-
Notifications
You must be signed in to change notification settings - Fork 4k
Open
Description
Describe the bug, including details regarding any error messages, version, and platform.
Two Gandiva functions crash when called with extreme integer values:
-
substring_index(VARCHAR, VARCHAR, INT)crashes withINT_MINcount parameter- Calling
substring_index("a.b.c", ".", INT_MIN)causes SIGBUS crash - Root cause: Uses
abs(cnt)which triggers undefined behavior whencnt == INT_MIN(abs(INT_MIN) overflows in 32-bit signed integers)
- Calling
-
truncate(BIGINT, INT)crashes with extreme scale values- Calling
truncate(12345, INT_MAX)ortruncate(12345, INT_MIN)causes SIGSEGV - Root cause: Passes extreme scale values directly to
GetScaleMultiplier, which only has array entries for scales 0-38, causing out-of-bounds array access
- Calling
Expected behavior
Both functions should handle extreme integer values gracefully without crashing:
substring_indexshould safely compute absolute value of count parametertruncateshould validate scale parameter before array access
Actual behavior
substring_index: SIGBUS crash due to integer overflow inabs(INT_MIN)truncate: SIGSEGV crash due to out-of-bounds array access
How to reproduce
// substring_index crash
gdv_fn_substring_index(ctx, "a.b.c", 5, ".", 1, INT_MIN, &out_len);
// truncate crash
truncate_int64_int32(12345, INT_MAX);
truncate_int64_int32(12345, INT_MIN);
### Component(s)
C++, GandivaReactions are currently unavailable