Skip to content

[Bug] use-after-free in readRegons found by ASAN #147

@fzhedu

Description

@fzhedu

Component Selection

  • Core Engine (Expression eval, Memory, Vector)
  • Connectors / File Formats (Hive, Parquet, etc.)
  • API / Bindings (Python, etc.)
  • Build
  • Other

Describe the Bug

==13==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d0006adde0 
READ of size 8 at 0x61d0006adde0 thread T290 (AsyncLoadThr64)
    #0 0x7f7dda1c3ec1 in bytedance::bolt::dwio::common::DirectBufferedInput::readRegions(...)
    #1 0x7f7dda1c8556 in bytedance::bolt::dwio::common::DirectBufferedInput::load(...)
    #2 0x7f7dc0b22f25 in bytedance::bolt::parquet::StructColumnReader::loadRowGroup(...)
    #3 0x7f7dc08cccbf in bytedance::bolt::parquet::ReaderBase::scheduleRowGroups(...)
    #4 0x7f7ddc4fe812 in bytedance::bolt::exec::TableScan::preload(...)
    #5 0x7f7ddc5265b9 in bytedance::bolt::AsyncSource<bytedance::bolt::connector::DataSource>::prepare()
    #6 0x7f7db7619b62 in folly::ThreadPoolExecutor::runTask(...)
    #7 0x7f7f6fb3f608 in start_thread 

0x61d0006adde0 is located 1888 bytes inside of 1952-byte region [0x61d0006ad680,0x61d0006ade20)
freed by thread T65 (Executor task l) here:
    #0 0x7f7f6fdf3bbf in operator delete(void*, unsigned long)
    #1 0x7f7ddc523008 in bytedance::bolt::exec::TableScan::~TableScan()
    #2 0x7f7ddc0d8881 in std::_Sp_counted_ptr<bytedance::bolt::exec::Driver*, ...>::_M_dispose()
    #3 0x7f7ddbcf87a7 in bytedance::bolt::exec::Driver::next(...)

Reproduction Steps

unstable

Bolt Version / Commit ID

main

System Configuration

- **OS**: (e.g. Ubuntu 22.04, CentOS 7)
- **Compiler**: (e.g. GCC 11, Clang 14)
- **Build Type**: (Debug / Release / RelWithDebInfo)
- **CPU Arch**: (e.g. x86_64 AVX2, ARM64)
- **Framework**: (e.g. Spark 3.3, PrestoDB)
ubuntu x86

Logs / Stack Trace

Expected Behavior

No response

Additional context

No response

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingciPipeline & resource management for continuous integrationneeds triage

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions