Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Differential JOIN reads out of range for a nonempty nullary keyed left

Closed
  • Is something wrong?
#2,202 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #2212 by @justinjoy — merged

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
54/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
database

Research direction

Start in wirelog/columnar/join.c at wl_columnar_join_diff_op and compare its nullary left-input validation with the ordinary operator. Then inspect wirelog/columnar/diff_join_batch.c and the bounds check in join_batch.c; add the regression cases described for nonempty and empty zero-column left inputs, including the bounded mode. Done when the invalid keyed case returns EINVAL without changing the stack or reservations, while the empty case still returns an empty result.

Written by the indexing model from the issue text.

Description

bug

A nonempty nullary (zero-column) left input to a keyed differential JOIN can read past the left relation's column metadata.

Where

  • wl_columnar_join_diff_op (wirelog/columnar/join.c) resolves each key with col_op_resolve_key, which falls back to column 0 when the name is not found.
  • col_join_key_types_compatible then reads column_types[lk[k]] without checking lk[k] < left->ncols; for a zero-column left that index is out of range.
  • The bounded differential producer (col_diff_join_batch_producer_create, wirelog/columnar/diff_join_batch.c) has no lk[k] < left->ncols check either; the ordinary producer has one (join_batch.c, returns EINVAL).

3be9ba28 ("reject nonempty nullary keyed left inputs") added the rejection to the ordinary operator (wl_columnar_join_op) only. Found during the #1382 review (finding Y2); it predates #1382, which only changed how the differential operator records and refuses excluded shapes.

Fix

  • Mirror the 3be9ba28 check in wl_columnar_join_diff_op before the materialization cache lookup and the bounded-mode decision: a nonempty left with ncols == 0 and key_count > 0 returns EINVAL.
  • Add the lk[k] < left->ncols (and right) bounds check to col_diff_join_batch_producer_create, as the ordinary producer has.

Tests

  • A keyed differential JOIN over a nonempty zero-column left returns EINVAL and leaves the stack and reservations unchanged, with the knob off and at WIRELOG_JOIN_BATCH_BYTES=224, under ASan/UBSan.
  • An empty zero-column left still yields an empty result (the #2170 case).
Dominant language
C
Stars
18
Forks
2
Avg merge
7h 5m
Merged PRs (30d)
240

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from semantic-reasoning/wirelog

All issues in semantic-reasoning/wirelog

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.