bjchambers opened a new issue, #23773:
URL: https://github.com/apache/datafusion/issues/23773
**Describe the bug**
`array_any_value` reads the wrong value, or panics the query, when its input
list
column contains a non-null **empty** (length-0) list element.
`general_array_any_value` (in `datafusion/functions-nested/src/extract.rs`)
guards
null and all-null elements, but a non-null empty element falls through to the
no-nulls branch, which unconditionally reads `values[start]`:
- **interior empty list** → reads `values[start]`, i.e. the *next* element's
value (silently wrong data)
- **trailing empty list** (`start == values.len()`) → out-of-bounds slice →
panic `range end index N out of range for slice of length N-1`
The panic is easy to hit when the `array_any_value` output flows into a hash
`RepartitionExec` (e.g. the value is used as an equi-join key):
repartitioning
slices batches so an empty element can land at the end of a values buffer,
tripping the out-of-bounds read on a spawned task.
**To Reproduce**
```sql
create table t (id int, tags bigint[]) as values
(1, make_array(10)),
(2, cast(make_array() as bigint[])), -- interior empty -> wrongly
returns 20
(3, make_array(20, 30)),
(4, cast(make_array() as bigint[])); -- trailing empty -> out-of-bounds
panic
select id, array_any_value(tags) from t order by id;
```
**Expected behavior**
An empty list has no value to take, so `array_any_value` should return
`NULL`:
```
1 10
2 NULL
3 20
4 NULL
```
**Additional context**
Sibling functions in `extract.rs` are already safe (`array_element`
bounds-checks
the index; `array_slice` / `array_pop_front` / `array_pop_back` guard `len
== 0`).
Fix incoming.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
