[fix](expr) avoid crashing caused by big depth of expression tree

be/src/common/config.h

@@ -745,6 +745,9 @@ CONF_mInt32(max_fragment_start_wait_time_seconds, "30");
 
 // limit the queue of pending batches which will be sent by a single nodechannel
 CONF_mInt64(nodechannel_pending_queue_max_bytes, "67108864");
+
+// max depth of expression tree allowed.
+CONF_Int32(max_depth_of_expr_tree, "200");
 } // namespace config
 
 } // namespace doris

be/src/vec/exprs/vexpr.cpp

@@ -28,10 +28,10 @@
 #include "vec/exprs/vcompound_pred.h"
 #include "vec/exprs/vectorized_fn_call.h"
 #include "vec/exprs/vin_predicate.h"
-#include "vec/exprs/vtuple_is_null_predicate.h"
+#include "vec/exprs/vinfo_func.h"
 #include "vec/exprs/vliteral.h"
 #include "vec/exprs/vslot_ref.h"
-#include "vec/exprs/vinfo_func.h"
+#include "vec/exprs/vtuple_is_null_predicate.h"
 
 namespace doris::vectorized {
 using doris::Status;
@@ -62,9 +62,18 @@ VExpr::VExpr(const TypeDescriptor& type, bool is_slotref, bool is_nullable)
 }
 
 Status VExpr::prepare(RuntimeState* state, const RowDescriptor& row_desc, VExprContext* context) {
+    ++context->_depth_num;
+    if (context->_depth_num > config::max_depth_of_expr_tree) {
+        return Status::InternalError(
+                fmt::format("The depth of the expression tree is too big, make it less than {}",
+                            config::max_depth_of_expr_tree));
+    }
+
     for (int i = 0; i < _children.size(); ++i) {
         RETURN_IF_ERROR(_children[i]->prepare(state, row_desc, context));
     }
+
+    --context->_depth_num;
     return Status::OK();
 }
 

be/src/vec/exprs/vexpr_context.h

@@ -92,5 +92,8 @@ class VExprContext {
     std::unique_ptr<MemPool> _pool;
 
     int _last_result_column_id;
+
+    /// The depth of expression-tree.
+    int _depth_num = 0;
 };
 } // namespace doris::vectorized