Skip to content

Fix misc undefined behavior#313

Merged
serprex merged 1 commit into
mainfrom
misc-undefined
Jul 11, 2026
Merged

Fix misc undefined behavior#313
serprex merged 1 commit into
mainfrom
misc-undefined

Conversation

@serprex

@serprex serprex commented Jul 10, 2026

Copy link
Copy Markdown
Member
  1. kv_iter_next would access out of bounds with strlen when iter->togo == 1
  2. CollapsingMergeTree was didn't validate well with bad parenthesis
  3. CF_DATE_TRUNC/CF_DATE_PART didn't reject non-Const or null units
  4. binary_simple_query was accessing state->coltypes[j] potentially out of bounds if column counts mismatched
  5. volatile MemoryContext tempcxt needed for longjmp/setjmp semantics, added -Wclobbered to warn about this on gcc
  6. char_to_datum would skip out of bounds on inputs without prefix
  7. avoid calling convert_record / ch_binary_init_convert_state with NULL
  8. busy should also be initialized in get_connection_entry
  9. use typed curl_xferinfo_callback
  10. curl_easy_escape returns NULL on failure, handle failure
  11. DateTime64 scale bounded against lengthof(pow10i) for more hardening against malicious CH server
  12. Wsign-compare

@serprex serprex force-pushed the misc-undefined branch 5 times, most recently from 4d9b4e8 to 3f0b7d3 Compare July 10, 2026 18:41
@serprex serprex requested a review from theory July 10, 2026 18:44
@serprex serprex force-pushed the misc-undefined branch 2 times, most recently from 8dcb695 to b963735 Compare July 10, 2026 19:18
Comment thread test/expected/binary.out
Comment thread test/expected/result_map.txt
Comment thread test/expected/functions_0.out
Comment thread test/expected/result_map.txt Outdated
Comment thread src/include/kv_list.h Outdated
Comment thread src/custom_types.c Outdated
Comment thread src/pglink.c Outdated
1. kv_iter_next would access out of bounds with strlen when iter->togo == 1
2. CollapsingMergeTree was didn't validate well with bad parenthesis
3. CF_DATE_TRUNC/CF_DATE_PART didn't reject non-Const or null units
4. binary_simple_query was accessing state->coltypes[j] potentially out of bounds if column counts mismatched
5. volatile MemoryContext tempcxt needed for longjmp/setjmp semantics, added -Wclobbered to warn about this
6. char_to_datum would skip out of bounds on inputs without prefix
7. avoid calling convert_record / ch_binary_init_convert_state with NULL
8. `busy` should also be initialized in get_connection_entry
9. use typed curl_xferinfo_callback
10. curl_easy_escape returns NULL on failure, handle failure
11. DateTime64 scale bounded against lengthof(pow10i) for more hardening against malicious CH server
12. Wsign-compare
Comment thread test/expected/binary.out
v
---------
()
("(1)")

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That doesn't look right. Should be:

 ((1))

No?

@serprex serprex Jul 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no,

> select ROW(1),ROW(ROW(1));
 row |   row   
-----+---------
 (1) | ("(1)")

@serprex serprex merged commit b7c3ec5 into main Jul 11, 2026
23 checks passed
@serprex serprex deleted the misc-undefined branch July 11, 2026 02:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants