Fix OOB segfault in groupArrayLastMerge

[mstetsyuk]

Changelog category (leave one):

• Critical Bug Fix (crash, data loss, RBAC)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Fix a segfault in groupArrayLastMerge. Deserialization of aggregated function state is now validated. So a broken state does not lead to OOB.

Version info

• Merged into: 26.7.1.670 (included in 26.7 and later)
• Backported to: 26.6.2.53, 26.5.6.64, 26.4.5.152, 26.3.17.66, 25.8.29.28

[clickhouse-gh]

Workflow [PR], commit [c67534b]

Summary: ✅

• Performance Comparison: Performance dashboard

---

AI Review

Summary

This PR hardens groupArrayLast and groupArraySample state deserialization by rejecting states whose stored element count is inconsistent with total_values and max_elems, which closes the malformed-state path that could previously read past the stored array during merge. I did not find a remaining correctness issue in the code change itself; the only review note is a changelog-entry wording nit, and runtime confirmation is still pending because the direct Praktika report is empty.

PR Metadata

• Changelog category: Critical Bug Fix matches the change.
• Changelog entry: required, but the current text is too implementation-focused (OOB, "broken state") and does not follow the present-tense, user-facing style from the changelog guidelines.
• Replacement: Fixes a server exception when malformed \groupArrayLast` or `groupArraySample` aggregate states are deserialized or merged.`

Missing context / blind spots

• ⚠️ The direct Praktika report for PR #109485 was still empty at review time (Total: 0), and this checkout has no existing build directory, so I could not independently run 02520_group_array_last to confirm the new regression coverage.

Final Verdict

✅ No blocking issues found in the patch. Merge is reasonable once CI executes and the changelog entry is rewritten in user-facing terms.

[clickhouse-gh]

LLVM Coverage Report

Metric	Baseline	Current	Δ
Lines	85.60%	85.60%	+0.00%
Functions	92.70%	92.70%	+0.00%
Branches	77.80%	77.80%	+0.00%

Changed lines: Changed C/C++ lines covered: 17/17 (100.00%) · Uncovered code

Full report · Diff report