Server throws exception: `Logical error: 'Arguments of 'minus' have incorrect data types`

**Describe what's wrong**
Insertion into distributed table causes Segmentation fault

**How to reproduce**

* Which ClickHouse server version to use: `24.9.1.1(master)` 
* Which interface to use, if it matters: `MySQL Shell`
* Non-default settings, if any: 
```xml
            <distributed_product_mode>allow</distributed_product_mode>
            <allow_experimental_parallel_reading_from_replicas>1</allow_experimental_parallel_reading_from_replicas>
            <allow_experimental_inverted_index>1</allow_experimental_inverted_index>
            <allow_experimental_full_text_index>1</allow_experimental_full_text_index>
            <allow_experimental_join_condition>1</allow_experimental_join_condition>
            <allow_experimental_query_deduplication>1</allow_experimental_query_deduplication>
```

* init database:
[init.sql.txt](https://github.com/user-attachments/files/17148875/init.sql.txt)

* Queries to run that lead to an unexpected result
[error.sql.txt](https://github.com/user-attachments/files/17148874/error.sql.txt)

clickhouse log:
full log: [db_0.log](https://github.com/user-attachments/files/17148873/db_0.log)
summary:
```
2024.09.26 12:57:47.988668 [ 833 ] {mysql:7:09b60788-e483-4f24-908b-7ad29c934ac6} <Fatal> : Logical error: 'Arguments of 'minus' have incorrect data types: 'if(CAST(equals(__table1.c_izfnu, __table1.c_l8d2_b), 'Nullable(Bool)'_String), sign(__table1.c_izfnu), __table1.c_hmbcdw)' of type 'Int64', '__table1.c_zjw' of type 'Int32''.
2024.09.26 12:57:47.992482 [ 611 ] {64a8019e-4d94-4081-90f7-219349876215::202409_1_10_2} <Debug> MergeTask::PrepareStage: Selected MergeAlgorithm: Horizontal
2024.09.26 12:57:48.019495 [ 833 ] {mysql:7:09b60788-e483-4f24-908b-7ad29c934ac6} <Fatal> : Stack trace (when copying this message, always include the lines below):

0. ./contrib/llvm-project/libcxx/include/exception:141: Poco::Exception::Exception(String const&, int) @ 0x00000000271e7f14
1. ./build/./src/Common/Exception.cpp:109: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x00000000152997a9
2. DB::Exception::Exception(PreformattedMessage&&, int) @ 0x00000000054e4045
3. DB::Exception::Exception<String, String const&, String, String const&, String>(int, FormatStringHelperImpl<std::type_identity<String>::type, std::type_identity<String const&>::type, std::type_identity<String>::type, std::type_identity<String const&>::type, std::type_identity<String>::type>, String&&, String const&, String&&, String const&, String&&) @ 0x0000000007d33815
4. DB::FunctionBinaryArithmetic<DB::MinusImpl, DB::NameMinus, true, true, false>::executeImpl2(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul> const*) const @ 0x000000000ef7f539
5. DB::FunctionBinaryArithmetic<DB::MinusImpl, DB::NameMinus, true, true, false>::executeImpl(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000000ef798b3
6. DB::IFunction::executeImplDryRun(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x00000000054e25f5
7. DB::FunctionToExecutableFunctionAdaptor::executeDryRunImpl(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000000551d7d5
8. DB::IExecutableFunction::executeWithoutLowCardinalityColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x000000000776f05b
9. DB::IExecutableFunction::executeWithoutSparseColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000077709bc
10. DB::IExecutableFunction::execute(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x0000000007774390
11. ./build/./src/Interpreters/ActionsDAG.cpp:734: DB::ActionsDAG::evaluatePartialResult(std::unordered_map<DB::ActionsDAG::Node const*, DB::ColumnWithTypeAndName, std::hash<DB::ActionsDAG::Node const*>, std::equal_to<DB::ActionsDAG::Node const*>, std::allocator<std::pair<DB::ActionsDAG::Node const* const, DB::ColumnWithTypeAndName>>>&, std::vector<DB::ActionsDAG::Node const*, std::allocator<DB::ActionsDAG::Node const*>> const&, unsigned long, bool) @ 0x000000002156a048
12. ./build/./src/Interpreters/ActionsDAG.cpp:814: DB::ActionsDAG::updateHeader(DB::Block const&) const @ 0x0000000021567a37
13. ./build/./src/Processors/Transforms/ExpressionTransform.cpp:10: DB::ExpressionTransform::transformHeader(DB::Block const&, DB::ActionsDAG const&) @ 0x00000000263ed837
14. ./build/./src/Processors/QueryPlan/ExpressionStep.cpp:31: DB::ExpressionStep::ExpressionStep(DB::DataStream const&, DB::ActionsDAG) @ 0x00000000267c9af9
15. ./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:714: DB::(anonymous namespace)::addExpressionStep(DB::QueryPlan&, std::shared_ptr<DB::ActionsAndProjectInputsFlag>&, String const&, std::unordered_set<std::shared_ptr<DB::FutureSet>, std::hash<std::shared_ptr<DB::FutureSet>>, std::equal_to<std::shared_ptr<DB::FutureSet>>, std::allocator<std::shared_ptr<DB::FutureSet>>>&) @ 0x00000000227642f3
16. ./build/./src/Planner/Planner.cpp:1644: DB::Planner::buildPlanForQueryNode() @ 0x000000002275c782
17. ./build/./src/Planner/Planner.cpp:1292: DB::Planner::buildQueryPlanIfNeeded() @ 0x000000002274e07b
18. ./build/./src/Interpreters/InterpreterSelectQueryAnalyzer.cpp:234: DB::InterpreterSelectQueryAnalyzer::getQueryPlan() @ 0x0000000022749352
19. ./build/./src/Interpreters/executeQuery.cpp:1263: DB::executeQueryImpl(char const*, char const*, std::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x0000000022e0bee2
20. ./build/./src/Interpreters/executeQuery.cpp:1613: DB::executeQuery(DB::ReadBuffer&, DB::WriteBuffer&, bool, std::shared_ptr<DB::Context>, std::function<void (DB::QueryResultDetails const&)>, DB::QueryFlags, std::optional<DB::FormatSettings> const&, std::function<void (DB::IOutputFormat&, String const&, std::shared_ptr<DB::Context const> const&, std::optional<DB::FormatSettings> const&)>) @ 0x0000000022e13821
21. ./build/./src/Server/MySQLHandler.cpp:530: DB::MySQLHandler::comQuery(DB::ReadBuffer&, bool) @ 0x0000000025f4738a
22. ./build/./src/Server/MySQLHandler.cpp:295: DB::MySQLHandler::run() @ 0x0000000025f3e91d
23. ./build/./base/poco/Net/src/TCPServerConnection.cpp:43: Poco::Net::TCPServerConnection::start() @ 0x00000000273b452f
24. ./build/./base/poco/Net/src/TCPServerDispatcher.cpp:115: Poco::Net::TCPServerDispatcher::run() @ 0x00000000273b5117
25. ./build/./base/poco/Foundation/src/ThreadPool.cpp:205: Poco::PooledThread::run() @ 0x00000000272c824b
26. ./base/poco/Foundation/src/Thread_POSIX.cpp:335: Poco::ThreadImpl::runnableEntry(void*) @ 0x00000000272c23a8
27. asan_thread_start(void*) @ 0x0000000005499059
28. ? @ 0x00007fe5f6c1c609
29. ? @ 0x00007fe5f6eaf353
```

**Expected behavior**
No crash.

**Additional context**
docker compose config:
```
version: '3.8'
services:
  clickhouse-01:
    image: "my_clickhouse:latest"
    user: "101"
    container_name: clickhouse-01
    hostname: clickhouse-01
    networks:
      cluster_2S_1R:
        ipv4_address: 10.0.7.1
    volumes:
      - ${PWD}/fs/volumes/clickhouse-01/etc/clickhouse-server/config.d/config.xml:/etc/clickhouse-server/config.d/config.xml
      - ${PWD}/fs/volumes/clickhouse-01/etc/clickhouse-server/users.d/users.xml:/etc/clickhouse-server/users.d/users.xml
      - ${PWD}/fs/volumes/clickhouse-01/var/log/clickhouse-server:/var/log/clickhouse-server
      - /var/cores
    depends_on:
      - clickhouse-keeper-01
      - clickhouse-keeper-02
      - clickhouse-keeper-03
    # env for ASAN_OPTIONS
    environment:
      - ASAN_OPTIONS=detect_leaks=0:use_sigaltstack=false

  clickhouse-02:
    image: "my_clickhouse:latest"
    user: "101"
    container_name: clickhouse-02
    hostname: clickhouse-02
    networks:
      cluster_2S_1R:
        ipv4_address: 10.0.7.2
    volumes:
      - ${PWD}/fs/volumes/clickhouse-02/etc/clickhouse-server/config.d/config.xml:/etc/clickhouse-server/config.d/config.xml
      - ${PWD}/fs/volumes/clickhouse-02/etc/clickhouse-server/users.d/users.xml:/etc/clickhouse-server/users.d/users.xml
      - ${PWD}/fs/volumes/clickhouse-02/var/log/clickhouse-server:/var/log/clickhouse-server
    depends_on:
      - clickhouse-keeper-01
      - clickhouse-keeper-02
      - clickhouse-keeper-03
    environment:
      - ASAN_OPTIONS=detect_leaks=0:use_sigaltstack=false

  clickhouse-keeper-01:
    image: "clickhouse/clickhouse-keeper:${CHKVER:-latest-alpine}"
    user: "101"
    container_name: clickhouse-keeper-01
    hostname: clickhouse-keeper-01
    networks:
      cluster_2S_1R:
        ipv4_address: 10.0.7.5
    volumes:
      - ${PWD}/fs/volumes/clickhouse-keeper-01/etc/clickhouse-keeper/keeper_config.xml:/etc/clickhouse-keeper/keeper_config.xml
      - ${PWD}/fs/volumes/clickhouse-keeper-01/var/log/clickhouse-keeper:/var/log/clickhouse-keeper
    # caps for get_mempolicy
    cap_add:
      - SYS_NICE

  clickhouse-keeper-02:
    image: "clickhouse/clickhouse-keeper:${CHKVER:-latest-alpine}"
    user: "101"
    container_name: clickhouse-keeper-02
    hostname: clickhouse-keeper-02
    networks:
      cluster_2S_1R:
        ipv4_address: 10.0.7.6
    volumes:
      - ${PWD}/fs/volumes/clickhouse-keeper-02/etc/clickhouse-keeper/keeper_config.xml:/etc/clickhouse-keeper/keeper_config.xml
    # caps for get_mempolicy
    cap_add:
      - SYS_NICE

  clickhouse-keeper-03:
    image: "clickhouse/clickhouse-keeper:${CHKVER:-latest-alpine}"
    user: "101"
    container_name: clickhouse-keeper-03
    hostname: clickhouse-keeper-03
    networks:
      cluster_2S_1R:
        ipv4_address: 10.0.7.7
    volumes:
      - ${PWD}/fs/volumes/clickhouse-keeper-03/etc/clickhouse-keeper/keeper_config.xml:/etc/clickhouse-keeper/keeper_config.xml
    # caps for get_mempolicy
    cap_add:
      - SYS_NICE

networks:
  cluster_2S_1R:
    driver: bridge
    ipam:
      config:
        - subnet: 10.0.7.0/24
          gateway: 10.0.7.254

```

the my_clickhouse:latest is built by:
```dockerfile
FROM clickhouse/clickhouse-server:latest

# replace
COPY ./clickhouse /usr/bin/clickhouse
```

and the binary is built by
```
CC=clang-18 CXX=clang++-18 \
cmake -B build -S . \
    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
    -DENABLE_LIBRARIES=OFF \
    -DSANITIZE=address

cd build
ninja clickhouse-server clickhouse-client
```

config.xml
```xml
<clickhouse replace="true">
    <logger>
        <level>debug</level>
        <log>/var/log/clickhouse-server/clickhouse-server.log</log>
        <errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>
        <size>1000M</size>
        <count>3</count>
    </logger>
    <display_name>cluster_2S_1R node 1</display_name>
    <listen_host>0.0.0.0</listen_host>
    <http_port>8123</http_port>
    <tcp_port>9000</tcp_port>
    <mysql_port>9004</mysql_port>
    <postgresql_port>9005</postgresql_port>
    <user_directories>
        <users_xml>
            <path>users.xml</path>
        </users_xml>
        <local_directory>
            <path>/var/lib/clickhouse/access/</path>
        </local_directory>
    </user_directories>
    <distributed_ddl>
        <path>/clickhouse/task_queue/ddl</path>
    </distributed_ddl>
    <remote_servers>
        <default>
            <shard>
                <replica>
                    <host>clickhouse-01</host>
                    <port>9000</port>
                </replica>
            </shard>
            <shard>
                <replica>
                    <host>clickhouse-02</host>
                    <port>9000</port>
                </replica>
            </shard>
        </default>
    </remote_servers>
    <send_crash_reports>
        <enabled>true</enabled>
    </send_crash_reports>
    <zookeeper>
        <node>
            <host>clickhouse-keeper-01</host>
            <port>9181</port>
        </node>
        <node>
            <host>clickhouse-keeper-02</host>
            <port>9181</port>
        </node>
        <node>
            <host>clickhouse-keeper-03</host>
            <port>9181</port>
        </node>
    </zookeeper>
    <macros>
        <shard>01</shard>
        <replica>01</replica>
    </macros>
</clickhouse>

```
users.xml
```xml
<?xml version="1.0"?>
<clickhouse replace="true">
    <profiles>
        <default>
            <max_memory_usage>20000000000</max_memory_usage>
            <use_uncompressed_cache>0</use_uncompressed_cache>
            <load_balancing>in_order</load_balancing>
            <log_queries>1</log_queries>
            <distributed_product_mode>allow</distributed_product_mode>
            <allow_experimental_parallel_reading_from_replicas>1</allow_experimental_parallel_reading_from_replicas>
            <allow_experimental_inverted_index>1</allow_experimental_inverted_index>
            <allow_experimental_full_text_index>1</allow_experimental_full_text_index>
            <allow_experimental_join_condition>1</allow_experimental_join_condition>
            <allow_experimental_query_deduplication>1</allow_experimental_query_deduplication>
        </default>
    </profiles>
    <users>
        <default>
            <access_management>1</access_management>
            <profile>default</profile>
            <networks>
                <ip>::/0</ip>
            </networks>
            <password></password>
            <quota>default</quota>
            <access_management>1</access_management>
            <named_collection_control>1</named_collection_control>
            <show_named_collections>1</show_named_collections>
            <show_named_collections_secrets>1</show_named_collections_secrets>
        </default>
    </users>
    <quotas>
        <default>
            <interval>
                <duration>3600</duration>
                <queries>0</queries>
                <errors>0</errors>
                <result_rows>0</result_rows>
                <read_rows>0</read_rows>
                <execution_time>0</execution_time>
            </interval>
        </default>
    </quotas>
</clickhouse>

```

#### about us
We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the potential above-mentioned vulnerability that may lead to database error.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Server throws exception: `Logical error: 'Arguments of 'minus' have incorrect data types` #70015

about us

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Server throws exception: Logical error: 'Arguments of 'minus' have incorrect data types #70015

Description

about us

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Server throws exception: `Logical error: 'Arguments of 'minus' have incorrect data types` #70015