Crashing due to index out of bounds
sayJason opened this issue · 2 comments
sayJason commented
Bug Report
Please answer these questions before submitting your issue. Thanks!
1. Minimal reproduce step (Required)
CREATE TABLE t1 (c1 FLOAT);
INSERT INTO t1 VALUES (0);
SELECT c1 FROM t1 WHERE ELT((CASE c1 WHEN c1 THEN ~ c1 WHEN c1 THEN 0 END), '-1', c1, 0 REGEXP ('\\-4 v/'));
2. What did you expect to see? (Required)
Some values should be returned.
3. What did you see instead (Required)
An error message is returned, and TiKV crashed.
ERROR 9005 (HY000): Region is unavailable
The log is in the following.
[lib.rs:497] ["index out of bounds: the len is 4 but the index is 9223372036854775807"]
4. What is your TiDB version? (Required)
Release Version: v7.0.0
Edition: Community
Git Commit Hash: 7376954
Git Branch: heads/refs/tags/v7.0.0
UTC Build Time: 2023-03-29 13:32:13
GoVersion: go1.20.2
Race Enabled: false
TiKV Min Version: 6.2.0-alpha
Check Table Before Drop: false
Store: tikv
sayJason commented
Here is another test case, which may help to locate the error.
CREATE TABLE t1 (c1 TEXT);
INSERT INTO t1 VALUES ('9223372036854775807');
SELECT c1 FROM t1 WHERE (0 NOT REGEXP(ELT(c1, 1)));
-- [lib.rs:497] ["index out of bounds: the len is 2 but the index is 9223372036854775807"]
The root cause may be that the ELT function does not properly handle the out of bound value.
Defined2014 commented
The bounds check looks like this, it causes i + 1
to overflow when i == 9223372036854775807
if i <= 0 || i + 1 > raw_args.len() as i64 {