This is an automated email from the ASF dual-hosted git repository.
jacktengg pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new e904fbe7d9c [fix](be) Fix array_difference out-of-bounds read on
single-element array (#65855)
e904fbe7d9c is described below
commit e904fbe7d9c13c49f8bfa690d90ea963630e570d
Author: HappenLee <[email protected]>
AuthorDate: Wed Jul 22 11:51:23 2026 +0800
[fix](be) Fix array_difference out-of-bounds read on single-element array
(#65855)
### What problem does this PR solve?
Issue Number: None
Problem Summary:
FunctionArrayDifference::impl read src[begin+1] before checking whether
begin+1 < end. For a single-element array (begin+1 == end) this accessed
one element past the valid range, causing undefined behavior.
The fix rewrites the loop so that it only reads src[curr_pos] when
curr_pos < end, while preserving the existing semantics.
This change also adds regression cases for single-element arrays and
for int32 overflow scenarios (e.g. [INT32_MAX, INT32_MIN]) to ensure
array_difference widens to bigint before subtraction.
### Release note
None
### Check List (For Author)
- Test: Regression test
- Behavior changed: No
- Does this need documentation: No
---
be/src/exprs/function/array/function_array_difference.h | 13 +++++--------
.../test_array_functions_of_array_difference.out | 12 ++++++++++++
.../test_array_functions_of_array_difference.groovy | 6 ++++++
3 files changed, 23 insertions(+), 8 deletions(-)
diff --git a/be/src/exprs/function/array/function_array_difference.h
b/be/src/exprs/function/array/function_array_difference.h
index 065be5a35be..cb29ef42737 100644
--- a/be/src/exprs/function/array/function_array_difference.h
+++ b/be/src/exprs/function/array/function_array_difference.h
@@ -130,14 +130,11 @@ private:
template <typename Element, typename Result>
NO_SANITIZE_UNDEFINED static void impl(const Element* __restrict src,
Result* __restrict dst,
size_t begin, size_t end) {
- size_t curr_pos = begin;
- if (curr_pos < end) {
- Element prev_element = src[curr_pos];
- dst[curr_pos] = {};
- curr_pos++;
- Element curr_element = src[curr_pos];
- for (; curr_pos < end; ++curr_pos) {
- curr_element = src[curr_pos];
+ if (begin < end) {
+ Element prev_element = src[begin];
+ dst[begin] = {};
+ for (size_t curr_pos = begin + 1; curr_pos < end; ++curr_pos) {
+ Element curr_element = src[curr_pos];
dst[curr_pos] =
static_cast<Result>(curr_element) -
static_cast<Result>(prev_element);
prev_element = curr_element;
diff --git
a/regression-test/data/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.out
b/regression-test/data/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.out
index afdad5f9500..5cec2b9c19e 100644
---
a/regression-test/data/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.out
+++
b/regression-test/data/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.out
@@ -7,6 +7,9 @@
5 [16, 7, 8] [0, -9, 1]
6 [1, 2, 3, 4, 5, 4, 3, 2, 1] [0, 1, 1, 1, 1, -1, -1, -1, -1]
7 [1111, 12324, 8674, 123, 3434, 435, 45, 53, 54, 2] [0, 11213,
-3650, -8551, 3311, -2999, -390, 8, 1, -52]
+8 [42] [0]
+9 [2147483647, -2147483648] [0, -4294967295]
+10 [-2147483648, 2147483647] [0, 4294967295]
-- !select --
[0, 1, 1, 1]
@@ -14,3 +17,12 @@
-- !select --
[0, 6, 93, -95]
+-- !select --
+[0]
+
+-- !select --
+[0, -4294967295]
+
+-- !select --
+[0, 4294967295]
+
diff --git
a/regression-test/suites/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.groovy
b/regression-test/suites/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.groovy
index 19db8178729..e0f4beff26d 100644
---
a/regression-test/suites/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.groovy
+++
b/regression-test/suites/query_p0/sql_functions/array_functions/test_array_functions_of_array_difference.groovy
@@ -38,11 +38,17 @@ suite("test_array_functions_of_array_difference") {
sql """ INSERT INTO ${tableName} VALUES(5, [16,7,8]) """
sql """ INSERT INTO ${tableName} VALUES(6, [1,2,3,4,5,4,3,2,1]) """
sql """ INSERT INTO ${tableName} VALUES(7,
[1111,12324,8674,123,3434,435,45,53,54,2]) """
+ sql """ INSERT INTO ${tableName} VALUES(8, [42]) """
+ sql """ INSERT INTO ${tableName} VALUES(9, [2147483647,-2147483648]) """
+ sql """ INSERT INTO ${tableName} VALUES(10, [-2147483648,2147483647]) """
qt_select "SELECT *, array_difference(k2) FROM ${tableName} order by k1"
// literal
qt_select "SELECT array_difference([1, 2, 3, 4]);"
qt_select "SELECT array_difference([1, 7, 100, 5]);"
+ qt_select "SELECT array_difference([42]);"
+ qt_select "SELECT array_difference([2147483647, -2147483648]);"
+ qt_select "SELECT array_difference([-2147483648, 2147483647]);"
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
