Antalya 26.3: Bump to 26.3.17

[zvonand]

Changelog category (leave one):

• Not for changelog (changelog entry is not required)

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [efa360f]

[zvonand]

@blau-ai

[blau-ai]

CI triage for #2096 (26.3.16 → 26.3.17 bump)

Verdict: 8 distinct failing checks — 1 PR-caused (real bug, has a fix below), 1 real-but-pre-existing (fuzzer), 1 needs a baseline compare, and 5 that are infra/expected-for-a-bump. Not CI-green, but only one item is a genuine regression introduced by this bump and it has a small, clear fix.

Check	Class	PR-caused?
Stateless (amd_debug, parallel) + (…, s3 storage)	real bug	Yes — incomplete backport
BuzzHouse (amd_debug)	real bug, latent	No (pre-existing, fuzzer-found)
RegressionTests / Iceberg (2) / iceberg_2	test failures	Needs baseline compare
GrypeScan{Keeper,Server,Server-alpine} (+3 status checks)	infra	No
DCO	expected	No
FinishCIReport / PR	aggregate gates	No

---

1. Stateless tests — 04308_arrow_oob_reads_value ⟶ PR-caused, fix below

Both debug stateless jobs fail on the same test, deterministically:

04308_arrow_oob_reads_value:  [ FAIL ]
+FAIL [uuid] expected INCORRECT_DATA (exit=0);   got: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
+FAIL [uuid] expected INCORRECT_DATA (exit=139); got: <empty output>      # 139 = segfault

Only the last (uuid) sub-check fails; the other 8 pass. Both the test and the code it exercises arrived in this bump via e3d6c73dd18 "Backport ClickHouse#106395 to 26.3: Arrow IPC: fix heap out-of-bounds reads…" — git branch -r --contains e3d6c73dd18 shows it is only on this bump branch, not on antalya-26.3, so this is new here.

Root cause: the backport is incomplete. Every sibling reader in src/Processors/Formats/Impl/ArrowColumnToCHColumn.cpp validates the data buffer against the declared row count before reading (validateChunksBeforeReserve(… checkedCastFixedSizeBinary …)), but readColumnWithUUIDFromFixedBinaryData (line ~900) does not — it uses a raw assert_cast and only checks byte_width(), never the buffer size:

const auto & fixed_binary_array = assert_cast<const arrow::FixedSizeBinaryArray &>(arrow_chunk);
if (fixed_binary_array.byte_width() != sizeof(UUID)) throw …;   // width only, not length×width
for (int64_t i = 0; i < fixed_binary_array.length(); ++i)        // length is attacker-forged (16384)
    std::memcpy(&res, fixed_binary_array.GetValue(i), 16);       // reads past the 16-byte buffer → OOB → garbage / segfault

The test forges the row count to 16384 while the buffer holds 1 row, so GetValue(i) reads out of bounds — returning garbage (aaaa…, exit 0) or crashing (exit 139). Upstream ClickHouse/ClickHouse master already guards this path (its readColumnWithUUIDFromFixedBinaryData calls validateChunksBeforeReserve + checkedCastFixedSizeBinary); the 26.3 backport just dropped those two lines. This is a real read-out-of-bounds on malformed Arrow input, so it's worth fixing rather than muting the test.

Suggested fix (mirrors upstream — both helpers already exist in this branch):

--- a/src/Processors/Formats/Impl/ArrowColumnToCHColumn.cpp
+++ b/src/Processors/Formats/Impl/ArrowColumnToCHColumn.cpp
@@ static ColumnWithTypeAndName readColumnWithUUIDFromFixedBinaryData(
     auto column = type_hint->createColumn();
     auto & column_data = assert_cast<ColumnVector<UUID> &>(*column).getData();
-    column_data.reserve(arrow_column->length());
+
+    /// Reject a wrong fixed-size width before reserving: a FixedSizeBinary(1) read with a UUID hint
+    /// would otherwise reserve 16x the (attacker-controlled) row count before the per-chunk check.
+    const auto * fixed_type = assert_cast<const arrow::FixedSizeBinaryType *>(arrow_column->type().get());
+    if (static_cast<size_t>(fixed_type->byte_width()) != sizeof(UUID))
+        throw Exception(ErrorCodes::INCORRECT_DATA,
+            "Cannot read UUID from Arrow FixedSizeBinary array with byte_width != {}", sizeof(UUID));
+
+    /// Validate every chunk's data buffer covers the declared rows before reserving/reading.
+    validateChunksBeforeReserve(*arrow_column, [&](const arrow::Array & chunk) { checkedCastFixedSizeBinary(chunk, column_name); });
+    column_data.reserve(arrow_column->length());

     for (int chunk_i = 0, num_chunks = arrow_column->num_chunks(); chunk_i < num_chunks; ++chunk_i)
     {
-        const auto & arrow_chunk = *(arrow_column->chunk(chunk_i));
-        const auto & fixed_binary_array = assert_cast<const arrow::FixedSizeBinaryArray &>(arrow_chunk);
-
-        // Security check: Ensure we actually got 16 bytes per row
-        if (fixed_binary_array.byte_width() != sizeof(UUID))
-            throw Exception(ErrorCodes::INCORRECT_DATA,
-                "Cannot read UUID from Arrow FixedSizeBinary array with byte_width != {}", sizeof(UUID));
-
+        const auto & fixed_binary_array = checkedCastFixedSizeBinary(*(arrow_column->chunk(chunk_i)), column_name);
         for (int64_t i = 0; i < fixed_binary_array.length(); ++i)

(The per-element loop body is unchanged. checkedCastFixedSizeBinary validates byte_width × length ≤ buffer size per chunk, so the forged length is rejected as INCORRECT_DATA — which is exactly what the .reference expects.)

---

2. BuzzHouse (amd_debug) — real, but pre-existing (not this bump)

Crash is SIGABRT, Code: 49 (LOGICAL_ERROR) from executeQueryImpl at executeQuery.cpp:1240:

throw Exception(LOGICAL_ERROR, "Inconsistent AST formatting: the query:\n{}\ncannot parse query back …")

This is the debug-only AST format→re-parse roundtrip self-check tripping on a fuzzer query:
EXPLAIN ESTIMATE INSERT INTO t13 (…) SELECT … FROM generateRandom('…Variant(FixedString(147),Time64(3),Tuple(c3 Date))…') — it re-serializes as EXPLAIN ESTIMATE (INSERT …) (INSERT wrapped in parens) which then fails to parse back. It's a general AST-formatting defect in EXPLAIN ESTIMATE INSERT, unrelated to a patch-level version bump — BuzzHouse generates fresh random queries each run and surfaces different latent bugs. Not a merge blocker for this bump; worth a separate issue for the query-formatting owners. Recommend confirming a BuzzHouse run on antalya-26.3 reproduces it (it should).

---

3. RegressionTests / Iceberg (2) / iceberg_2 — needs a baseline compare

13 scenarios fail, all concentrated in one Altinity-antalya feature, /iceberg/export partition/ (catalogs, transactions, casting/lossy, casting/out_of_bounds), each an AssertionError. The suite runs with --output new-fails, i.e. these are flagged relative to the regression baseline. I can't fetch the report.html or a base-branch baseline from this container (no network), so I can't definitively call it PR-caused vs. baseline drift. Because the failures are deterministic and clustered in one feature (not scattered/flaky), the two likely explanations are (a) a real interaction with 26.3.17's casting changes, or (b) test-vs-version drift in the clickhouse-regression baseline. Ask: could the regression owner compare this iceberg_2 run against the latest antalya-26.3 baseline? If it's green there, it's a real regression to chase; if red there too, it's pre-existing.

---

4. Grype scans (3 jobs + 3 status checks) — infra, not PR-caused

All fail with the same Grype-side error, not a vulnerability:

WARN error updating db … UNIQUE constraint failed: operating_systems.name … (2067)
ERROR failed to load vulnerability db: database does not exist
##[error]Process completed with exit code 1

The Grype vulnerability DB failed to download/migrate on the runner. The status lines even read "Grype Scan Completed with 0 high/critical vulnerabilities." Safe to re-run once the Grype DB mirror is healthy.

5. DCO — expected for a version bump

"129 commits incorrectly signed off" — these are the upstream ClickHouse backport commits merged in via the v26.3.17 tag; upstream commits don't carry Altinity DCO sign-offs. Normal for a bump PR and handled by the maintainer at merge time, not a code defect.

6. FinishCIReport / PR — aggregate gates

These just reflect that the jobs above are red; they carry no independent failure.

---

Bottom line / next steps

• Only Update README.md #1 is a real regression introduced by this bump, and it's a genuine OOB-read fix. I can deliver the one-file patch above. Since the mention didn't specify delivery, I haven't pushed anything — want me to open a blau/* PR with this fix, or commit it directly onto bump/antalya-26.3/26.3.17?
• Update README.md #4 (Grype), Update README.md #5 (DCO), Update README.md #6 (aggregates) need no code change — re-run Grype / normal bump handling.
• Update README.md #2 (BuzzHouse) — file separately; not a blocker for the bump.
• Update README.md #3 (Iceberg export-partition) — needs a baseline comparison from the regression owner to classify.

_{Analysis only; I can't build/run ClickHouse in this container, so correctness of the proposed fix would be confirmed by CI on the PR. Evidence: run 29845885999, commit efa360f.}