matrixorigin / matrixorigin/matrixone

[Bug]: COM_STMT_EXECUTE date-family decoding accepts or panics on truncated bodies

Open
#25,756 1 comment 0 reactions 1 assignee Claimed by @daviszhen View on GitHub
deferred kind/bug
Dominant language
Go
Stars
1.9k
Forks
311
Avg merge
1d 3h
Merged PRs (30d)
768

Description

## Is there an existing issue for the same bug?

- [x] I have checked the existing issues.

## Branch Name

`main`

## Commit ID

`e538e203ad47ebf0506a424fe93aed61290c4061`

## Actual Behavior

Binary-protocol `DATE`, `DATETIME`, and `TIMESTAMP` parameter decoding does not validate that the declared temporal body is present before indexing it.

`readDate`, `readDateTime`, and `readTimestamp` perform unchecked indexing and ignore failed integer reads. A white-box short-packet test supplies every body length from zero through declared-length minus one for `DATE(4)`, `DATETIME(7)`, and `TIMESTAMP(11)`. On latest `main`, malformed packets are either silently accepted with a nil error or panic with an index-out-of-range error.

The `TIME(8)`/`TIME(12)` bounds handling and `TIME(12)` position advancement originally included in this issue are already fixed on `main` by `5fe5e46fc9`. A valid `TIME(12)` followed by another parameter now decodes correctly. This issue is therefore narrowed to the date-family helpers.

## Expected Behavior

Any `DATE`, `DATETIME`, or `TIMESTAMP` body shorter than its declared binary-protocol length must return a malformed-packet error without panicking or consuming bytes outside that parameter.

## Steps to Reproduce

1. Prepare `select ?`.
2. Bind each of `DATE(4)`, `DATETIME(7)`, and `TIMESTAMP(11)`.
3. For each type, provide every body length from zero through declared-length minus one.
4. Assert parsing does not panic and returns an error.
5. On `main@e538e203a`, the test observes both nil errors and index-out-of-range panics.

## Relevant code

- `pkg/frontend/mysql_protocol.go:1021-1044`
- `pkg/frontend/mysql_protocol.go:1070-1076`
- `pkg/frontend/mysql_protocol.go:1122-1136`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.