DATE_FORMAT vector path length overflow causes wrong results and observer crash

Self Checks

• I have read the Contributing Guide.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

OceanBase version

5.7.25-OceanBase_CE-v4.6.0.0

Self Hosted

Self Hosted (Other)

Environment

ubuntu22.04

Steps to reproduce

CREATE DATABASE IF NOT EXISTS repro;
USE repro;

CREATE TABLE t(d DATE);
INSERT INTO t VALUES ('2020-01-01');
A. Wrong result from int16_t length wrap
SELECT LENGTH(DATE_FORMAT(d, REPEAT('%Y', 8192))) FROM t;

Expected MySQL 8.4 result:

32768

Observed OceanBase result:

-32768
B. Scalar/vector inconsistency at 1028-byte output
SELECT LENGTH(DATE_FORMAT('2020-01-01', REPEAT('%Y', 257)));

Expected MySQL 8.4 result:

1028

Observed OceanBase scalar result:

ERROR 4019 (HY000): Size overflow

However, the equivalent column-driven expression succeeds in the vector path:

SELECT LENGTH(DATE_FORMAT(d, REPEAT('%Y', 257))) FROM t;

Observed OceanBase vector result:

1028
C. Observer crash / DoS

Run only on a disposable instance, because the observer must be restarted afterward.

SELECT LENGTH(DATE_FORMAT(d, REPEAT('%Y', 16383))) FROM t;

Observed result:

Lost connection to MySQL server during query

The observer process dies. The same class of crash is also reproducible with:

SELECT LENGTH(DATE_FORMAT(d, REPEAT('%Y', 16384))) FROM t;
SELECT LENGTH(DATE_FORMAT(d, REPEAT('%H', 32768))) FROM t;

✔️ Expected Behavior

Expected behavior

DATE_FORMAT() should follow the same overflow and result-type policy as MySQL-compatible behavior and as the already-fixed TIME_FORMAT() implementation:

return correct positive lengths for valid outputs;
reject oversized outputs consistently across scalar and vector execution;
never return wrapped negative lengths;
never crash the observer.

❌ Actual Behavior

Case	MySQL 8.4	OceanBase scalar	OceanBase vector
257 × %Y / 1028 B	1028	ERROR 4019	1028
8192 × %Y / 32768 B	32768	—	-32768
16300 × %Y / 65200 B	65200	—	negative result
16383 × %Y / 65532 B	65532	—	observer crash
16384 × %Y / 65536 B	65536	ERROR 4019	observer crash
DATE + 32768 × %H / ~65536 B	65536	ERROR 4019	observer crash
TIME + 32767 × %H / 65534 B	65534	—	ERROR 4019, no crash

Start by comparing the DATE_FORMAT scalar and vector execution paths with the already-fixed TIME_FORMAT implementation, using the reproduction queries to trace the differing length and overflow behavior. Done means valid outputs have correct positive lengths, oversized results are rejected consistently, and none of the listed queries crashes the observer.