From 02716598d48a83855519c88045b20d9185bf06f5 Mon Sep 17 00:00:00 2001 From: zhiqiang Date: Tue, 16 Jul 2024 15:04:42 +0800 Subject: [PATCH] [Fix](sql function) memory overflow to the left of string address when do_money_format has small negative value #36226 (#37870) cherry pick from #36226 Co-authored-by: sparrow <38098988+biohazard4321@users.noreply.github.com> --- be/src/vec/functions/function_string.h | 5 ++++- be/test/vec/function/function_math_test.cpp | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/be/src/vec/functions/function_string.h b/be/src/vec/functions/function_string.h index 4096bcca6d..df15bc600e 100644 --- a/be/src/vec/functions/function_string.h +++ b/be/src/vec/functions/function_string.h @@ -3073,7 +3073,7 @@ static StringRef do_money_format(FunctionContext* context, const string& value) if (!is_positive) { *result_data = '-'; } - for (int i = value.size() - 4, j = result_len - 4; i >= 0; i = i - 3, j = j - 4) { + for (int i = value.size() - 4, j = result_len - 4; i >= 0; i = i - 3) { *(result_data + j) = *(value.data() + i); if (i - 1 < 0) { break; @@ -3085,6 +3085,9 @@ static StringRef do_money_format(FunctionContext* context, const string& value) *(result_data + j - 2) = *(value.data() + i - 2); if (j - 3 > 1 || (j - 3 == 1 && is_positive)) { *(result_data + j - 3) = ','; + j -= 4; + } else { + j -= 3; } } memcpy(result_data + result_len - 3, value.data() + value.size() - 3, 3); diff --git a/be/test/vec/function/function_math_test.cpp b/be/test/vec/function/function_math_test.cpp index c93c6ca324..00d0770935 100644 --- a/be/test/vec/function/function_math_test.cpp +++ b/be/test/vec/function/function_math_test.cpp @@ -511,7 +511,8 @@ TEST(MathFunctionTest, money_format_test) { InputTypeSet input_types = {TypeIndex::Float64}; DataSet data_set = {{{Null()}, Null()}, {{DOUBLE(17014116.67)}, VARCHAR("17,014,116.67")}, - {{DOUBLE(-17014116.67)}, VARCHAR("-17,014,116.67")}}; + {{DOUBLE(-17014116.67)}, VARCHAR("-17,014,116.67")}, + {{DOUBLE(-123.45)}, VARCHAR("-123.45")}}; static_cast(check_function(func_name, input_types, data_set)); }