(doris) branch master updated: [fix](memory) Fix make_top_consumption_snapshots heap-use-after-free #27434

[yiguolei]

This is an automated email from the ASF dual-hosted git repository.

yiguolei pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git


The following commit(s) were added to refs/heads/master by this push:
     new 4fc638c98c9 [fix](memory) Fix make_top_consumption_snapshots 
heap-use-after-free #27434
4fc638c98c9 is described below

commit 4fc638c98c9e0c7d4e5578fdf9485fbca5c7a32f
Author: Xinyi Zou <zouxiny...@gmail.com>
AuthorDate: Thu Nov 23 13:59:53 2023 +0800

    [fix](memory) Fix make_top_consumption_snapshots heap-use-after-free #27434
---
 be/src/runtime/memory/mem_tracker.h           | 6 ++++--
 be/src/runtime/memory/mem_tracker_limiter.cpp | 9 ++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/be/src/runtime/memory/mem_tracker.h 
b/be/src/runtime/memory/mem_tracker.h
index 8af83d299f9..3257ddd0ebe 100644
--- a/be/src/runtime/memory/mem_tracker.h
+++ b/be/src/runtime/memory/mem_tracker.h
@@ -47,12 +47,14 @@ class MemTrackerLimiter;
 class MemTracker {
 public:
     struct Snapshot {
-        std::string type = "";
+        std::string type;
         std::string label;
-        std::string parent_label = "";
+        std::string parent_label;
         int64_t limit = 0;
         int64_t cur_consumption = 0;
         int64_t peak_consumption = 0;
+
+        bool operator<(const Snapshot& rhs) const { return cur_consumption < 
rhs.cur_consumption; }
     };
 
     struct TrackerGroup {
diff --git a/be/src/runtime/memory/mem_tracker_limiter.cpp 
b/be/src/runtime/memory/mem_tracker_limiter.cpp
index ad90df81145..60ad66bfbdd 100644
--- a/be/src/runtime/memory/mem_tracker_limiter.cpp
+++ b/be/src/runtime/memory/mem_tracker_limiter.cpp
@@ -202,18 +202,17 @@ void 
MemTrackerLimiter::make_type_snapshots(std::vector<MemTracker::Snapshot>* s
 
 void 
MemTrackerLimiter::make_top_consumption_snapshots(std::vector<MemTracker::Snapshot>*
 snapshots,
                                                        int top_num) {
-    std::priority_queue<std::pair<int64_t, MemTrackerLimiter*>> max_pq;
+    std::priority_queue<MemTracker::Snapshot> max_pq;
     // not include global type.
     for (unsigned i = 1; i < mem_tracker_limiter_pool.size(); ++i) {
         std::lock_guard<std::mutex> l(mem_tracker_limiter_pool[i].group_lock);
-        for (auto tracker : mem_tracker_limiter_pool[i].trackers) {
-            max_pq.emplace(tracker->consumption(), tracker);
+        for (auto* tracker : mem_tracker_limiter_pool[i].trackers) {
+            max_pq.emplace(tracker->make_snapshot());
         }
     }
 
     while (!max_pq.empty() && top_num > 0) {
-        auto tracker = max_pq.top().second;
-        (*snapshots).emplace_back(tracker->make_snapshot());
+        (*snapshots).emplace_back(max_pq.top());
         top_num--;
         max_pq.pop();
     }


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For additional commands, e-mail: commits-h...@doris.apache.org