Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BugFix] Fix UAF in shared UDF (backport #54592) #54609

Merged
merged 1 commit into from
Jan 3, 2025

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Jan 2, 2025

Why I'm doing:

In shared UDF the function context object is cached in memory, this can lead to a UAF when accessing the function context, resulting in undefined behavior.

What I'm doing:

In this commit, we remove the Function Context object of BatchCallStub. Use the StatusOr interface instead of the control flow.

==1404951==ERROR: AddressSanitizer: heap-use-after-free on address 0x614001250e80 at pc 0x00000c6298a1 bp 0x7f7f81b806f0 sp 0x7f7f81b806e0
READ of size 8 at 0x614001250e80 thread T590
    #0 0xc6298a0 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::size() const /usr/include/c++/11/bits/basic_string.h:921
    #1 0xc685eed in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::empty() const /usr/include/c++/11/bits/basic_string.h:1024
    #2 0x14934659 in starrocks::FunctionContext::has_error() const be/src/exprs/function_context.cpp:160
    #3 0x162357c1 in starrocks::UDFFunctionCallHelper::call(starrocks::FunctionContext*, std::vector<std::shared_ptr<starrocks::Column>, std::allocator<std::shared_ptr<starrocks::Column> > >&, unsigned long) be/src/exprs/java_function_call_expr.cpp:81
    #4 0x1622959e in operator() be/src/exprs/java_function_call_expr.cpp:114
    #5 0x16231d53 in __invoke_impl<starrocks::Status, starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*)::<lambda()>&> /usr/include/c++/11/bits/invoke.h:61
    #6 0x16231093 in __invoke_r<starrocks::Status, starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*)::<lambda()>&> /usr/include/c++/11/bits/invoke.h:116
    #7 0x16230746 in _M_invoke /usr/include/c++/11/bits/std_function.h:291
    #8 0xe2ada11 in std::function<starrocks::Status ()>::operator()() const /usr/include/c++/11/bits/std_function.h:590
    #9 0x19a18955 in starrocks::call_function_in_pthread(starrocks::RuntimeState*, std::function<starrocks::Status ()> const&) be/src/udf/java/utils.cpp:45
    #10 0x16229da8 in starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*) be/src/exprs/java_function_call_expr.cpp:117
    #11 0x1491137f in starrocks::ExprContext::evaluate(starrocks::Expr*, starrocks::Chunk*, unsigned char*) be/src/exprs/expr_context.cpp:188
    #12 0x14910a53 in starrocks::ExprContext::evaluate(starrocks::Chunk*, unsigned char*) be/src/exprs/expr_context.cpp:164
    #13 0xfd85334 in starrocks::pipeline::ProjectOperator::push_chunk(starrocks::RuntimeState*, std::shared_ptr<starrocks::Chunk> const&) be/src/exec/pipeline/project_operator.cpp:60
    #14 0x10156289 in starrocks::pipeline::PipelineDriver::process(starrocks::RuntimeState*, int) be/src/exec/pipeline/pipeline_driver.cpp:352

close https://github.com/StarRocks/StarRocksTest/issues/9031

What type of PR is this:

  • BugFix
  • Feature
  • Enhancement
  • Refactor
  • UT
  • Doc
  • Tool

Does this PR entail a change in behavior?

  • Yes, this PR will result in a change in behavior.
  • No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

  • Interface/UI changes: syntax, type conversion, expression evaluation, display information
  • Parameter changes: default values, similar parameters but with different default values
  • Policy changes: use new policy to replace old one, functionality automatically enabled
  • Feature removed
  • Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

  • I have added test cases for my bug fix or my new feature
  • This pr needs user documentation (for new or modified features or behaviors)
    • I have added documentation for my new feature or new function
  • This is a backport pr

Signed-off-by: stdpain <[email protected]>
(cherry picked from commit a29b2b6)
@mergify mergify bot mentioned this pull request Jan 2, 2025
24 tasks
@wanpengfei-git wanpengfei-git enabled auto-merge (squash) January 2, 2025 13:44
@wanpengfei-git wanpengfei-git merged commit 9c501cc into branch-3.2 Jan 3, 2025
32 of 33 checks passed
@wanpengfei-git wanpengfei-git deleted the mergify/bp/branch-3.2/pr-54592 branch January 3, 2025 02:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants