apache / apache/carbondata

CSDK uses JNI local references beyond their valid lifetime

Open
#4,401 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Scala
Stars
1.5k
Forks
694
PR merge metrics
No merged PRs in 30d

Description

### Summary

The CSDK wrappers store JNI local references as members and leave several temporary references unreleased.

Affected code:

- https://github.com/apache/carbondata/blob/f86ac085ddbbd8381b0a5b65658731fe618eff4a/sdk/CSDK/src/CarbonSchemaReader.cpp
- https://github.com/apache/carbondata/blob/f86ac085ddbbd8381b0a5b65658731fe618eff4a/sdk/CSDK/src/Configuration.cpp

### Issues

- `FindClass` results are stored in `carbonSchemaReaderClass` and `configurationClass` without `NewGlobalRef`.
- `configurationObject` is also stored as a member local reference.
- Temporary strings created by `NewStringUTF` in `readSchema`, `set`, and `get` are not released.
- `Configuration::get` returns data from `GetStringUTFChars` without calling `ReleaseStringUTFChars`.

### Impact

If these C++ objects survive beyond the current JNI frame, their member references become invalid. Repeated calls on a long-lived attached thread may also accumulate local references and native string buffers, potentially causing failures or crashes.

### Suggested fix

- Convert persistent member references with `NewGlobalRef` and release them with `DeleteGlobalRef` in destructors.
- Define safe copy/move ownership semantics for these wrappers.
- Delete temporary local references after JNI calls.
- Copy the value returned by `GetStringUTFChars` into owned memory, then call `ReleaseStringUTFChars` before returning.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with sdk/CSDK/src/CarbonSchemaReader.cpp and sdk/CSDK/src/Configuration.cpp, tracing how JNI references and strings are created, stored, and destroyed. Check constructors, destructors, readSchema, set, and get; done means persistent references have valid ownership, temporary references are released, and returned string data is copied before JNI buffers are released.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.