[CP] Fix merge join backup restore const expr datum out of bounds

Author: hezuojiao

src/sql/engine/join/ob_merge_join_op.cpp

@@ -973,9 +973,14 @@ int ObMergeJoinOp::ChildBatchFetcher::get_next_batch(const int64_t max_row_cnt)
     } else {
       const int64_t restore_cnt = MIN(max_row_cnt, remain_backup_rows);
       for (int64_t i = 0; i < backup_datums_.count(); i++) {
-        ObDatum *datum = all_exprs_->at(i)->locate_batch_datums(merge_join_op_.eval_ctx_);
-        MEMCPY(datum, backup_datums_.at(i) + backup_rows_used_, sizeof(ObDatum) * restore_cnt);
-        all_exprs_->at(i)->set_evaluated_projected(merge_join_op_.eval_ctx_);
+        const ObExpr *expr = all_exprs_->at(i);
+        if (expr->is_const_expr()) {
+          continue;
+        } else {
+          ObDatum *datum = all_exprs_->at(i)->locate_batch_datums(merge_join_op_.eval_ctx_);
+          MEMCPY(datum, backup_datums_.at(i) + backup_rows_used_, sizeof(ObDatum) * restore_cnt);
+          all_exprs_->at(i)->set_evaluated_projected(merge_join_op_.eval_ctx_);
+        }
       }
       brs_.size_ = restore_cnt;
       brs_.end_ = false;
@@ -1020,8 +1025,11 @@ int ObMergeJoinOp::ChildBatchFetcher::backup_remain_rows()
   } else if (backup_datums_.empty()) {
     int64_t alloc_size = sizeof(ObDatum) * merge_join_op_.spec_.max_batch_size_;
     for (int64_t i = 0; i < all_exprs_->count() && OB_SUCC(ret); i++) {
+      const ObExpr *expr = all_exprs_->at(i);
       ObDatum *datum = NULL;
-      if (OB_ISNULL(datum = static_cast<ObDatum *>(allocator.alloc(alloc_size)))) {
+      // if expr is const, use NULL datum pointer as padding.
+      if (!expr->is_const_expr() &&
+            OB_ISNULL(datum = static_cast<ObDatum *>(allocator.alloc(alloc_size)))) {
         ret = OB_ALLOCATE_MEMORY_FAILED;
         LOG_WARN("allocate memory failed", K(ret));
       } else if (OB_FAIL(backup_datums_.push_back(datum))) {
@@ -1035,17 +1043,22 @@ int ObMergeJoinOp::ChildBatchFetcher::backup_remain_rows()
       LOG_WARN("count mismatch", K(ret), K(all_exprs_->count()), K(backup_datums_.count()));
     } else {
       for (int64_t i = 0; i < all_exprs_->count() && OB_SUCC(ret); i++) {
-        backup_rows_cnt_ = 0;
-        backup_rows_used_ = 0;
-        ObDatumVector src_datum = all_exprs_->at(i)->locate_expr_datumvector(merge_join_op_.eval_ctx_);
-        ObDatum *datum = backup_datums_.at(i);
-        if (OB_ISNULL(datum)) {
-          ret = OB_ERR_UNEXPECTED;
-          LOG_WARN("backup datums memory is null", K(ret), K(i), K(all_exprs_->count()));
+        const ObExpr *expr = all_exprs_->at(i);
+        if (expr->is_const_expr()) {
+          continue;
         } else {
-          for (int64_t j = cur_idx_; j < brs_.size_ && OB_SUCC(ret); j++) {
-            if (!brs_.skip_->contain(j)) {
-              datum[backup_rows_cnt_++] = *src_datum.at(j);
+          backup_rows_cnt_ = 0;
+          backup_rows_used_ = 0;
+          ObDatumVector src_datum = expr->locate_expr_datumvector(merge_join_op_.eval_ctx_);
+          ObDatum *datum = backup_datums_.at(i);
+          if (OB_ISNULL(datum)) {
+            ret = OB_ERR_UNEXPECTED;
+            LOG_WARN("backup datums memory is null", K(ret), K(i), K(all_exprs_->count()));
+          } else {
+            for (int64_t j = cur_idx_; j < brs_.size_ && OB_SUCC(ret); j++) {
+              if (!brs_.skip_->contain(j)) {
+                datum[backup_rows_cnt_++] = *src_datum.at(j);
+              }
             }
           }
         }