[CBRD-27216] Fix int32 overflow in REPEAT result size (11.4) - #7704
Merged
Conversation
- REPEAT computed its result byte size with a 32-bit multiply, so a large result wrapped past the size check and undersized the buffer; the copy loop then overran the heap and crashed the server. Widen the multiply to 64-bit so the check fires and the statement errors out instead. - Report the requested byte count as size_t in message 1042, now that it can exceed int range. - An over-limit but non-overflowing result still returns NULL rather than an error, kept for MySQL compatibility. (cherry picked from commit ab1e86e)
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes a server-crash bug caused by 32-bit integer overflow when computing the result byte size for REPEAT(str, n) (notably reproducible with multibyte/UTF-8 strings), and aligns the related error message formatting with size_t-sized values.
Changes:
- Prevents int32 wraparound in
db_string_repeatsize calculation by promoting the multiplication to 64-bit before overflow checking. - Updates
ER_QPROC_STRING_SIZE_TOO_BIGreporting call sites to pass the required-size argument assize_t. - Updates message 1042 format specifier from
%dto%zu(Korean/English catalogs) to correctly printsize_t.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/query/string_opfunc.c | Promotes src_size * count_i to 64-bit before overflow checking and passes required sizes as size_t to match updated message formatting. |
| msg/ko_KR.utf8/cubrid.msg | Updates message 1042 to print required bytes using %zu. |
| msg/en_US.utf8/cubrid.msg | Updates message 1042 to print required bytes using %zu. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
|
Reviews (1): Last reviewed commit: "Merge remote-tracking branch 'upstream/r..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
db_string_make_empty_typed_string leaves dummy holding an allocated buffer, and the ER_QPROC_STRING_SIZE_TOO_BIG return is the only exit that does not clear it. The 64-bit multiply makes that branch reachable for the first time -- it was unreachable while the product was computed in int, since an int result can never exceed DB_INT32_MAX.
ctshim
approved these changes
Aug 14, 2026
jongmin-won
approved these changes
Aug 14, 2026
beyondykk9
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
http://jira.cubrid.org/browse/CBRD-27216
Purpose
REPEAT(str, n)의 결과 byte size 가 int32 overflow 되어cub_server가 crash. 멀티바이트(UTF-8) 컬럼이면 일반SELECT로 재현.Implementation
ab1e86e) cherry-pick.db_string_repeat:src_size * count_i를(DB_BIGINT)캐스팅으로 64-bit 곱셈 →OR_CHECK_INT_OVERFLOW에 걸려ER_QPROC_STRING_SIZE_TOO_BIG.%zu+ er_set 호출부size_t캐스팅.Remarks
dummy를 해제하는pr_clear_value를 추가했다. 이 분기는int곱셈 시절 결과가DB_INT32_MAX를 넘을 수 없어 도달 불가능했고, 64-bit 곱셈으로 처음 살아났다.