…rcher.h

…rcher.h

…rcher.h

Backport #100225 to 26.1: Fix use-of-uninitialized-value in StringSearcher.h

Backport #100225 to 26.2: Fix use-of-uninitialized-value in StringSearcher.h

Backport #100225 to 26.3: Fix use-of-uninitialized-value in StringSearcher.h

…earcher

`StringSearcher<false, false>` (the UTF-8 case-insensitive variant used by
`ilike`, `positionCaseInsensitiveUTF8`, `startsWithCaseInsensitiveUTF8`,
`endsWithCaseInsensitiveUTF8`, `multiSearchAnyCaseInsensitiveUTF8`, and
`VolnitskyCaseInsensitiveUTF8`) populates the `cachel` / `cacheu` SIMD
registers in its constructor from per-character lowercase / uppercase
UTF-8 byte buffers `l_seq` / `u_seq` (each 6 bytes on the stack,
uninitialized at declaration).

The first character is handled by the outer `if (*needle < 0x80u)` /
`else` block, where the `else` branch already copies bytes verbatim
when `convertUTF8ToCodePoint` reports an invalid UTF-8 sequence.

The same care was missing from the per-character cache loop. Whenever
`convertUTF8ToCodePoint` returned an empty optional for an invalid
UTF-8 sequence in the middle of the needle (so `c_u32` was null and the
`if (c_u32) { ... }` body was skipped), the inner loop still went on to
read `l_seq[j]` / `u_seq[j]` for `j = 0..src_len-1` and feed those
bytes into `cachel` / `cacheu` via `_mm_insert_epi8`. When `src_len`
exceeded the number of bytes written by a previous iteration, the
uninitialized portion of `l_seq` / `u_seq` was inserted into the SIMD
cache and surfaced later as a `MemorySanitizer` use-of-uninitialized-value
in `_mm_cmpeq_epi8` against the haystack in both `compare`
(`StringSearcher.h:496`) and `search` (`StringSearcher.h:563`).

The fix adds the missing `else` branch — when `c_u32` is empty, the
needle bytes are memcpy'd into `l_seq` / `u_seq`, identical to how the
first character is handled.

This is the same chronic family that PR ClickHouse#100225 ("Fix
use-of-uninitialized-value in `StringSearcher.h`") partially addressed
by adding `if (needle == needle_end) return true;` to `compare` for the
empty-needle case. The empty-needle case is fixed; the invalid-UTF-8-
mid-needle case is what this PR closes.

Reported by `Unit tests (msan, function_prop_fuzzer)` across many
unrelated master and PR runs (chronic noise under umbrella issue
ClickHouse#104877), with stack:

    StringSearcher.h:563:61 in DB::impl::StringSearcher<false, false>::search
    Volnitsky::Volnitsky
    MatchImpl::vectorVector
    FunctionLike (ilike)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>