[IMPALA-3533] Stack buffer overflow in CodegenMaterializeExprs

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Impala 2.6.0
• Fix Version/s: Impala 2.6.0
• Component/s: Backend
• Labels: broken-build crash
• Target Version: Impala 2.6.0
• Assignee: Skye Wanderman-Milne
• Reporter: Tim Armstrong
• Created: 12/May/16 20:39
• Updated: 16/May/16 18:24
• Resolved: 16/May/16 18:24

Description

I got this running locally:

==4666==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f12beb25ee8 at pc 0x0000016a9504 bp 0x7f12beb254d0 sp 0x7f12beb254c8
WRITE of size 8 at 0x7f12beb25ee8 thread T389
    #0 0x16a9503 in impala::LlvmCodeGen::FnPrototype::GeneratePrototype(llvm::IRBuilder<true, llvm::ConstantFolder, llvm::IRBuilderDefaultInserter<true> >*, llvm::Value**) /home/tarmstrong/Impala/Impala/be/src/codegen/llvm-codegen.cc:612:39
    #1 0x13ab5ca in impala::Tuple::CodegenMaterializeExprs(impala::RuntimeState*, bool, impala::TupleDescriptor const&, std::vector<impala::ExprContext*, std::allocator<impala::ExprContext*> > const&, impala::MemPool*, llvm::Function**) /home/tarmstrong/Impala/Impala/be/src/runtime/tuple.cc:352:9
    #2 0x1886940 in impala::TopNNode::Codegen(impala::RuntimeState*) /home/tarmstrong/Impala/Impala/be/src/exec/topn-node.cc:73:29
    #3 0x18871b9 in impala::TopNNode::Prepare(impala::RuntimeState*) /home/tarmstrong/Impala/Impala/be/src/exec/topn-node.cc:111:32
    #4 0x1b8a8fc in impala::PlanFragmentExecutor::Prepare(impala::TExecPlanFragmentParams const&) /home/tarmstrong/Impala/Impala/be/src/runtime/plan-fragment-executor.cc:244:31
    #5 0x15424e2 in impala::FragmentMgr::FragmentExecState::Prepare() /home/tarmstrong/Impala/Impala/be/src/service/fragment-exec-state.cc:46:19
    #6 0x1535d29 in impala::FragmentMgr::FragmentThread(impala::TUniqueId) /home/tarmstrong/Impala/Impala/be/src/service/fragment-mgr.cc:85:19
    #7 0x153b2dd in boost::_mfi::mf1<void, impala::FragmentMgr, impala::TUniqueId>::operator()(impala::FragmentMgr*, impala::TUniqueId) const /opt/Impala-Toolchain/boost-1.57.0/include/boost/bind/mem_fn_template.hpp:165:16
    #8 0x153b137 in void boost::_bi::list2<boost::_bi::value<impala::FragmentMgr*>, boost::_bi::value<impala::TUniqueId> >::operator()<boost::_mfi::mf1<void, impala::FragmentMgr, impala::TUniqueId>, boost::_bi::list0>(boost::_bi::type<void>, boost::_mfi::mf1<void, impala::FragmentMgr, impala::TUniqueId>&, boost::_bi::list0&, int) /opt/Impala-Toolchain/boost-1.57.0/include/boost/bind/bind.hpp:313:9
    #9 0x153afe7 in boost::_bi::bind_t<void, boost::_mfi::mf1<void, impala::FragmentMgr, impala::TUniqueId>, boost::_bi::list2<boost::_bi::value<impala::FragmentMgr*>, boost::_bi::value<impala::TUniqueId> > >::operator()() /opt/Impala-Toolchain/boost-1.57.0/include/boost/bind/bind_template.hpp:20:16
    #10 0x12be052 in boost::function0<void>::operator()() const /opt/Impala-Toolchain/boost-1.57.0/include/boost/function/function_template.hpp:766:14
    #11 0x1662ba5 in impala::Thread::SuperviseThread(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*) /home/tarmstrong/Impala/Impala/be/src/util/thread.cc:315:3
    #12 0x166be9a in void boost::_bi::list4<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::Promise<long>*> >::operator()<void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*), boost::_bi::list0>(boost::_bi::type<void>, void (*&)(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*), boost::_bi::list0&, int) /opt/Impala-Toolchain/boost-1.57.0/include/boost/bind/bind.hpp:457:9
    #13 0x166bd27 in boost::_bi::bind_t<void, void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*), boost::_bi::list4<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::Promise<long>*> > >::operator()() /opt/Impala-Toolchain/boost-1.57.0/include/boost/bind/bind_template.hpp:20:16
    #14 0x1c720b9 in thread_proxy (/home/tarmstrong/Impala/Impala/be/build/debug/service/impalad+0x1c720b9)
    #15 0x7f159032e6a9 in start_thread /build/glibc-ryFjv0/glibc-2.21/nptl/pthread_create.c:333
    #16 0x7f158d6cee9c in clone /build/glibc-ryFjv0/glibc-2.21/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

It looks like the args[] buffer in CodegenMaterializeExprs is 1 element too small.