[IMPALA-5252] Java UDF returning string can lead to crash under memory pressure.

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Impala 2.8.0
• Fix Version/s: Impala 2.9.0
• Component/s: Backend
• Labels: crash
• Target Version: Impala 2.9.0
• Epic Color: ghx-label-7
• Assignee: Daniel Hecht
• Reporter: Alexander Behm
• Created: 24/Apr/17 20:25
• Updated: 06/Jul/17 21:27
• Resolved: 02/May/17 18:17

Description

Look at this code from hive-udf-call.cc HiveUdfCall::GetStringVal():

StringVal HiveUdfCall::GetStringVal(ExprContext* ctx, const TupleRow* row) {
  DCHECK_EQ(type_.type, TYPE_STRING);
  StringVal result = *reinterpret_cast<StringVal*>(Evaluate(ctx, row));

  // Copy the string into a local allocation with the usual lifetime for expr results.
  // Needed because the UDF output buffer is owned by the Java UDF executor and may be
  // freed or reused by the next call into the Java UDF executor.
  FunctionContext* fn_ctx = ctx->fn_context(fn_context_index_);
  uint8_t* local_alloc = fn_ctx->impl()->AllocateLocal(result.len);
  memcpy(local_alloc, result.ptr, result.len); <--- crash when local_alloc is nullptr
  result.ptr = local_alloc;
  return result;
}

Issue Links

• breaks: IMPALA-5580 Java UDF: return null STRING incorrectly converted to empty string
• is broken by: IMPALA-4266 Java udf expression returning string in group by can give incorrect results.