Merge pull request ClickHouse#83086 from ClickHouse/backport/25.6/83020

clickhouse-gh[bot] · web-flow · commit ec847d634b3c · 2025-07-02T17:29:13.000+01:00
Backport ClickHouse#83020 to 25.6: Fix uninitialized memory in formatDateTime
diff --git a/src/Functions/formatDateTime.cpp b/src/Functions/formatDateTime.cpp
@@ -581,11 +581,17 @@ class FunctionFormatDateTimeImpl : public IFunction
                 fractional_second /= 10;
             }
 
-            for (UInt32 i = scale; i > 0 && fractional_second > 0; --i)
+            size_t writes = 0;
+            for (UInt32 i = scale; i > 0; --i)
             {
-                dest[i - 1] += fractional_second % 10;
+                dest[i - 1] = '0' + (fractional_second % 10);
                 fractional_second /= 10;
+                ++writes;
             }
+
+            for (UInt32 i = writes; i < 6; ++i)
+                dest[i] = '0';
+
             return 6;
         }
 
@@ -1217,11 +1223,11 @@ class FunctionFormatDateTimeImpl : public IFunction
         };
 
         Pos pos = format.data();
-        Pos const end = format.data() + format.size();
+        const Pos end = format.data() + format.size();
 
         while (true)
         {
-            Pos const percent_pos = find_first_symbols<'%'>(pos, end);
+            const Pos percent_pos = find_first_symbols<'%'>(pos, end);
 
             if (percent_pos < end)
             {
@@ -1356,16 +1362,18 @@ class FunctionFormatDateTimeImpl : public IFunction
                     // Fractional seconds
                     case 'f':
                     {
-                        /// If the time data type has no fractional part, we print (default) '000000' or (deprecated) '0' as fractional part.
                         if (mysql_f_prints_single_zero)
                         {
+                            /// If the time data type has no fractional part, print '0' as fractional part.
+                            /// Legacy behavior.
                             Instruction<T> instruction;
                             instruction.setMysqlFunc(&Instruction<T>::mysqlFractionalSecondSingleZero);
                             instructions.push_back(std::move(instruction));
                             out_template += String(scale == 0 ? 1 : scale, '0');
                         }
                         else
                         {
+                            /// If the time data type has no fractional part, print '000000' as fractional part.
                             if (mysql_f_prints_scale_number_of_digits)
                             {
                                 /// Print as many digits as specified by scale. Legacy behavior.
@@ -1376,7 +1384,8 @@ class FunctionFormatDateTimeImpl : public IFunction
                             }
                             else
                             {
-                                /// Unconditionally print six digits (independent of scale). This is what MySQL does, may it live long and prosper.
+                                /// Unconditionally print six digits (independent of scale).
+                                /// This is what MySQL does, may it live long and prosper.
                                 Instruction<T> instruction;
                                 instruction.setMysqlFunc(&Instruction<T>::mysqlFractionalSecond);
                                 instructions.push_back(std::move(instruction));
diff --git a/tests/queries/0_stateless/00719_format_datetime_f_varsize_bug.reference b/tests/queries/0_stateless/00719_format_datetime_f_varsize_bug.reference
@@ -0,0 +1 @@
+12:January:00.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
diff --git a/tests/queries/0_stateless/00719_format_datetime_f_varsize_bug.sql b/tests/queries/0_stateless/00719_format_datetime_f_varsize_bug.sql
@@ -0,0 +1,4 @@
+-- %M is a variable-size formatter. This triggered a bug in %f which forgot to write to all of its 6 output characters.
+-- This caused ClickHouse to output whatever happened to be in DRAM in these places.
+-- The problem occurs also with a single %f, I just added lots of them to make the issue more likely to occur.
+select formatDateTime(Date('2026-01-02'),'%h:%M:%s.%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f');

Original file line number	Diff line number	Diff line change
`@@ -581,11 +581,17 @@ class FunctionFormatDateTimeImpl : public IFunction`
`581`	`581`	`fractional_second /= 10;`
`582`	`582`	`}`
`583`	`583`
`584`		`- for (UInt32 i = scale; i > 0 && fractional_second > 0; --i)`
	`584`	`+ size_t writes = 0;`
	`585`	`+ for (UInt32 i = scale; i > 0; --i)`
`585`	`586`	`{`
`586`		`- dest[i - 1] += fractional_second % 10;`
	`587`	`+ dest[i - 1] = '0' + (fractional_second % 10);`
`587`	`588`	`fractional_second /= 10;`
	`589`	`+ ++writes;`
`588`	`590`	`}`
	`591`	`+`
	`592`	`+ for (UInt32 i = writes; i < 6; ++i)`
	`593`	`+ dest[i] = '0';`
	`594`	`+`
`589`	`595`	`return 6;`
`590`	`596`	`}`
`591`	`597`
`@@ -1217,11 +1223,11 @@ class FunctionFormatDateTimeImpl : public IFunction`
`1217`	`1223`	`};`
`1218`	`1224`
`1219`	`1225`	`Pos pos = format.data();`
`1220`		`- Pos const end = format.data() + format.size();`
	`1226`	`+ const Pos end = format.data() + format.size();`
`1221`	`1227`
`1222`	`1228`	`while (true)`
`1223`	`1229`	`{`
`1224`		`- Pos const percent_pos = find_first_symbols<'%'>(pos, end);`
	`1230`	`+ const Pos percent_pos = find_first_symbols<'%'>(pos, end);`
`1225`	`1231`
`1226`	`1232`	`if (percent_pos < end)`
`1227`	`1233`	`{`
`@@ -1356,16 +1362,18 @@ class FunctionFormatDateTimeImpl : public IFunction`
`1356`	`1362`	`// Fractional seconds`
`1357`	`1363`	`case 'f':`
`1358`	`1364`	`{`
`1359`		`- /// If the time data type has no fractional part, we print (default) '000000' or (deprecated) '0' as fractional part.`
`1360`	`1365`	`if (mysql_f_prints_single_zero)`
`1361`	`1366`	`{`
	`1367`	`+ /// If the time data type has no fractional part, print '0' as fractional part.`
	`1368`	`+ /// Legacy behavior.`
`1362`	`1369`	`Instruction<T> instruction;`
`1363`	`1370`	`instruction.setMysqlFunc(&Instruction<T>::mysqlFractionalSecondSingleZero);`
`1364`	`1371`	`instructions.push_back(std::move(instruction));`
`1365`	`1372`	`out_template += String(scale == 0 ? 1 : scale, '0');`
`1366`	`1373`	`}`
`1367`	`1374`	`else`
`1368`	`1375`	`{`
	`1376`	`+ /// If the time data type has no fractional part, print '000000' as fractional part.`
`1369`	`1377`	`if (mysql_f_prints_scale_number_of_digits)`
`1370`	`1378`	`{`
`1371`	`1379`	`/// Print as many digits as specified by scale. Legacy behavior.`
`@@ -1376,7 +1384,8 @@ class FunctionFormatDateTimeImpl : public IFunction`
`1376`	`1384`	`}`
`1377`	`1385`	`else`
`1378`	`1386`	`{`
`1379`		`- /// Unconditionally print six digits (independent of scale). This is what MySQL does, may it live long and prosper.`
	`1387`	`+ /// Unconditionally print six digits (independent of scale).`
	`1388`	`+ /// This is what MySQL does, may it live long and prosper.`
`1380`	`1389`	`Instruction<T> instruction;`
`1381`	`1390`	`instruction.setMysqlFunc(&Instruction<T>::mysqlFractionalSecond);`
`1382`	`1391`	`instructions.push_back(std::move(instruction));`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+12:January:00.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000