Skip to content

Undefined behavior in tidb_query_datatype's RowSlice #7613

@brson

Description

@brson

Bug Report

RowSlice does an unsafe pointer cast that is often unaligned. This is undefined behavior, which could potentially lead to miscompilation.

Here is the source:

let slice = unsafe { std::slice::from_raw_parts(buf.as_ptr() as *const T, len) };

The fix isn't simple, so I'm just filing a bug cc @breeswish.

Potential fixes are to accumulate the casted items into a new buffer instead of slicing the original buffer, but that costs an allocation. Another fix would be to change the serialization such that the cast always ends up aligned, while adding an assertion here that the alignment is correct.

Tested against commit adf3a94

Found with miri (cc @oli-obk 👍 ).

Metadata

Metadata

Assignees

Labels

type/bugThe issue is confirmed as a bug.

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions