apache / apache/doris

[Bug] BE SEGV in OrcReader::_seek_to_read_one_line when _row_reader is nullptr

Open Beginner friendly
#63,921 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
15.9k
Forks
3.9k
Avg merge
2d 21h
Merged PRs (30d)
531

Description

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues.

### Version

master (trunk)

### What's Wrong?

When running `OrcReadLinesTest.test0` BE unit test with ASAN build on x86, AddressSanitizer reports a SEGV crash due to null pointer dereference of `_row_reader` in `OrcReader::_seek_to_read_one_line()`.

**ASAN crash stack:**
```
==XX==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x555558b3c2e0 bp 0x7ffff3c8e400 sp 0x7ffff3c8e3a0 T2)
==XX==The signal is caused by a READ memory access.
#0 0x555558b3c2e0 in orc::RowReaderImpl::seekToRow(unsigned long) be/src/formats/orc/../../thirdparty/installed/include/orc/Reader.hh
#1 0x5555590a3b5c in doris::vectorized::OrcReader::_seek_to_read_one_line() be/src/format/orc/vorc_reader.h:710
#2 0x5555590a3b5c in doris::vectorized::OrcReader::_get_next_block_impl(doris::vectorized::Block*, unsigned long*, bool*) be/src/format/orc/vorc_reader.cpp:2350
#3 0x555558f5c5a0 in doris::vectorized::OrcReader::get_next_block(doris::vectorized::Block*, unsigned long*, bool*) be/src/format/orc/vorc_reader.cpp:2260
#4 0x555558f5c5a0 in doris::vectorized::GenericReader::read_by_rows(doris::RuntimeState*, doris::vectorized::Block*, unsigned long*, bool*) be/src/format/generic_reader.h:165
...
```

**Root cause:**

In `OrcReader::_init_orc_row_reader()`, when `createRowReader` throws an exception and `should_stop` is true with error message "stop", the catch block swallows the exception and returns `Status::OK()`, but `_row_reader` remains nullptr. The caller then proceeds to call `_seek_to_read_one_line()` which dereferences the null `_row_reader` via `_row_reader->seekToRow()`, causing SEGV.

This is inconsistent with `_create_file_reader()` which returns `Status::EndOfFile("stop")` in the same `should_stop` scenario.

### What You Expected?

No SEGV crash. When `_row_reader` is not initialized, the code should either return a proper error status or assert the precondition, not silently continue and dereference a null pointer.

### How to Reproduce?

1. Build BE with ASAN: `BUILD_TYPE=ASAN ./build.sh --be`
2. Run: `./run-be-ut.sh --run --filter=OrcReadLinesTest.test0`
3. Observe ASAN SEGV crash

### Anything Else?

The x86 vs ARM difference is a typical undefined behavior manifestation - x86 null pointer dereference hits unmapped memory (SIGSEGV), while ARM may happen to access mapped memory and appear to pass.

### Are you willing to submit PR?

- [x] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

Contributor guide

Open the contributing guide

Research direction

Start with be/src/formats/orc/vorc_reader.h at OrcReader::_seek_to_read_one_line() and be/src/formats/orc/vorc_reader.cpp around _get_next_block_impl(), then inspect _init_orc_row_reader() and _create_file_reader() for their stop handling. Run the ASAN build and ./run-be-ut.sh --run --filter=OrcReadLinesTest.test0; done means the test no longer reports a null-pointer SEGV when the row reader is not initialized.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
databases
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.