Skip to content

branch-30:[Bug](function) fix to_ipv6 cause stack-buffer-overflow error (#53713) #54011

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
dataroaring merged 1 commit into from
Aug 12, 2025
Merged

branch-30:[Bug](function) fix to_ipv6 cause stack-buffer-overflow error (#53713) #54011

dataroaring merged 1 commit into from
Aug 12, 2025

Conversation

@zhangstar333
Copy link
Contributor

@zhangstar333 zhangstar333 commented Jul 29, 2025

What problem does this PR solve?

Problem Summary:
cherry-pick from (#53713)

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason

  • Behavior changed:

    • No.
    • Yes.

  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@zhangstar333
[Bug](function) fix to_ipv6 cause stack-buffer-overflow error (apache…
b6910ff 
…#53713)

Problem Summary:

memcpy(dst, &result, sizeof(result));
when use memcpy, it's size if sizeof(result), so use int64 maybe
overflow of dst

```
==3524968==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f18404e1d73 at pc 0x559e2c162b01 bp 0x7f18439e5dc0 sp 0x7f18439e5db8
WRITE of size 8 at 0x7f18404e1d73 thread T1265 (brpc_light)
    #0 0x559e2c162b00 in bool doris::vectorized::parse_ipv4<char const, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'()>(char const*&, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'(), unsigned char*, long) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:165:5
    apache#1 0x559e2c161eb3 in bool doris::vectorized::parse_ipv6<char const, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'()>(char const*&, doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*)::'lambda'(), unsigned char*, int) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:416:18
    apache#2 0x559e2c160c44 in doris::vectorized::parse_ipv6(char const*, char const*, unsigned char*) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:467:9
    apache#3 0x559e2c160c44 in doris::vectorized::parse_ipv6_whole(char const*, char const*, unsigned char*) /mnt/disk8/zhangsida/doris/be/src/vec/common/format_ip.h:475:12
    apache#4 0x559e2c160c44 in doris::IPv6Value::from_string(unsigned __int128&, char const*, unsigned long) /mnt/disk8/zhangsida/doris/be/src/vec/runtime/ipv6_value.h:71:16
    apache#5 0x559e4fdb05f3 in doris::vectorized::FunctionToIP<(doris::vectorized::IPConvertExceptionMode)0, (doris::PrimitiveType)37>::execute_impl(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function_ip.h:1180:21
    apache#6 0x559e4c233b1e in doris::vectorized::DefaultExecutable::execute_impl(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.h:447:26
    apache#7 0x559e4eebcef3 in doris::vectorized::PreparedFunctionImpl::_execute_skipped_constant_deal(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp
    apache#8 0x559e4eeb68c4 in doris::vectorized::PreparedFunctionImpl::default_implementation_for_constant_arguments(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool, bool*) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp:168:5
    apache#9 0x559e4eeb8fc4 in doris::vectorized::PreparedFunctionImpl::execute_without_low_cardinality_columns(doris::FunctionContext*, doris::vectorized::Block&, std::vector<unsigned int, std::allocator<unsigned int>> const&, unsigned int, unsigned long, bool) const /mnt/disk8/zhangsida/doris/be/src/vec/functions/function.cpp:237:5
```
@Thearas
Copy link
Contributor

Thearas commented Jul 29, 2025

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@zhangstar333
Copy link
Contributor Author

zhangstar333 commented Jul 29, 2025

run buildall

@hello-stephen
Copy link
Contributor

hello-stephen commented Jul 29, 2025

BE UT Coverage Report

Increment line coverage 75.00% (3/4) 🎉

Increment coverage report
Complete coverage report

Category Coverage
Function Coverage 41.90% (11137/26580)
Line Coverage 32.44% (95410/294134)
Region Coverage 31.57% (49272/156072)
Branch Coverage 27.99% (25244/90186)

@doris-robot
Copy link

doris-robot commented Jul 29, 2025

TPC-H: Total hot run time: 40172 ms 
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit b6910ffbc07226427f87896bb5868b925bfb012b, data reload: false

------ Round 1 ----------------------------------
q1	17672	6934	6630	6630
q2	2075	195	164	164
q3	10617	1171	1166	1166
q4	10498	768	748	748
q5	7745	3160	2818	2818
q6	213	131	130	130
q7	969	629	594	594
q8	9423	2002	2022	2002
q9	6739	6415	6434	6415
q10	6993	2230	2344	2230
q11	459	259	262	259
q12	396	213	212	212
q13	17774	2993	2992	2992
q14	236	215	200	200
q15	515	474	461	461
q16	447	368	378	368
q17	978	594	547	547
q18	7487	6776	6702	6702
q19	1415	1075	1023	1023
q20	484	201	202	201
q21	3902	3306	3351	3306
q22	1083	1004	1014	1004
Total cold run time: 108120 ms
Total hot run time: 40172 ms

----- Round 2, with runtime_filter_mode=off -----
q1	6655	6544	6613	6544
q2	338	229	234	229
q3	3019	3022	2985	2985
q4	2058	1825	1782	1782
q5	5731	5793	5750	5750
q6	212	127	125	125
q7	2198	1814	1755	1755
q8	3381	3496	3516	3496
q9	8785	8882	8845	8845
q10	3585	3539	3504	3504
q11	571	482	490	482
q12	828	622	608	608
q13	8933	3198	3191	3191
q14	306	273	274	273
q15	514	459	463	459
q16	458	428	437	428
q17	1841	1653	1627	1627
q18	8191	7677	7679	7677
q19	1699	1588	1631	1588
q20	2114	1879	1830	1830
q21	5140	4968	4927	4927
q22	1140	1006	985	985
Total cold run time: 67697 ms
Total hot run time: 59090 ms

@doris-robot
Copy link

doris-robot commented Jul 29, 2025

TPC-DS: Total hot run time: 190351 ms 
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit b6910ffbc07226427f87896bb5868b925bfb012b, data reload: false

query1	966	385	363	363
query2	6542	1884	1846	1846
query3	6698	215	224	215
query4	33898	23491	23956	23491
query5	4353	444	463	444
query6	274	171	178	171
query7	4631	310	308	308
query8	275	215	205	205
query9	9643	2569	2570	2569
query10	483	281	274	274
query11	18159	15713	15288	15288
query12	149	105	105	105
query13	1639	430	421	421
query14	9691	7184	7537	7184
query15	254	178	184	178
query16	8203	479	462	462
query17	1673	581	563	563
query18	2151	310	319	310
query19	375	161	154	154
query20	121	108	111	108
query21	207	106	106	106
query22	4325	4216	4160	4160
query23	34629	33113	33450	33113
query24	11779	2869	2872	2869
query25	715	412	398	398
query26	1802	169	176	169
query27	2868	355	358	355
query28	7705	2129	2126	2126
query29	1067	457	445	445
query30	330	162	157	157
query31	1038	784	779	779
query32	98	59	61	59
query33	799	321	308	308
query34	904	507	531	507
query35	886	719	733	719
query36	1100	926	957	926
query37	190	73	71	71
query38	3981	3813	3808	3808
query39	1468	1421	1428	1421
query40	289	104	103	103
query41	55	51	52	51
query42	110	102	110	102
query43	519	474	469	469
query44	1272	807	801	801
query45	185	171	169	169
query46	1146	732	727	727
query47	1958	1845	1819	1819
query48	470	387	395	387
query49	1304	413	404	404
query50	820	417	416	416
query51	7447	7103	7161	7103
query52	104	98	88	88
query53	262	185	190	185
query54	1231	491	498	491
query55	83	78	82	78
query56	282	250	256	250
query57	1274	1179	1159	1159
query58	254	211	222	211
query59	2932	2925	2735	2735
query60	280	262	250	250
query61	111	112	113	112
query62	854	674	657	657
query63	219	187	191	187
query64	5252	669	641	641
query65	3312	3168	3189	3168
query66	1434	313	299	299
query67	15979	15676	15491	15491
query68	4502	572	589	572
query69	444	274	267	267
query70	1197	1158	1126	1126
query71	390	255	257	255
query72	6683	4160	4094	4094
query73	737	357	357	357
query74	10339	8955	8973	8955
query75	3387	2618	2625	2618
query76	2756	1063	1141	1063
query77	414	285	283	283
query78	10486	9572	9589	9572
query79	2530	620	636	620
query80	1056	430	420	420
query81	526	222	219	219
query82	912	90	95	90
query83	220	142	146	142
query84	249	79	77	77
query85	1483	307	298	298
query86	451	302	299	299
query87	4412	4257	4333	4257
query88	4247	2425	2371	2371
query89	407	294	294	294
query90	2004	203	186	186
query91	205	152	153	152
query92	71	52	56	52
query93	1635	562	551	551
query94	871	298	288	288
query95	365	267	263	263
query96	603	280	281	280
query97	3245	3142	3121	3121
query98	223	202	197	197
query99	1515	1357	1304	1304
Total cold run time: 304072 ms
Total hot run time: 190351 ms

@doris-robot
Copy link

doris-robot commented Jul 29, 2025

ClickBench: Total hot run time: 30.19 s 
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit b6910ffbc07226427f87896bb5868b925bfb012b, data reload: false

query1	0.03	0.04	0.03
query2	0.07	0.03	0.04
query3	0.23	0.07	0.06
query4	1.61	0.11	0.11
query5	0.53	0.51	0.50
query6	1.14	0.72	0.73
query7	0.02	0.02	0.01
query8	0.04	0.04	0.03
query9	0.56	0.49	0.50
query10	0.55	0.55	0.57
query11	0.15	0.09	0.10
query12	0.14	0.11	0.11
query13	0.62	0.60	0.59
query14	0.78	0.78	0.82
query15	0.86	0.83	0.82
query16	0.38	0.39	0.40
query17	1.02	1.02	0.98
query18	0.24	0.22	0.23
query19	1.89	1.85	1.86
query20	0.01	0.02	0.01
query21	15.39	0.59	0.59
query22	2.66	1.85	2.07
query23	17.10	0.95	0.88
query24	2.98	0.95	2.29
query25	0.24	0.17	0.05
query26	0.54	0.15	0.15
query27	0.05	0.04	0.04
query28	9.32	0.53	0.46
query29	12.60	3.20	3.19
query30	0.25	0.06	0.06
query31	2.86	0.39	0.38
query32	3.22	0.47	0.46
query33	2.98	2.99	3.02
query34	16.92	4.51	4.53
query35	4.55	4.48	4.56
query36	0.66	0.48	0.50
query37	0.08	0.06	0.07
query38	0.05	0.04	0.03
query39	0.04	0.02	0.02
query40	0.16	0.13	0.12
query41	0.09	0.02	0.02
query42	0.04	0.02	0.02
query43	0.03	0.03	0.03
Total cold run time: 103.68 s
Total hot run time: 30.19 s

dataroaring
dataroaring approved these changes Aug 12, 2025
View reviewed changes
Copy link
Contributor

@dataroaring dataroaring left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dataroaring dataroaring merged commit 307d4e5 into apache:branch-3.0 Aug 12, 2025
23 of 25 checks passed
@gavinchou gavinchou mentioned this pull request Sep 1, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dataroaring dataroaring dataroaring approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@zhangstar333 @Thearas @hello-stephen @doris-robot @dataroaring