On Wed, Apr 01, 2009 at 07:59:56PM +0000, Martin Kersten wrote:

Update of /cvsroot/monetdb/MonetDB5/src/modules/mal In directory 23jxhf1.ch3.sourceforge.com:/tmp/cvs-serv25709

Modified Files: mat.mx Log Message: Packing of BATs should avoid falling into the BATextend trap. Preclaim enough space. Don't bother about the properties of the result. That should be decided later.

This checking removes the only initialization of the pointer variable int *ret; which is then later dereferenced for assginment --- this might/will result in a segfault or other non-deterministic behavior. See details below. Stefan

U mat.mx Index: mat.mx =================================================================== RCS file: /cvsroot/monetdb/MonetDB5/src/modules/mal/mat.mx,v retrieving revision 1.25 retrieving revision 1.26 diff -u -d -r1.25 -r1.26 --- mat.mx 7 Jan 2009 14:15:13 -0000 1.25 +++ mat.mx 1 Apr 2009 19:59:50 -0000 1.26 @@ -134,22 +134,31 @@ The pack operation could be quite expensive, because it may create a really large BAT. For the experiments we materialize the BAT in the first -component. +component. It should be extended upfront to accomodate +all elements. @c str MATpackInternal(MalStkPtr stk, InstrPtr p,int first) { int i,*ret;

^^^^

BAT *b, *bn; + BUN cap=0;

bn= BATdescriptor(stk->stk[getArg(p,first)].val.ival); - if( bn == NULL) - throw(MAL, "mat.pack","Could access BAT"); - if (BAThrestricted(bn) || BATtrestricted(bn)) { + if (bn && (BAThrestricted(bn) || BATtrestricted(bn)) ){ b = BATcopy(bn, bn->htype, bn->ttype, TRUE); BBPunfix(bn->batCacheid); bn = b; } + if( bn == NULL) + throw(MAL, "mat.pack","Could not access BAT"); + + for(i=first; i<p->argc; i++){ + b= BATdescriptor(stk->stk[getArg(p,i)].val.ival); + cap += BATcount(b); + BBPunfix(b->batCacheid); + } + bn = BATextend(bn, cap); for(i=first+1; i<p->argc; i++){ b= BATdescriptor(stk->stk[getArg(p,i)].val.ival); if( b == NULL) @@ -158,12 +167,6 @@ BATins(bn,b,FALSE); BBPunfix(b->batCacheid); } - if (bn->htype == TYPE_oid && !BAThordered(bn)) { - BAT *b = BATsort(bn); - BBPunfix(bn->batCacheid); - bn = b; - } - ret= (int*) getArgReference(stk,p,0); ^ ^^^^ BBPkeepref(*ret = bn->batCacheid); ^^^^ return MAL_SUCCEED; }

------------------------------------------------------------------------------ _______________________________________________ Monetdb-checkins mailing list Monetdb-checkins@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/monetdb-checkins

-- | Dr. Stefan Manegold | mailto:Stefan.Manegold@cwi.nl | | CWI, P.O.Box 94079 | http://www.cwi.nl/~manegold/ | | 1090 GB Amsterdam | Tel.: +31 (20) 592-4212 | | The Netherlands | Fax : +31 (20) 592-4312 |