Thread: Frequent HLL bitstream_unpack crashes

Folks,

We’ve been seeing nearly daily crashes from a PostgreSQL 9.6 application that is heavily
dependent on the HLL extension (v 2.10.2). All these crashes are from inside the HLL
bitstream_unpack function. Usually they’re from an INSERT VALUES statement, but
occasionally they are from an hll_cardinality call in a query.

I think I’ve identified the root cause, but I’d like someone who is familiar with the code
in the HLL library to confirm my hypothesis:

    In bitstream_unpack it pulls a full quadword of data out of the bitstream using the

    brc_curp pointer.  Usually this is not a problem.  However, if the brc_curp pointer is

    less than 8 bytes from the end of the bitstream data, then that quadword read is

    reading past the end of the actual bitstream data.  Because of the subsequent bit

    reordering, shifting, and masking this has no effect of the answers.  However, when

    the end of the bitstream is very close to the end of an OS page then the quadword

    read will attempt to read the next OS page, and if that next OS page does not exist

    in this process, then it will SEGV.

I posted this as a comment in the HLL GitHub, but have yet to get a response there:

    https://github.com/citusdata/postgresql-hll/issues/84

Thanks for any assistance!