[IMPALA-5774] StringFunctions::FindInSet() may read one byte beyond a string's extent

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 2.10.0
• Fix Version/s: Impala 2.10.0
• Component/s: Backend
• Epic Color: ghx-label-4
• Assignee: Henry Robinson
• Reporter: Henry Robinson
• Created: 07/Aug/17 19:22
• Updated: 08/Aug/17 22:18
• Resolved: 08/Aug/17 22:18

Description

The following may read str_set.ptr[str_set.len] if no ',' is found.

while(str_set.ptr[end] != ',' && end < str_set.len) ++end;

(This was discovered by poisoning mempool data from IMPALA-5666).