Skip to content

Commit

Permalink
[BugFix](JDBC Catalog) fix jdbc catalog query bitmap may cause be cor…
Browse files Browse the repository at this point in the history
…e sometimes (apache#26933)

BitmapValue::write_to will get a string with size 1 for empty BitmapValue, however the size 1 string will reinterpret to BitmapValue* back in ColumnComplexType::insert:
void insert(const Field& x) override {
const String& s = doris::vectorized::get<const String&>(x);
data.push_back(reinterpret_cast<const T>(s.c_str()));
}

in data.push_back will goto BitmapValue copy constructor, as the _type is not first member in BitmapValue, cause access to an unknown memory location.
  • Loading branch information
GoGoWen authored and seawinde committed Nov 15, 2023
1 parent 7e931f8 commit 5e2008c
Showing 1 changed file with 3 additions and 4 deletions.
7 changes: 3 additions & 4 deletions be/src/util/bitmap_value.h
Original file line number Diff line number Diff line change
Expand Up @@ -1259,10 +1259,9 @@ class BitmapValue {
}

static std::string empty_bitmap() {
static BitmapValue bitmap;
std::string buf;
buf.resize(bitmap.getSizeInBytes());
bitmap.write_to(buf.data());
std::string buf(sizeof(BitmapValue), 0);
BitmapValue* bitmap_value = reinterpret_cast<BitmapValue*>(buf.data());
bitmap_value->_type = EMPTY;
return buf;
}

Expand Down

0 comments on commit 5e2008c

Please sign in to comment.