Skip to content

TiKV Crash Bug: LIKE operator on BIT(58) type causes index out of bounds panic #66597

@transgene0302

Description

@transgene0302

Bug Report

TiKV crashes with a panic when executing a LIKE operation on BIT(58) columns. The crash occurs in impl_like.rs due to an array index out of bounds error.

1. Minimal reproduce step (Required)

-- Step 1: Create a table with BIT(58) column

CREATE TABLE t1 (c1 INT);
CREATE TABLE t2 (c1 BIT(58));

-- Step 2: Insert test data
INSERT INTO t1 VALUES (1), (2);
INSERT INTO t2 VALUES (b'1010101010101010101010101010101010101010101010101010101010');
INSERT INTO t2 VALUES (b'1111111111111111111111111111111111111111111111111111111111');


-- Step 3: Execute query with LIKE on BIT(58) column - THIS CRASHES TiKV
SELECT * FROM t1 LEFT JOIN (SELECT c1 FROM t2) AS sub 
ON (sub.c1 LIKE sub.c1);   

2. What did you expect to see? (Required)

Either return an error indicating LIKE is not supported for BIT types
Or handle the operation gracefully without crashing

3. What did you see instead (Required)

TiKV process panics and exits with the following error:

[FATAL] [lib.rs:481] ["range end index 9 out of range for slice of length 8"]
[location=components/tidb_query_expr/src/impl_like.rs:50]
[thread_name=unified-read-pool-3]

Full backtrace:

   0: backtrace::capture::Backtrace::new
   1: tikv_util::set_panic_hook::{{closure}}
   2: std::panicking::rust_panic_with_hook
   3: std::panicking::begin_panic_handler::{{closure}}
   4: std::sys_common::backtrace::__rust_end_short_backtrace
   5: _rust_begin_unwind
   6: core::panicking::panic_fmt
   7: core::slice::index::slice_end_index_len_fail
   8: tidb_query_expr::impl_like::like
   9: <tidb_query_expr::types::function::ArgConstructor<A,E> as tidb_query_expr::types::function::Evaluator>::eval
  10: tidb_query_expr::impl_like::like_fn_meta::run
  ...

4. What is your TiDB version? (Required)

8.0.11-TiDB-v8.5.5 TiDB Server

Metadata

Metadata

Assignees

No one assigned

    Labels

    contributionThis PR is from a community contributor.type/bugThe issue is confirmed as a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions