impala-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Internal Jenkins (Code Review)" <>
Subject [Impala-ASF-CR] IMPALA-4377: Fix Java UDF-arg buffer use-after-free in UdfExecutorTest.
Date Sun, 30 Oct 2016 01:23:11 GMT
Internal Jenkins has submitted this change and it was merged.

Change subject: IMPALA-4377: Fix Java UDF-arg buffer use-after-free in UdfExecutorTest.

IMPALA-4377: Fix Java UDF-arg buffer use-after-free in UdfExecutorTest.

The bug is simplest to explain with the old buggy test code below.
I added comments in the code to explain the bug.

// We used this for creating Text UDF arguments before invoking a UDF.
Writable createText(String v) {
  // Note that 'w' does not own the native buffer backing the string,
  // explained below.
  ImpalaTextWritable w = new ImpalaTextWritable(createStringValue(v));
  return w;

long createStringValue(String v) {
  byte[] array = v.getBytes();
  long ptr = allocate(16);
  UnsafeUtil.UNSAFE.putInt(ptr + 8, 0);
  ImpalaStringWritable sw = new ImpalaStringWritable(ptr);
  // This allocates a new native buffer and sets it as a member
  // of 'sw'. The native buffer is freed in sw.finalize().
  // However, after this function there are no more references
  // to 'sw', so the GC is allowed to free it. When that happens
  // the UDF argument's native memory is gone and we get garbage
  // UDF evaluations.
  sw.set(array, 0, array.length);
  return ptr;

This change also includes logging improvements to make similar
issues easier to diagnose in the future.

Testing: The bug was easy to reproduce by increasing the number
of runs in TestUdfImpl() to a large number. After this patch
I could not reproduce the issue anymore.

Change-Id: Id94130715e4f342e4dd2f6cd137ac1eb7b1ecf2d
Reviewed-by: Matthew Jacobs <>
Tested-by: Internal Jenkins
M fe/src/test/java/org/apache/impala/hive/executor/
1 file changed, 119 insertions(+), 71 deletions(-)

  Matthew Jacobs: Looks good to me, approved
  Internal Jenkins: Verified

To view, visit
To unsubscribe, visit

Gerrit-MessageType: merged
Gerrit-Change-Id: Id94130715e4f342e4dd2f6cd137ac1eb7b1ecf2d
Gerrit-PatchSet: 3
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-Owner: Alex Behm <>
Gerrit-Reviewer: Internal Jenkins
Gerrit-Reviewer: Matthew Jacobs <>

View raw message