Clickhouse: Segfault when using Delta codec

Created on 26 Jun 2019 · 5Comments · Source: ClickHouse/ClickHouse

_Tested on CH 19.9.2.4_

I've got a table which gets some data: one insert every 5 seconds, the size of insert - 10k-100k rows.

The structure is the following:

CREATE TABLE graphite_index (
  Date Date CODEC(Delta, LZ4),
  Level UInt32,
  Path String,
  Version UInt32
) ENGINE = ReplacingMergeTree(Version)
PARTITION BY toYYYYMM(Date)
ORDER BY (Level, Path, Date);

After a short period of time after I start to ingest it dies with one of the following:

2019.06.26 14:43:03.637851 [ 73 ] {} <Error> BaseDaemon: ########################################
2019.06.26 14:43:03.637915 [ 73 ] {} <Error> BaseDaemon: (version 19.9.2.4) (from thread 53) Received signal Segmentation fault (11).
2019.06.26 14:43:03.637952 [ 73 ] {} <Error> BaseDaemon: Address: 0x58
2019.06.26 14:43:03.637975 [ 73 ] {} <Error> BaseDaemon: Access: read.
2019.06.26 14:43:03.637998 [ 73 ] {} <Error> BaseDaemon: Address not mapped to object.
2019.06.26 14:43:03.657925 [ 73 ] {} <Error> BaseDaemon: 0. clickhouse-server(DB::IBlockInputStream::cancel(bool)+0x69) [0x597b4a9]
2019.06.26 14:43:03.658037 [ 73 ] {} <Error> BaseDaemon: 1. clickhouse-server(DB::IBlockInputStream::read()+0x4dc) [0x597e23c]
2019.06.26 14:43:03.658097 [ 73 ] {} <Error> BaseDaemon: 2. clickhouse-server(DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::atomic<bool>*)+0x46) [0x599bbc6]
2019.06.26 14:43:03.658194 [ 73 ] {} <Error> BaseDaemon: 3. clickhouse-server(DB::executeQuery(DB::ReadBuffer&, DB::WriteBuffer&, bool, DB::Context&, std::function<void (std::string const&)>, std::function<void (std::string const&)>)+0x58b) [0x5ba3c2b]
2019.06.26 14:43:03.658275 [ 73 ] {} <Error> BaseDaemon: 4. clickhouse-server(DB::HTTPHandler::processQuery(Poco::Net::HTTPServerRequest&, HTMLForm&, Poco::Net::HTTPServerResponse&, DB::HTTPHandler::Output&)+0x15d4) [0x31f3d14]
2019.06.26 14:43:03.658339 [ 73 ] {} <Error> BaseDaemon: 5. clickhouse-server(DB::HTTPHandler::handleRequest(Poco::Net::HTTPServerRequest&, Poco::Net::HTTPServerResponse&)+0x458) [0x31f6ab8]
2019.06.26 14:43:03.658400 [ 73 ] {} <Error> BaseDaemon: 6. clickhouse-server(Poco::Net::HTTPServerConnection::run()+0x2a9) [0x6663259]
2019.06.26 14:43:03.658474 [ 73 ] {} <Error> BaseDaemon: 7. clickhouse-server(Poco::Net::TCPServerConnection::start()+0xf) [0x665e22f]
2019.06.26 14:43:03.658537 [ 73 ] {} <Error> BaseDaemon: 8. clickhouse-server(Poco::Net::TCPServerDispatcher::run()+0xe5) [0x665e915]
2019.06.26 14:43:03.658611 [ 73 ] {} <Error> BaseDaemon: 9. clickhouse-server(Poco::PooledThread::run()+0x81) [0x677fe71]
2019.06.26 14:43:03.658685 [ 73 ] {} <Error> BaseDaemon: 10. clickhouse-server(Poco::ThreadImpl::runnableEntry(void*)+0x38) [0x677bc38]
2019.06.26 14:43:03.658758 [ 73 ] {} <Error> BaseDaemon: 11. clickhouse-server() [0x6fb07ef]
2019.06.26 14:43:03.658827 [ 73 ] {} <Error> BaseDaemon: 12. /lib64/libpthread.so.0(+0x7dd5) [0x7f6dcb003dd5]

2019.06.26 15:29:54.341827 [ 71 ] {} <Error> BaseDaemon: ########################################
2019.06.26 15:29:54.341932 [ 71 ] {} <Error> BaseDaemon: (version 19.9.2.4) (from thread 33) Received signal Segmentation fault (11).
2019.06.26 15:29:54.341983 [ 71 ] {} <Error> BaseDaemon: Address: 0xffffffffffffffe8
2019.06.26 15:29:54.342027 [ 71 ] {} <Error> BaseDaemon: Access: read.
2019.06.26 15:29:54.342058 [ 71 ] {} <Error> BaseDaemon: Address not mapped to object.
2019.06.26 15:29:54.364728 [ 71 ] {} <Error> BaseDaemon: 0. clickhouse-server(std::string::compare(std::string const&) const+0xd) [0x320c6ed]
2019.06.26 15:29:54.364796 [ 71 ] {} <Error> BaseDaemon: 1. clickhouse-server(DB::MergeTreePartInfo::operator<(DB::MergeTreePartInfo const&) const+0x12) [0x5c8d4b2]
2019.06.26 15:29:54.364854 [ 71 ] {} <Error> BaseDaemon: 2. clickhouse-server(DB::MergeTreeData::modifyPartState(std::shared_ptr<DB::MergeTreeDataPart const> const&, DB::MergeTreeDataPart::State)+0x74) [0x5d358d4]
2019.06.26 15:29:54.364903 [ 71 ] {} <Error> BaseDaemon: 3. clickhouse-server(DB::MergeTreeData::renameTempPartAndReplace(std::shared_ptr<DB::MergeTreeDataPart>&, SimpleIncrement*, DB::MergeTreeData::Transaction*, std::unique_lock<std::mutex>&, std::vector<std::shared_ptr<DB::MergeTreeDataPart const>, std::allocator<std::shared_ptr<DB::MergeTreeDataPart const> > >*)+0xa7e) [0x5d2385e]
2019.06.26 15:29:54.364953 [ 71 ] {} <Error> BaseDaemon: 4. clickhouse-server(DB::MergeTreeData::renameTempPartAndReplace(std::shared_ptr<DB::MergeTreeDataPart>&, SimpleIncrement*, DB::MergeTreeData::Transaction*)+0x83) [0x5d23af3]
2019.06.26 15:29:54.365003 [ 71 ] {} <Error> BaseDaemon: 5. clickhouse-server(DB::MergeTreeDataMergerMutator::renameMergedTemporaryPart(std::shared_ptr<DB::MergeTreeDataPart>&, std::vector<std::shared_ptr<DB::MergeTreeDataPart const>, std::allocator<std::shared_ptr<DB::MergeTreeDataPart const> > > const&, DB::MergeTreeData::Transaction*)+0x32) [0x5d38022]
2019.06.26 15:29:54.365057 [ 71 ] {} <Error> BaseDaemon: 6. clickhouse-server(DB::StorageMergeTree::merge(bool, std::string const&, bool, bool, std::string*)+0x3b6) [0x5c89b06]
2019.06.26 15:29:54.365092 [ 71 ] {} <Error> BaseDaemon: 7. clickhouse-server(DB::StorageMergeTree::backgroundTask()+0x161) [0x5c8b441]
2019.06.26 15:29:54.365119 [ 71 ] {} <Error> BaseDaemon: 8. clickhouse-server(DB::BackgroundProcessingPool::threadFunction()+0x3e8) [0x5cefc18]
2019.06.26 15:29:54.365144 [ 71 ] {} <Error> BaseDaemon: 9. clickhouse-server() [0x5cf0614]
2019.06.26 15:29:54.365181 [ 71 ] {} <Error> BaseDaemon: 10. clickhouse-server(ThreadPoolImpl<std::thread>::worker(std::_List_iterator<std::thread>)+0x187) [0x6420fb7]
2019.06.26 15:29:54.365213 [ 71 ] {} <Error> BaseDaemon: 11. clickhouse-server() [0x6fb07ef]
2019.06.26 15:29:54.365244 [ 71 ] {} <Error> BaseDaemon: 12. /lib64/libpthread.so.0(+0x7dd5) [0x7fcda61e1dd5]



md5-9070396ebabb643ad0b97d68510a4a70



2019.06.26 15:30:29.194860 [ 70 ] {} <Error> BaseDaemon: ########################################
2019.06.26 15:30:29.194934 [ 70 ] {} <Error> BaseDaemon: (version 19.9.2.4) (from thread 64) Received signal Segmentation fault (11).
2019.06.26 15:30:29.194978 [ 70 ] {} <Error> BaseDaemon: Address: 0xffe8
2019.06.26 15:30:29.195003 [ 70 ] {} <Error> BaseDaemon: Access: read.
2019.06.26 15:30:29.195026 [ 70 ] {} <Error> BaseDaemon: Address not mapped to object.
2019.06.26 15:30:29.215477 [ 70 ] {} <Error> BaseDaemon: 0. clickhouse-server(Poco::Net::NameValueCollection::set(std::string const&, std::string const&)+0x3c) [0x6642c4c]
2019.06.26 15:30:29.215563 [ 70 ] {} <Error> BaseDaemon: 1. clickhouse-server(DB::setResponseDefaultHeaders(Poco::Net::HTTPServerResponse&, unsigned int)+0xa8) [0x64316e8]
2019.06.26 15:30:29.215592 [ 70 ] {} <Error> BaseDaemon: 2. clickhouse-server(DB::WriteBufferFromHTTPServerResponse::startSendHeaders()+0x95) [0x64516f5]
2019.06.26 15:30:29.215619 [ 70 ] {} <Error> BaseDaemon: 3. clickhouse-server(DB::WriteBufferFromHTTPServerResponse::finalize()+0x66) [0x6452676]
2019.06.26 15:30:29.215667 [ 70 ] {} <Error> BaseDaemon: 4. clickhouse-server(DB::HTTPHandler::processQuery(Poco::Net::HTTPServerRequest&, HTMLForm&, Poco::Net::HTTPServerResponse&, DB::HTTPHandler::Output&)+0x1969) [0x31f40a9]
2019.06.26 15:30:29.215704 [ 70 ] {} <Error> BaseDaemon: 5. clickhouse-server(DB::HTTPHandler::handleRequest(Poco::Net::HTTPServerRequest&, Poco::Net::HTTPServerResponse&)+0x458) [0x31f6ab8]
2019.06.26 15:30:29.215738 [ 70 ] {} <Error> BaseDaemon: 6. clickhouse-server(Poco::Net::HTTPServerConnection::run()+0x2a9) [0x6663259]
2019.06.26 15:30:29.215772 [ 70 ] {} <Error> BaseDaemon: 7. clickhouse-server(Poco::Net::TCPServerConnection::start()+0xf) [0x665e22f]
2019.06.26 15:30:29.215805 [ 70 ] {} <Error> BaseDaemon: 8. clickhouse-server(Poco::Net::TCPServerDispatcher::run()+0xe5) [0x665e915]
2019.06.26 15:30:29.215842 [ 70 ] {} <Error> BaseDaemon: 9. clickhouse-server(Poco::PooledThread::run()+0x81) [0x677fe71]
2019.06.26 15:30:29.215906 [ 70 ] {} <Error> BaseDaemon: 10. clickhouse-server(Poco::ThreadImpl::runnableEntry(void*)+0x38) [0x677bc38]
2019.06.26 15:30:29.215938 [ 70 ] {} <Error> BaseDaemon: 11. clickhouse-server() [0x6fb07ef]
2019.06.26 15:30:29.215962 [ 70 ] {} <Error> BaseDaemon: 12. /lib64/libpthread.so.0(+0x7dd5) [0x7f1bbb0f3dd5]

Points:

I'm not sure why it dies one way or another. I've seen even more backtraces, can post if needed
If I remove Delta codec things become stable - I see no crashes
Delta codec on other UInt32 columns does not seem to cause crashes
The only values which end up in Date column are 1970-02-12 and 2019-06-26, but by inserting them manually I could not reproduce the segfault. Although I used clickhouse-client and not HTTP
This is 100% reproducible on my setup, if some tests are needed - let me know

bug crash v19.9

Source

blind-oracle

All 5 comments

Thanks for the report. Can you install version with address sanitizer? It can be downloaded from this page https://clickhouse-builds.s3.yandex.net/5626/2f0c7d094aad8bbf8453e6fd90d5851222dfa79a/report.html (row where third column == 'asan'). Sanitizer reports much more convenient than segfault traces.

P.S. asan print error messages to stderr log.

alesapin on 26 Jun 2019

@alesapin

Here's the ASAN dump with llvm-symbolizer applied:

    #0 0x133724d1 in void unalignedStore<int>(void*, int const&) /build/obj-x86_64-linux-gnu/../libs/libcommon/include/common/unaligned.h:17:5
    #1 0x133724d1 in void DB::(anonymous namespace)::compressDataForType<unsigned short>(char const*, unsigned int, char*) /build/obj-x86_64-linux-gnu/../dbms/src/Compression/CompressionCodecDelta.cpp:51
    #2 0x133724d1 in DB::CompressionCodecDelta::doCompressData(char const*, unsigned int, char*) const /build/obj-x86_64-linux-gnu/../dbms/src/Compression/CompressionCodecDelta.cpp:92
    #3 0x1337e35e in DB::ICompressionCodec::compress(char*, unsigned int, char*) const /build/obj-x86_64-linux-gnu/../dbms/src/Compression/ICompressionCodec.cpp:37:39
    #4 0x1337ae64 in DB::CompressionCodecMultiple::doCompressData(char const*, unsigned int, char*) const /build/obj-x86_64-linux-gnu/../dbms/src/Compression/CompressionCodecMultiple.cpp:70:41
    #5 0x1337e35e in DB::ICompressionCodec::compress(char*, unsigned int, char*) const /build/obj-x86_64-linux-gnu/../dbms/src/Compression/ICompressionCodec.cpp:37:39
    #6 0x1335c776 in DB::CompressedWriteBuffer::nextImpl() /build/obj-x86_64-linux-gnu/../dbms/src/Compression/CompressedWriteBuffer.cpp:34:37
    #7 0x12aebd90 in DB::WriteBuffer::next() /build/obj-x86_64-linux-gnu/../dbms/src/IO/WriteBuffer.h:44:13
    #8 0x12aebd90 in DB::HashingWriteBuffer::nextImpl() /build/obj-x86_64-linux-gnu/../dbms/src/IO/HashingWriteBuffer.h:64
    #9 0x12de6bcb in DB::WriteBuffer::next() /build/obj-x86_64-linux-gnu/../dbms/src/IO/WriteBuffer.h:44:13
    #10 0x12de6bcb in DB::IMergedBlockOutputStream::ColumnStream::finalize() /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergedBlockOutputStream.cpp:313
    #11 0x12df5902 in DB::MergedBlockOutputStream::writeSuffixAndFinalizePart(std::__1::shared_ptr<DB::MergeTreeDataPart>&, DB::NamesAndTypesList const*, DB::MergeTreeDataPartChecksums*) /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergedBlockOutputStream.cpp:481:21
    #12 0x12cf8da7 in DB::MergeTreeDataWriter::writeTempPart(DB::BlockWithPartition&) /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergeTreeDataWriter.cpp:262:9
    #13 0x12b4f7ba in DB::MergeTreeBlockOutputStream::write(DB::Block const&) /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergeTreeBlockOutputStream.cpp:24:65
    #14 0x11d50480 in DB::PushingToViewsBlockOutputStream::write(DB::Block const&) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/PushingToViewsBlockOutputStream.cpp:76:17
    #15 0x11d4a5c8 in DB::SquashingBlockOutputStream::finalize() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/SquashingBlockOutputStream.cpp:30:17
    #16 0x11d4b11d in DB::SquashingBlockOutputStream::writeSuffix() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/SquashingBlockOutputStream.cpp:50:5
    #17 0x1187a3e2 in void DB::copyDataImpl<DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)>(DB::IBlockInputStream&, DB::IBlockOutputStream&, DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:48:8
    #18 0x1187a3e2 in DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:61
    #19 0x11d43663 in DB::NullAndDoCopyBlockInputStream::readImpl() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/NullAndDoCopyBlockInputStream.h:40:9
    #20 0x1184108d in DB::IBlockInputStream::read() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/IBlockInputStream.cpp:56:15
    #21 0x1187951c in void DB::copyDataImpl<DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)>(DB::IBlockInputStream&, DB::IBlockOutputStream&, DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:25:31
    #22 0x1187951c in DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:61
    #23 0x1250bdbe in DB::executeQuery(DB::ReadBuffer&, DB::WriteBuffer&, bool, DB::Context&, std::__1::function<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>, std::__1::function<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>) /build/obj-x86_64-linux-gnu/../dbms/src/Interpreters/executeQuery.cpp:541:13
    #24 0x7148942 in DB::HTTPHandler::processQuery(Poco::Net::HTTPServerRequest&, HTMLForm&, Poco::Net::HTTPServerResponse&, DB::HTTPHandler::Output&) /build/obj-x86_64-linux-gnu/../dbms/programs/server/HTTPHandler.cpp:614:5
    #25 0x715332c in DB::HTTPHandler::handleRequest(Poco::Net::HTTPServerRequest&, Poco::Net::HTTPServerResponse&) /build/obj-x86_64-linux-gnu/../dbms/programs/server/HTTPHandler.cpp:725:9
    #26 0x13f2721f in Poco::Net::HTTPServerConnection::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Net/src/HTTPServerConnection.cpp:85:17
    #27 0x13f98dde in Poco::Net::TCPServerConnection::start() /build/obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerConnection.cpp:43:3
    #28 0x13f99a5f in Poco::Net::TCPServerDispatcher::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerDispatcher.cpp:114:20
    #29 0x14174284 in Poco::PooledThread::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:214:14
    #30 0x1416ec4e in Poco::ThreadImpl::runnableEntry(void*) /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_STD.cpp:139:27
    #31 0x141729d5 in decltype(std::__1::forward<void* (*)(void*)>(fp)(std::__1::forward<Poco::ThreadImpl*>(fp0))) std::__1::__invoke<void* (*)(void*), Poco::ThreadImpl*>(void* (*&&)(void*), Poco::ThreadImpl*&&) /usr/include/c++/v1/type_traits:4482:1
    #32 0x141729d5 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void* (*)(void*), Poco::ThreadImpl*, 2ul>(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void* (*)(void*), Poco::ThreadImpl*>&, std::__1::__tuple_indices<2ul>) /usr/include/c++/v1/thread:342
    #33 0x141729d5 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void* (*)(void*), Poco::ThreadImpl*> >(void*) /usr/include/c++/v1/thread:352
    #34 0x7fc6f4b936da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #35 0x7fc6f431688e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

0x602000156a40 is located 0 bytes to the right of 16-byte region [0x602000156a30,0x602000156a40)
allocated by thread T40 (HTTPHandler) here:
    #0 0x702ee73 in __interceptor_malloc (/usr/bin/clickhouse+0x702ee73)
    #1 0x7117ca8 in AllocatorWithHint<false, AllocatorHints::DefaultHint, 67108864ul>::alloc(unsigned long, unsigned long) /build/obj-x86_64-linux-gnu/../dbms/src/Common/Allocator.h:139:27
    #2 0x1337ad90 in void DB::PODArrayBase<1ul, 4096ul, AllocatorWithHint<false, AllocatorHints::DefaultHint, 67108864ul>, 0ul, 0ul>::alloc<>(unsigned long) /build/obj-x86_64-linux-gnu/../dbms/src/Common/PODArray.h:108:64
    #3 0x1337ad90 in void DB::PODArrayBase<1ul, 4096ul, AllocatorWithHint<false, AllocatorHints::DefaultHint, 67108864ul>, 0ul, 0ul>::realloc<>(unsigned long) /build/obj-x86_64-linux-gnu/../dbms/src/Common/PODArray.h:130
    #4 0x1337ad90 in void DB::PODArrayBase<1ul, 4096ul, AllocatorWithHint<false, AllocatorHints::DefaultHint, 67108864ul>, 0ul, 0ul>::reserve<>(unsigned long) /build/obj-x86_64-linux-gnu/../dbms/src/Common/PODArray.h:207
    #5 0x1337ad90 in void DB::PODArrayBase<1ul, 4096ul, AllocatorWithHint<false, AllocatorHints::DefaultHint, 67108864ul>, 0ul, 0ul>::resize<>(unsigned long) /build/obj-x86_64-linux-gnu/../dbms/src/Common/PODArray.h:213
    #6 0x1337ad90 in DB::CompressionCodecMultiple::doCompressData(char const*, unsigned int, char*) const /build/obj-x86_64-linux-gnu/../dbms/src/Compression/CompressionCodecMultiple.cpp:68
    #7 0x1337e35e in DB::ICompressionCodec::compress(char*, unsigned int, char*) const /build/obj-x86_64-linux-gnu/../dbms/src/Compression/ICompressionCodec.cpp:37:39
    #8 0x1335c776 in DB::CompressedWriteBuffer::nextImpl() /build/obj-x86_64-linux-gnu/../dbms/src/Compression/CompressedWriteBuffer.cpp:34:37
    #9 0x12aebd90 in DB::WriteBuffer::next() /build/obj-x86_64-linux-gnu/../dbms/src/IO/WriteBuffer.h:44:13
    #10 0x12aebd90 in DB::HashingWriteBuffer::nextImpl() /build/obj-x86_64-linux-gnu/../dbms/src/IO/HashingWriteBuffer.h:64
    #11 0x12de6bcb in DB::WriteBuffer::next() /build/obj-x86_64-linux-gnu/../dbms/src/IO/WriteBuffer.h:44:13
    #12 0x12de6bcb in DB::IMergedBlockOutputStream::ColumnStream::finalize() /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergedBlockOutputStream.cpp:313
    #13 0x12df5902 in DB::MergedBlockOutputStream::writeSuffixAndFinalizePart(std::__1::shared_ptr<DB::MergeTreeDataPart>&, DB::NamesAndTypesList const*, DB::MergeTreeDataPartChecksums*) /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergedBlockOutputStream.cpp:481:21
    #14 0x12cf8da7 in DB::MergeTreeDataWriter::writeTempPart(DB::BlockWithPartition&) /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergeTreeDataWriter.cpp:262:9
    #15 0x12b4f7ba in DB::MergeTreeBlockOutputStream::write(DB::Block const&) /build/obj-x86_64-linux-gnu/../dbms/src/Storages/MergeTree/MergeTreeBlockOutputStream.cpp:24:65
    #16 0x11d50480 in DB::PushingToViewsBlockOutputStream::write(DB::Block const&) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/PushingToViewsBlockOutputStream.cpp:76:17
    #17 0x11d4a5c8 in DB::SquashingBlockOutputStream::finalize() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/SquashingBlockOutputStream.cpp:30:17
    #18 0x11d4b11d in DB::SquashingBlockOutputStream::writeSuffix() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/SquashingBlockOutputStream.cpp:50:5
    #19 0x1187a3e2 in void DB::copyDataImpl<DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)>(DB::IBlockInputStream&, DB::IBlockOutputStream&, DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:48:8
    #20 0x1187a3e2 in DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:61
    #21 0x11d43663 in DB::NullAndDoCopyBlockInputStream::readImpl() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/NullAndDoCopyBlockInputStream.h:40:9
    #22 0x1184108d in DB::IBlockInputStream::read() /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/IBlockInputStream.cpp:56:15
    #23 0x1187951c in void DB::copyDataImpl<DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)>(DB::IBlockInputStream&, DB::IBlockOutputStream&, DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*)::$_0&, void (&)(DB::Block const&)) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:25:31
    #24 0x1187951c in DB::copyData(DB::IBlockInputStream&, DB::IBlockOutputStream&, std::__1::atomic<bool>*) /build/obj-x86_64-linux-gnu/../dbms/src/DataStreams/copyData.cpp:61
    #25 0x1250bdbe in DB::executeQuery(DB::ReadBuffer&, DB::WriteBuffer&, bool, DB::Context&, std::__1::function<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>, std::__1::function<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>) /build/obj-x86_64-linux-gnu/../dbms/src/Interpreters/executeQuery.cpp:541:13
    #26 0x7148942 in DB::HTTPHandler::processQuery(Poco::Net::HTTPServerRequest&, HTMLForm&, Poco::Net::HTTPServerResponse&, DB::HTTPHandler::Output&) /build/obj-x86_64-linux-gnu/../dbms/programs/server/HTTPHandler.cpp:614:5
    #27 0x715332c in DB::HTTPHandler::handleRequest(Poco::Net::HTTPServerRequest&, Poco::Net::HTTPServerResponse&) /build/obj-x86_64-linux-gnu/../dbms/programs/server/HTTPHandler.cpp:725:9
    #28 0x13f2721f in Poco::Net::HTTPServerConnection::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Net/src/HTTPServerConnection.cpp:85:17
    #29 0x13f98dde in Poco::Net::TCPServerConnection::start() /build/obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerConnection.cpp:43:3
    #30 0x13f99a5f in Poco::Net::TCPServerDispatcher::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerDispatcher.cpp:114:20
    #31 0x14174284 in Poco::PooledThread::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:214:14
    #32 0x1416ec4e in Poco::ThreadImpl::runnableEntry(void*) /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_STD.cpp:139:27
    #33 0x141729d5 in decltype(std::__1::forward<void* (*)(void*)>(fp)(std::__1::forward<Poco::ThreadImpl*>(fp0))) std::__1::__invoke<void* (*)(void*), Poco::ThreadImpl*>(void* (*&&)(void*), Poco::ThreadImpl*&&) /usr/include/c++/v1/type_traits:4482:1
    #34 0x141729d5 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void* (*)(void*), Poco::ThreadImpl*, 2ul>(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void* (*)(void*), Poco::ThreadImpl*>&, std::__1::__tuple_indices<2ul>) /usr/include/c++/v1/thread:342
    #35 0x141729d5 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void* (*)(void*), Poco::ThreadImpl*> >(void*) /usr/include/c++/v1/thread:352
    #36 0x7fc6f4b936da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

Thread T40 (HTTPHandler) created by T0 here:
    #0 0x701778d in __interceptor_pthread_create (/usr/bin/clickhouse+0x701778d)
    #1 0x14171bc8 in std::__1::__libcpp_thread_create(unsigned long*, void* (*)(void*), void*) /usr/include/c++/v1/__threading_support:327:10
    #2 0x14171bc8 in std::__1::thread::thread<void* (&)(void*), Poco::ThreadImpl*, void>(void* (&)(void*), Poco::ThreadImpl*&&) /usr/include/c++/v1/thread:368
    #3 0x1416e1d3 in Poco::ThreadImpl::startImpl(Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable> >) /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_STD.cpp:58:53
    #4 0x14170bc4 in Poco::Thread::start(Poco::Runnable&) /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread.cpp:116:2
    #5 0x1417483f in Poco::PooledThread::start(int) /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:88:10
    #6 0x1417483f in Poco::ThreadPool::ThreadPool(int, int, int, int, Poco::ThreadPool::ThreadAffinityPolicy) /build/obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:278
    #7 0x7075b46 in DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /build/obj-x86_64-linux-gnu/../dbms/programs/server/Server.cpp:547:26
    #8 0x13fc2430 in Poco::Util::Application::run() /build/obj-x86_64-linux-gnu/../contrib/poco/Util/src/Application.cpp:335:8
    #9 0x7063ef9 in DB::Server::run() /build/obj-x86_64-linux-gnu/../dbms/programs/server/Server.cpp:140:25
    #10 0x709a42b in mainEntryClickHouseServer(int, char**) /build/obj-x86_64-linux-gnu/../dbms/programs/server/Server.cpp:869:20
    #11 0x7061c02 in main /build/obj-x86_64-linux-gnu/../dbms/programs/main.cpp:174:12
    #12 0x7fc6f4216b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-buffer-overflow /build/obj-x86_64-linux-gnu/../libs/libcommon/include/common/unaligned.h:17:5 in void unalignedStore<int>(void*, int const&)
Shadow bytes around the buggy address:
  0x0c0480022cf0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c0480022d00: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa fd fa
  0x0c0480022d10: fa fa 00 fa fa fa 00 00 fa fa fd fd fa fa fd fa
  0x0c0480022d20: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fd
  0x0c0480022d30: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 fa
=>0x0c0480022d40: fa fa 04 fa fa fa 00 00[fa]fa fa fa fa fa fa fa
  0x0c0480022d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480022d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480022d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480022d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480022d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

blind-oracle on 26 Jun 2019

👍1

I've seen same errors on other codec when getMaxCompressedDataSize() returned wrong value. It probably should returns