apache / datafusion

Apache DataFusion SQL Query Engine
https://datafusion.apache.org/
Apache License 2.0
5.5k stars 1.02k forks source link

Overflow bug in POW scalar function (found by SQLancer) #11075

Closed 2010YOUY01 closed 1 week ago

2010YOUY01 commented 1 week ago

Describe the bug

The following statement should return an error instead of directly crash

DataFusion CLI v39.0.0
> select pow(2107754225, 1221660777);
thread 'main' panicked at /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/num/mod.rs:358:5:
attempt to multiply with overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Found by SQLancer https://github.com/apache/datafusion/issues/11030

To Reproduce

No response

Expected behavior

No response

Additional context

No response

LorrensP-2158466 commented 1 week ago

take

LorrensP-2158466 commented 1 week ago

this is the third, scalar function that panics instead of returning an error, maybe it's a good idea to open up a separate tracking issue to find all of these cases? For example GCD and LCM #11057

2010YOUY01 commented 1 week ago

this is the third, scalar function that panics instead of returning an error, maybe it's a good idea to open up a separate tracking issue to find all of these cases? For example GCD and LCM #11057

I think it's a great idea. Those bugs are all very likely only related to function implementation body, and don't require modifying execution core code to fix, we can open a tracking issue for all function-local bugs(and also label "good first issue" if someone wants to help)

Now only just a few types/functions has been fuzzed, I'm expecting more function-local bugs to appear.

Also thank you so much for fixing them @LorrensP-2158466 👍🏼

LorrensP-2158466 commented 1 week ago

Now that only just a few types/functions have been fuzzed, I'm expecting more function-local bugs to appear.

That's right, fixing GCD & LCM was very local, only to the actual implementation of the algorithm, the API already allowed to return error's. I expect that will also be the case for the others.

and also label "good first issue" if someone wants to help

I agree

Thanks! You have made a very cool tool, because I would have never thought about this, and I think a lot of other neither.