Skip to content

Fix crash in StorageDistributed when parsing malformed shard directory names#90243

Merged
serxa merged 1 commit intoClickHouse:masterfrom
AVMusorin:avoid-possible-null-pointer
Nov 18, 2025
Merged

Fix crash in StorageDistributed when parsing malformed shard directory names#90243
serxa merged 1 commit intoClickHouse:masterfrom
AVMusorin:avoid-possible-null-pointer

Conversation

@AVMusorin
Copy link
Contributor

@AVMusorin AVMusorin commented Nov 17, 2025

Changelog category (leave one):

  • Critical Bug Fix (crash, data loss, RBAC) or LOGICAL_ERROR

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Fix crash in StorageDistributed when parsing malformed shard directory names

Documentation entry for user-facing changes

  • Documentation is written (mandatory for new features)

Details

When the server encounters a distributed table directory with a name that:

  • starts with the pattern shardN_all_replicas (e.g., shard3_all_replicas_bkp)
  • but doesn't end with exactly _all_replicas

It would crash with a segmentation fault due to out-of-bounds array access.

…y names

When ClickHouse encounters a distributed table directory with a name that:
- starts with the pattern `shardN_all_replicas` (e.g., `shard3_all_replicas_bkp`)
- but doesn't end with exactly `_all_replicas`

It would crash with a segmentation fault due to out-of-bounds array access.

Trace example:
```
* thread ClickHouse#1, name = 'clickhouse-serv', stop reason = signal SIGSEGV
  * frame #0: 0x000000001194481b clickhouse-server`DB::Cluster::Address::Address(DB::Cluster::Address const&) + 27
    frame ClickHouse#1: 0x0000000011944550 clickhouse-server`void std::__1::vector<DB::Cluster::Address, std::__1::allocator<DB::Cluster::Address> >::__push_back_slow_path<DB::Cluster::Address const&>(DB::Cluster::Address const&&&) + 208
    frame ClickHouse#2: 0x00000000129a6c35 clickhouse-server`DB::StorageDistributed::parseAddresses(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) const + 3349
    frame ClickHouse#3: 0x00000000129a589b clickhouse-server`DB::StorageDistributed::getDirectoryQueue(std::__1::shared_ptr<DB::IDisk> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 3675
    frame ClickHouse#4: 0x00000000129a3f22 clickhouse-server`DB::StorageDistributed::initializeDirectoryQueuesForDisk(std::__1::shared_ptr<DB::IDisk> const&) + 2082
    frame ClickHouse#5: 0x000000000f681c48 clickhouse-server`DB::ThreadPoolCallbackRunnerLocal<void, ThreadPoolImpl<ThreadFromGlobalPoolImpl<false, true> >, std::__1::function<void ()> >::operator()(std::__1::function<void ()>&&, Priority)::'lambda'()::operator()() + 136
    frame ClickHouse#6: 0x000000000f68286c clickhouse-server`std::__1::packaged_task<void ()>::operator()() + 44
    frame ClickHouse#7: 0x000000000d83335b clickhouse-server`ThreadPoolImpl<ThreadFromGlobalPoolImpl<false, true> >::ThreadFromThreadPool::worker() + 2395
    frame ClickHouse#8: 0x000000000d839e23 clickhouse-server`void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<ThreadFromGlobalPoolImpl<false, true>::ThreadFromGlobalPoolImpl<void (ThreadPoolImpl<ThreadFromGlobalPoolImpl<false, true> >::ThreadFromThreadPool::*)(), ThreadPoolImpl<ThreadFromGlobalPoolImpl<false, true> >::ThreadFromThre
adPool*>(void (ThreadPoolImpl<ThreadFromGlobalPoolImpl<false, true> >::ThreadFromThreadPool::*&&)(), ThreadPoolImpl<ThreadFromGlobalPoolImpl<false, true> >::ThreadFromThreadPool*&&)::'lambda'(), void ()> >(std::__1::__function::__policy_storage const*) + 99
    frame ClickHouse#9: 0x000000000d830602 clickhouse-server`ThreadPoolImpl<std::__1::thread>::ThreadFromThreadPool::worker() + 2242
    frame ClickHouse#10: 0x000000000d8379ba clickhouse-server`_ZNSt3__114__thread_proxyB6v15007INS_5tupleIJNS_10unique_ptrINS_15__thread_structENS_14default_deleteIS3_EEEEMN14ThreadPoolImplINS_6threadEE20ThreadFromThreadPoolEFvvEPSA_EEEEEPvSF_ + 90
```
@serxa serxa self-assigned this Nov 17, 2025
@serxa serxa added the can be tested Allows running workflows for external contributors label Nov 18, 2025
@clickhouse-gh
Copy link
Contributor

clickhouse-gh bot commented Nov 18, 2025

Workflow [PR], commit [8cd469f]

Summary:

job_name test_name status info comment
AST fuzzer (amd_debug) failure
Logical error: 'Bad cast from type DB::ColumnConst to DB::ColumnVariant'. FAIL cidb
BuzzHouse (amd_debug) failure
Buzzing result failure cidb

@clickhouse-gh clickhouse-gh bot added pr-critical-bugfix pr-must-backport Pull request should be backported intentionally. Use this label with great care! labels Nov 18, 2025
Copy link
Member

@serxa serxa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you.

@serxa serxa added this pull request to the merge queue Nov 18, 2025
Merged via the queue into ClickHouse:master with commit 1f2f418 Nov 18, 2025
129 of 132 checks passed
robot-clickhouse-ci-1 added a commit that referenced this pull request Nov 18, 2025
Cherry pick #90243 to 25.8: Fix crash in StorageDistributed when parsing malformed shard directory names
robot-clickhouse added a commit that referenced this pull request Nov 18, 2025
robot-clickhouse-ci-1 added a commit that referenced this pull request Nov 18, 2025
Cherry pick #90243 to 25.9: Fix crash in StorageDistributed when parsing malformed shard directory names
robot-clickhouse added a commit that referenced this pull request Nov 18, 2025
robot-clickhouse-ci-1 added a commit that referenced this pull request Nov 18, 2025
Cherry pick #90243 to 25.10: Fix crash in StorageDistributed when parsing malformed shard directory names
robot-clickhouse added a commit that referenced this pull request Nov 18, 2025
@robot-ch-test-poll4 robot-ch-test-poll4 added the pr-synced-to-cloud The PR is synced to the cloud repo label Nov 18, 2025
@robot-ch-test-poll3 robot-ch-test-poll3 added the pr-must-backport-synced The `*-must-backport` labels are synced into the cloud Sync PR label Nov 18, 2025
@AVMusorin AVMusorin deleted the avoid-possible-null-pointer branch November 19, 2025 10:14
zvonand pushed a commit to Altinity/ClickHouse that referenced this pull request Dec 24, 2025
…l-pointer

Fix crash in StorageDistributed when parsing malformed shard directory names
zvonand added a commit to Altinity/ClickHouse that referenced this pull request Dec 26, 2025
25.8.13 Stable backport of ClickHouse#90243: Fix crash in StorageDistributed when parsing malformed shard directory names
robot-clickhouse-ci-1 added a commit that referenced this pull request Jan 2, 2026
Cherry pick #90243 to 25.3: Fix crash in StorageDistributed when parsing malformed shard directory names
robot-clickhouse added a commit that referenced this pull request Jan 2, 2026
@robot-clickhouse-ci-1 robot-clickhouse-ci-1 added the pr-backports-created Backport PRs are successfully created, it won't be processed by CI script anymore label Jan 2, 2026
zvonand pushed a commit to Altinity/ClickHouse that referenced this pull request Jan 15, 2026
…l-pointer

Fix crash in StorageDistributed when parsing malformed shard directory names
zvonand added a commit to Altinity/ClickHouse that referenced this pull request Jan 15, 2026
25.8.13 Stable backport of ClickHouse#90243: Fix crash in StorageDistributed when parsing malformed shard directory names
zvonand added a commit to Altinity/ClickHouse that referenced this pull request Jan 27, 2026
25.8.13 Stable backport of ClickHouse#90243: Fix crash in StorageDistributed when parsing malformed shard directory names
zvonand added a commit to Altinity/ClickHouse that referenced this pull request Jan 28, 2026
25.8.15 Stable backport of ClickHouse#90243: Fix crash in StorageDistributed when parsing malformed shard directory names
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

can be tested Allows running workflows for external contributors pr-backports-created Backport PRs are successfully created, it won't be processed by CI script anymore pr-critical-bugfix pr-must-backport Pull request should be backported intentionally. Use this label with great care! pr-must-backport-synced The `*-must-backport` labels are synced into the cloud Sync PR pr-synced-to-cloud The PR is synced to the cloud repo

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants