This is an automated email from the ASF dual-hosted git repository.

eldenmoon pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git


The following commit(s) were added to refs/heads/master by this push:
     new 6f063bc86da [fix](variant) fix potential use after free (#46056)
6f063bc86da is described below

commit 6f063bc86da6025c11fb66fb2c7bf6988697f35d
Author: lihangyu <lihan...@selectdb.com>
AuthorDate: Fri Dec 27 19:11:33 2024 +0800

    [fix](variant) fix potential use after free (#46056)
---
 be/src/vec/exprs/table_function/vexplode.cpp | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/be/src/vec/exprs/table_function/vexplode.cpp 
b/be/src/vec/exprs/table_function/vexplode.cpp
index 5fa378f6351..6f1db0ac1a9 100644
--- a/be/src/vec/exprs/table_function/vexplode.cpp
+++ b/be/src/vec/exprs/table_function/vexplode.cpp
@@ -44,27 +44,26 @@ VExplodeTableFunction::VExplodeTableFunction() {
 
 Status VExplodeTableFunction::_process_init_variant(Block* block, int 
value_column_idx) {
     // explode variant array
-    const auto& variant_column = check_and_get_column<ColumnObject>(
-            remove_nullable(block->get_by_position(value_column_idx)
-                                    .column->convert_to_full_column_if_const())
-                    .get());
+    auto column_without_nullable = 
remove_nullable(block->get_by_position(value_column_idx).column);
+    auto column = column_without_nullable->convert_to_full_column_if_const();
+    const auto& variant_column = assert_cast<const ColumnObject&>(*column);
     _detail.output_as_variant = true;
-    if (!variant_column->is_null_root()) {
-        _array_column = variant_column->get_root();
+    if (!variant_column.is_null_root()) {
+        _array_column = variant_column.get_root();
         // We need to wrap the output nested column within a variant column.
         // Otherwise the type is missmatched
         const auto* array_type = check_and_get_data_type<DataTypeArray>(
-                remove_nullable(variant_column->get_root_type()).get());
+                remove_nullable(variant_column.get_root_type()).get());
         if (array_type == nullptr) {
             return Status::NotSupported("explode not support none array type 
{}",
-                                        
variant_column->get_root_type()->get_name());
+                                        
variant_column.get_root_type()->get_name());
         }
         _detail.nested_type = array_type->get_nested_type();
     } else {
         // null root, use nothing type
         _array_column = 
ColumnNullable::create(ColumnArray::create(ColumnNothing::create(0)),
                                                ColumnUInt8::create(0));
-        
_array_column->assume_mutable()->insert_many_defaults(variant_column->size());
+        
_array_column->assume_mutable()->insert_many_defaults(variant_column.size());
         _detail.nested_type = std::make_shared<DataTypeNothing>();
     }
     return Status::OK();


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org
For additional commands, e-mail: commits-h...@doris.apache.org

Reply via email to