cockroachdb / cockroachdb/cockroach
sql: incorrect int width when type checking UNION branches
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
**Describe the problem**
internal error: unexpected error from the vectorized engine: runtime error: slice bounds out of range [:10] with capacity 6
**To Reproduce**
```sql
create table t1 (c1 int4 primary key);
insert into t1 (c1) values (1), (2), (3), (4), (5), (-1), (-2), (0);
create table t2 (c1 int4);
insert into t2 (c1) values (1), (2), (3), (4), (5), (-1), (-2), (0);
select
subq_0.r1
from
(select distinct
ref_0.c1 as r0,
ref_0.c1 as r1
from
t1 as ref_0
where (ref_0.c1 in (
select -2054851195 where (1787135109 in (
-2054847099, -1, -2055633531, -2054847099))
union
(
select distinct -58905172 where (-2054847099 in (
-2054847099, -2054855803, -2083685755, -1141395583))
)))) as subq_0
where ((256 <> (
select subq_0.r0 as r2 from t2
union (select c1 from t2 )
order by r2 limit 1)))
group by subq_0.r1;
```
error log:
```
ERROR: internal error: unexpected error from the vectorized engine: runtime error: slice bounds out of range [:10] with capacity 6
DETAIL: stack trace:
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:78: func1()
GOROOT/src/runtime/panic.go:770: gopanic()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:291: InternalError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/colrpc/inbox.go:329: func1()
GOROOT/src/runtime/panic.go:770: gopanic()
GOROOT/src/runtime/panic.go:140: goPanicSliceAcap()
github.com/apache/arrow/go/arrow/array/external/com_github_apache_arrow_go_arrow/array/numeric.gen.go:79: setData()
github.com/apache/arrow/go/arrow/array/external/com_github_apache_arrow_go_arrow/array/numeric.gen.go:38: NewInt64Data()
github.com/cockroachdb/cockroach/pkg/col/colserde/arrowbatchconverter.go:532: ArrowToBatch()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecutils/deserializer.go:74: func1()
github.com/cockroachdb/cockroach/pkg/sql/colmem/allocator.go:448: PerformOperation()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecutils/deserializer.go:73: Deserialize()
github.com/cockroachdb/cockroach/pkg/sql/colflow/colrpc/inbox.go:409: Next()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:118: next()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:126: Next()
github.com/cockroachdb/cockroach/bazel-out/k8-opt/bin/pkg/sql/colexec/ordered_synchronizer.eg.go:119: Next()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:118: next()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:126: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/unordered_distinct.go:100: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecdisk/disk_spiller.go:202: func1()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colexec/colexecdisk/disk_spiller.go:200: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/limit.go:47: Next()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:118: next()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colflow/stats.go:126: Next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/materializer.go:251: next()
github.com/cockroachdb/cockroach/pkg/sql/colexec/materializer.go:276: nextAdapter()
github.com/cockroachdb/cockroach/pkg/sql/colexecerror/error.go:152: CatchVectorizedRuntimeError()
github.com/cockroachdb/cockroach/pkg/sql/colexec/materializer.go:282: Next()
```
**Environment:**
- CockroachDB version: 24.2.4
- Server OS: Ubuntu 22.04
- Client app: psql
docker compose file:
```yaml
x-service-defaults: &service_defaults
image: cockroachdb/cockroach:v24.2.4
services:
crdb1:
<<: *service_defaults
command: "start --advertise-addr=crdb1:26357 --http-addr=crdb1:8080 --listen-addr=crdb1:26357 --sql-addr=crdb1:26257 --insecure --join=crdb1:26357,crdb2:26357,crdb3:26357"
volumes:
- "crdb1_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.11
crdb2:
<<: *service_defaults
command: "start --advertise-addr=crdb2:26357 --http-addr=crdb2:8080 --listen-addr=crdb2:26357 --sql-addr=crdb2:26257 --insecure --join=crdb1:26357,crdb2:26357,crdb3:26357"
volumes:
- "crdb2_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.12
crdb3:
<<: *service_defaults
command: "start --advertise-addr=crdb3:26357 --http-addr=crdb3:8080 --listen-addr=crdb3:26357 --sql-addr=crdb3:26257 --insecure --join=crdb1:26357,crdb2:26357,crdb3:26357"
volumes:
- "crdb3_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.13
crdb_single:
<<: *service_defaults
command: start-single-node --insecure
volumes:
- "crdb_single_data:/cockroach/cockroach-data"
networks:
crnet:
ipv4_address: ${CR_SUBNET}.21
volumes:
crdb1_data:
crdb2_data:
crdb3_data:
crdb_single_data:
networks:
crnet:
driver: bridge
ipam:
config:
- subnet: ${CR_SUBNET:?please provide subnet range like `10.0.5`}.0/24
gateway: ${CR_SUBNET}.254
```
**about us**
We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the above-mentioned possible vulnerabilities that may lead to database internal error.
Jira issue: CRDB-44251
Contributor guide
Research direction
Reproduce the supplied SQL on CockroachDB v24.2.4 and start with the UNION type-checking path and the stack entries in pkg/col/colserde/arrowbatchconverter.go and pkg/sql/colexec/colexecutils/deserializer.go. Trace where the integer width becomes inconsistent before ArrowToBatch, then add regression coverage for the query and confirm it no longer produces the slice-bounds internal error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, sql
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100