[IMPALA-8846] Undefined behaviour in RleEncoder::Put

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Epic Color: ghx-label-3
• Assignee: Daniel Becker
• Reporter: Daniel Becker
• Created: 08/Aug/19 16:31
• Updated: 13/Nov/19 03:40
• Resolved: 21/Aug/19 08:31

Description

On line https://github.com/apache/impala/blob/4000da35be69e469500f5f11e0e5fdec119cf5c7/be/src/util/rle-encoding.h#L346, we test repeat_count_ <= std::numeric_limits<int32_t>::max(), which is always true (repeat_count_ is an int), then we increment repeat_count which could be std::numeric_limits<int32_t>::max() and overflow, which is undefined behaviour for signed integers.

 

We should either change <= to < or if we think that this never happens, remove the misleading check.

If we correct the check, it may lead to some (probably small) performance regression because the compiler could have optimised this out.

Issue Links

• is a child of: IMPALA-5031 UBSAN clean and method for testing UBSAN cleanliness