[Bug](bitmap) Fix heap-use-after-free in the bitmap functions apache#…

…27411 (apache#27521)
morningman · Nov 24, 2023 · 0479de4 · 0479de4
1 parent 1c0adc1
commit 0479de4
Show file tree

Hide file tree

Showing 3 changed files with 647 additions and 2 deletions.
diff --git a/be/src/util/bitmap_value.h b/be/src/util/bitmap_value.h
@@ -2172,7 +2172,7 @@ class BitmapValue {
 
     // Return how many bytes are required to serialize this bitmap.
     // See BitmapTypeCode for the serialized format.
-    size_t getSizeInBytes() const {
+    size_t getSizeInBytes() {
         size_t res = 0;
         switch (_type) {
         case EMPTY:
@@ -2186,6 +2186,7 @@ class BitmapValue {
             }
             break;
         case BITMAP:
+            _prepare_bitmap_for_write();
             _bitmap->runOptimize();
             _bitmap->shrinkToFit();
             res = _bitmap->getSizeInBytes(config::bitmap_serialize_version);

diff --git a/be/src/vec/data_types/data_type_bitmap.cpp b/be/src/vec/data_types/data_type_bitmap.cpp
@@ -114,7 +114,8 @@ void DataTypeBitMap::to_string(const IColumn& column, size_t row_num, BufferWrit
     ColumnPtr ptr = result.first;
     row_num = result.second;
 
-    const auto& data = assert_cast<const ColumnBitmap&>(*ptr).get_element(row_num);
+    auto& data =
+            const_cast<BitmapValue&>(assert_cast<const ColumnBitmap&>(*ptr).get_element(row_num));
     std::string buffer(data.getSizeInBytes(), '0');
     data.write_to(const_cast<char*>(buffer.data()));
     ostr.write(buffer.c_str(), buffer.size());