fix heap-use-after-free in ORC SearchArgument rewriteLeaves.

hubgeter · hubgeter · commit 9a8e9f1160e3 · 2026-03-06T15:19:24.000+08:00
diff --git a/c++/src/sargs/SearchArgument.cc b/c++/src/sargs/SearchArgument.cc
@@ -315,7 +315,6 @@ namespace orc {
     // Perform BFS
     while (!nodes.empty()) {
       TreeNode& node = nodes.front();
-      nodes.pop_front();
 
       if (node->getOperator() == ExpressionTree::Operator::LEAF) {
         leaves.insert(node);
@@ -324,6 +323,7 @@ namespace orc {
           nodes.push_back(child);
         }
       }
+      nodes.pop_front();
     }
 
     // Update the leaf in place

Original file line number	Diff line number	Diff line change
`@@ -315,7 +315,6 @@ namespace orc {`
`315`	`315`	`// Perform BFS`
`316`	`316`	`while (!nodes.empty()) {`
`317`	`317`	`TreeNode& node = nodes.front();`
`318`		`- nodes.pop_front();`
`319`	`318`
`320`	`319`	`if (node->getOperator() == ExpressionTree::Operator::LEAF) {`
`321`	`320`	`leaves.insert(node);`
`@@ -324,6 +323,7 @@ namespace orc {`
`324`	`323`	`nodes.push_back(child);`
`325`	`324`	`}`
`326`	`325`	`}`
	`326`	`+ nodes.pop_front();`
`327`	`327`	`}`
`328`	`328`
`329`	`329`	`// Update the leaf in place`