github-actions[bot] commented on code in PR #70202:
URL: https://github.com/apache/doris/pull/70202#discussion_r4482662083
##########
be/src/exprs/aggregate/aggregate_function_collect.h:
##########
@@ -352,15 +358,60 @@ struct AggregateFunctionCollectListData<T, HasLimit> {
}
}
+ void write(BufferWritable& buf, const IDataType& column_type, int
query_version) const {
+ // A mixed cluster still uses the old query version: old BEs can only
read JSON states.
+ if (query_version < SUPPORT_COLLECT_LIST_NATIVE_SERIALIZATION_VERSION)
{
+ write(buf);
+ return;
+ }
+
+ // JSON can split the single array string a","b into two elements.
Serialize the
+ // column in place and frame only the actual native bytes, as nullable
array_agg does.
+ const auto capacity = cast_set<size_t>(
+ column_type.get_uncompressed_serialized_bytes(*column_data,
query_version));
+ buf.resize(sizeof(UInt64) + capacity);
+ auto* begin = buf.data() + sizeof(UInt64);
+ const char* end = nullptr;
+ try {
+ end = column_type.serialize(*column_data, begin, query_version);
+ } catch (...) {
+ buf.resize(0);
+ throw;
+ }
+ DORIS_CHECK_LE(end, begin + capacity);
+ const auto serialized_bytes = static_cast<UInt64>(end - begin);
+ memcpy(buf.data(), &serialized_bytes, sizeof(serialized_bytes));
+ const auto frame_bytes = sizeof(serialized_bytes) +
cast_set<size_t>(serialized_bytes);
+ buf.resize(frame_bytes);
+ buf.add_offset(frame_bytes);
+ write_var_int(max_size, buf);
+ }
+
+ void read(BufferReadable& buf, const IDataType& column_type, int
query_version) {
+ // Match the sender's query version, including when this BE supports a
newer version.
+ if (query_version < SUPPORT_COLLECT_LIST_NATIVE_SERIALIZATION_VERSION)
{
+ read(buf);
+ return;
+ }
+
+ UInt64 serialized_bytes = 0;
+ buf.read_binary(serialized_bytes);
+ const auto* begin = buf.data();
+ column_data->clear();
+ const auto* end = column_type.deserialize(begin, &column_data,
query_version);
Review Comment:
[P1] Bound the native frame before deserializing it. `serialized_bytes` is
read and then passed to `column_type.deserialize(begin, &column_data,
query_version)` at line 401, while the equality check at line 402 happens only
after the type has consumed its embedded lengths. `BufferReadable` and common
deserializers do not check an end pointer, so a truncated/corrupt collect_list
state can read through the frame into `max_size` or the next aggregate row and
crash the BE before the postcondition is reached. Reject declared lengths
beyond the remaining row and pass a bounded end/slice through the nested
deserializers (including a checked path for types without the end-aware
overload), then consume `max_size` only after the frame is validated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
