ + select find_in_set( + cast(regression_test_tpch_sf1_p1.orders.`O_COMMENT` as varchar), + cast(BITMAP_TO_STRING( + cast(BITMAP_EMPTY() as bitmap)) as varchar)) from regression_test_tpch_sf1_p1.orders limit 1 + """ + +} \ No newline at end of file --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
