runtime error: slice bounds out of range [:33] with capacity 32 in `expression.(*builtinRpadUTF8Sig).vecEvalString`
- Dominant language
- Go
- Stars
- 40.5k
- Forks
- 6.2k
- PR merge metrics
- PR metrics pending
Description
## Bug Report
Please answer these questions before submitting your issue. Thanks!
### 1. Minimal reproduce step (Required)
```sql
create table t_u6z6v6m3u (
c_ytzsa int ,
c_zllrsddn96 text ,
c_gvxf double ,
c_g91_kal4n double unique ,
primary key(c_ytzsa) CLUSTERED) pre_split_regions=2;
insert into t_u6z6v6m3u (c_ytzsa, c_zllrsddn96, c_gvxf, c_g91_kal4n) values
(666539487, 'w5qtrc', 85.90, 32768.9),
(1408667566, 'a6d0', 71.4, 15.89),
(-1680147087, 'yit7oneb5', 65535.7, 257.3),
(1211374988, 'e64', 92.46, 11.76);
SELECT
rpad(
cast(ref_0.c_zllrsddn96 as char),
33,
cast(unhex(
cast(case when (NOT NOT(cast( (cast(null as char) >= 'g7ru0xq_') as unsigned))) then ref_0.c_zllrsddn96 else ref_0.c_zllrsddn96 end
as char)) as char)) as c4
FROM
t_u6z6v6m3u as ref_0;
```
### 2. What did you expect to see? (Required)
Expect no crashes
### 3. What did you see instead (Required)
```
runtime error: slice bounds out of range [:33] with capacity 32
github.com/pingcap/errors.AddStack
/root/go/pkg/mod/github.com/pingcap/errors@v0.11.5-0.20240318064555-6bd07397691f/errors.go:178
github.com/pingcap/errors.Trace
/root/go/pkg/mod/github.com/pingcap/errors@v0.11.5-0.20240318064555-6bd07397691f/juju_adaptor.go:15
github.com/pingcap/tidb/pkg/util.GetRecoverError
/workspace/source/tidb/pkg/util/util.go:304
github.com/pingcap/tidb/pkg/executor.recoveryProjection
/workspace/source/tidb/pkg/executor/projection.go:466
github.com/pingcap/tidb/pkg/executor.(*projectionWorker).run.func1
/workspace/source/tidb/pkg/executor/projection.go:435
runtime.gopanic
/usr/local/go/src/runtime/panic.go:914
runtime.goPanicSliceAcap
/usr/local/go/src/runtime/panic.go:140
github.com/pingcap/tidb/pkg/expression.(*builtinRpadUTF8Sig).vecEvalString
/workspace/source/tidb/pkg/expression/builtin_string_vec.go:2630
github.com/pingcap/tidb/pkg/expression.(*ScalarFunction).VecEvalString
/workspace/source/tidb/pkg/expression/scalar_function.go:72
github.com/pingcap/tidb/pkg/expression.evalOneVec
/workspace/source/tidb/pkg/expression/chunk_executor.go:172
github.com/pingcap/tidb/pkg/expression.(*defaultEvaluator).run
/workspace/source/tidb/pkg/expression/evaluator.go:52
github.com/pingcap/tidb/pkg/expression.(*EvaluatorSuite).Run
/workspace/source/tidb/pkg/expression/evaluator.go:124
github.com/pingcap/tidb/pkg/executor.(*projectionWorker).run
/workspace/source/tidb/pkg/executor/projection.go:451
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:1650
```
### 4. What is your TiDB version? (Required)
```
Release Version: v8.1.0
Edition: Community
Git Commit Hash: 945d07c5d5c7a1ae212f6013adfb187f2de24b23
Git Branch: HEAD
UTC Build Time: 2024-05-21 03:51:57
GoVersion: go1.21.10
Race Enabled: false
Check Table Before Drop: false
Store: tikv
```
We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the above-mentioned vulnerabilities in TiDB that may lead to database crashes.
Contributor guide
Assessment
This issue has not been assessed yet.