pingcap/tidb

Crashing due to index out of bounds

sayJason opened this issue · 2 comments

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

CREATE TABLE t1 (c1 FLOAT);
INSERT INTO t1 VALUES (0);
SELECT c1 FROM t1 WHERE ELT((CASE c1 WHEN c1 THEN ~ c1 WHEN c1 THEN 0 END), '-1', c1, 0 REGEXP ('\\-4 v/'));

2. What did you expect to see? (Required)

Some values should be returned.

3. What did you see instead (Required)

An error message is returned, and TiKV crashed.

ERROR 9005 (HY000): Region is unavailable

The log is in the following.

[lib.rs:497] ["index out of bounds: the len is 4 but the index is 9223372036854775807"] 

4. What is your TiDB version? (Required)

Release Version: v7.0.0
Edition: Community
Git Commit Hash: 7376954
Git Branch: heads/refs/tags/v7.0.0
UTC Build Time: 2023-03-29 13:32:13
GoVersion: go1.20.2
Race Enabled: false
TiKV Min Version: 6.2.0-alpha
Check Table Before Drop: false
Store: tikv

Here is another test case, which may help to locate the error.

CREATE TABLE t1 (c1 TEXT);
INSERT INTO t1 VALUES ('9223372036854775807');
SELECT c1 FROM t1 WHERE (0 NOT REGEXP(ELT(c1, 1)));
-- [lib.rs:497] ["index out of bounds: the len is 2 but the index is 9223372036854775807"]

The root cause may be that the ELT function does not properly handle the out of bound value.

The bounds check looks like this, it causes i + 1 to overflow when i == 9223372036854775807

if i <= 0 || i + 1 > raw_args.len() as i64 {