tool
/
starrocks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[BugFix] Fix UAF for BinaryColumn::append_selective (backport #62410) (#62458) 

Signed-off-by: zihe.liu <ziheliu1024@gmail.com>
Co-authored-by: zihe.liu <ziheliu1024@gmail.com>
This commit is contained in:
mergify[bot] 2025-08-28 15:57:15 +08:00 committed by GitHub
parent e7b6d57f23
commit c03f27bca3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
be/src/column/binary_column.cpp
View File

@ -93,14 +93,13 @@ void BinaryColumnBase<T>::append_selective(const Column& src, const uint32_t* in
indexes += from;
const auto& src_column = down_cast<const BinaryColumnBase<T>&>(src);
const auto* __restrict src_offsets = src_column.get_offset().data();
const auto* __restrict src_bytes = src_column.get_bytes().data();
const size_t prev_num_offsets = _offsets.size();
const size_t prev_num_rows = prev_num_offsets - 1;
_offsets.resize(prev_num_offsets + size * 2);
auto* __restrict new_offsets = _offsets.data() + prev_num_offsets;
const auto* __restrict src_offsets = src_column.get_offset().data();
// Buffer i-th start offset and end offset in new_offsets[i * 2] and new_offsets[i * 2 + 1].
for (size_t i = 0; i < size; i++) {
@ -116,6 +115,7 @@ void BinaryColumnBase<T>::append_selective(const Column& src, const uint32_t* in
num_bytes += new_offsets[i * 2 + 1] - new_offsets[i * 2];
}
_bytes.resize(num_bytes);
const auto* __restrict src_bytes = src_column.get_bytes().data();
auto* __restrict dest_bytes = _bytes.data();
size_t cur_offset = _offsets[prev_num_rows];