cockroachdb / cockroachdb/cockroach

sql: incorrect int width when type checking UNION branches

Open
#134,798 4 comments 0 reactions 0 assignees View on GitHub
branch-master branch-release-22.1 branch-release-22.2 branch-release-23.1 branch-release-23.2 branch-release-24.1 branch-release-24.2 branch-release-24.3 C-bug O-community T-sql-queries X-blathers-triaged
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**
internal error: unexpected error from the vectorized engine: runtime error: slice bounds out of range [:10] with capacity 6

**To Reproduce**
```sql

create table t1 (c1 int4 primary key);
insert into t1 (c1) values (1), (2), (3), (4), (5), (-1), (-2), (0);
create table t2 (c1 int4);
insert into t2 (c1) values (1), (2), (3), (4), (5), (-1), (-2), (0);

select
subq_0.r1
from
(select distinct
ref_0.c1 as r0,
ref_0.c1 as r1
from
t1 as ref_0
where (ref_0.c1 in (
select -2054851195 where (1787135109 in (
-2054847099, -1, -2055633531, -2054847099))
union
(
select distinct -58905172 where (-2054847099 in (
-2054847099, -2054855803, -2083685755, -1141395583))
)))) as subq_0
where ((256 <> (
select subq_0.r0 as r2 from t2
union (select c1 from t2 )
order by r2 limit 1)))

group by subq_0.r1;
```

error log:
```
ERROR: internal error: unexpected error from the vectorized engine: runtime error: slice bounds out of range [:10] with capacity 6
DETAIL: stack trace:
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:78: func1()
GOROOT/src/runtime/panic.go:770: gopanic()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:291: InternalError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/colrpc/inbox.go:329: func1()
GOROOT/src/runtime/panic.go:770: gopanic()
GOROOT/src/runtime/panic.go:140: goPanicSliceAcap()
github.com/apache/arrow/go/arrow/array/external/com_github_apache_arrow_go_arrow/array/numeric.gen.go:79: setData()
github.com/apache/arrow/go/arrow/array/external/com_github_apache_arrow_go_arrow/array/numeric.gen.go:38: NewInt64Data()
github.com/cockroachdb/cockroach/pkg/col/colserde/arrowbatchconverter.go:532: ArrowToBatch()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecutils/deserializer.go:74: func1()
github.com/cockroachdb/cockroach/pkg/sql/colmem/allocator.go:448: PerformOperation()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecutils/deserializer.go:73: Deserialize()
github.com/cockroachdb/cockroach/pkg/sql/colflow/colrpc/inbox.go:409: Next()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:118: next()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:126: Next()
github.com/cockroachdb/cockroach/bazel-out/k8-opt/bin/pkg/sql/colexec/ordered_synchronizer.eg.go:119: Next()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:118: next()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:126: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/unordered_distinct.go:100: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecdisk/disk_spiller.go:202: func1()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecdisk/disk_spiller.go:200: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/limit.go:47: Next()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:118: next()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:126: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/materializer.go:251: next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/materializer.go:276: nextAdapter()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colexec/materializer.go:282: Next()
```
**Environment:**
- CockroachDB version: 24.2.4
- Server OS: Ubuntu 22.04
- Client app: psql

docker compose file:
```yaml
x-service-defaults: &service_defaults
image: cockroachdb/cockroach:v24.2.4

services:
crdb1:
<<: *service_defaults
command: "start --advertise-addr=crdb1:26357 --http-addr=crdb1:8080 --listen-addr=crdb1:26357 --sql-addr=crdb1:26257 --insecure --join=crdb1:26357,crdb2:26357,crdb3:26357"
volumes:
- "crdb1_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.11

crdb2:
<<: *service_defaults
command: "start --advertise-addr=crdb2:26357 --http-addr=crdb2:8080 --listen-addr=crdb2:26357 --sql-addr=crdb2:26257 --insecure --join=crdb1:26357,crdb2:26357,crdb3:26357"
volumes:
- "crdb2_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.12

crdb3:
<<: *service_defaults
command: "start --advertise-addr=crdb3:26357 --http-addr=crdb3:8080 --listen-addr=crdb3:26357 --sql-addr=crdb3:26257 --insecure --join=crdb1:26357,crdb2:26357,crdb3:26357"
volumes:
- "crdb3_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.13

crdb_single:
<<: *service_defaults
command: start-single-node --insecure
volumes:
- "crdb_single_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.21

volumes:
crdb1_data:
crdb2_data:
crdb3_data:
crdb_single_data:

networks:
crnet:
driver: bridge
ipam:
config:
- subnet: ${CR_SUBNET:?please provide subnet range like `10.0.5`}.0/24
gateway: ${CR_SUBNET}.254
```

**about us**
We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the above-mentioned possible vulnerabilities that may lead to database internal error.

Jira issue: CRDB-44251

Contributor guide

Open the contributing guide

Research direction

Reproduce the supplied SQL on CockroachDB v24.2.4 and start with the UNION type-checking path and the stack entries in pkg/col/colserde/arrowbatchconverter.go and pkg/sql/colexec/colexecutils/deserializer.go. Trace where the integer width becomes inconsistent before ArrowToBatch, then add regression coverage for the query and confirm it no longer produces the slice-bounds internal error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, sql
Domain
databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.