fix: avoided unbounded mem by capping exemplars hint

CHANGELOG.md

@@ -1,6 +1,7 @@
 ## main / unreleased
 
 * [CHANGE] Set default `max_result_limit` for search to 256*1024 [#6525](https://github.com/grafana/tempo/pull/6525) (@zhxiaogg)
+* [BUGFIX] avoided unbounded mem by capping exemplars hint [#6792](https://github.com/grafana/tempo/pull/6792) (@zhxiaogg) 
 
 # v2.8.3
 

pkg/traceql/engine_metrics.go

@@ -24,6 +24,8 @@ const (
 	internalLabelBucket   = "__bucket"
 	maxExemplars          = 100
 	maxExemplarsPerBucket = 2
+	// This is a safety cap applied on the exemplars hint from traceql
+	maxExemplarsHint = 100000
 	// NormalNaN is a quiet NaN. This is also math.NaN().
 	normalNaN uint64 = 0x7ff8000000000001
 )
@@ -895,7 +897,7 @@ func (e *Engine) CompileMetricsQueryRange(req *tempopb.QueryRangeRequest, exempl
 	}
 
 	if v, ok := expr.Hints.GetInt(HintExemplars, allowUnsafeQueryHints); ok {
-		exemplars = v
+		exemplars = min(v, maxExemplarsHint)
 	}
 
 	// This initializes all step buffers, counters, etc

pkg/traceql/engine_metrics_test.go

@@ -236,6 +236,51 @@ func TestCompileMetricsQueryRange(t *testing.T) {
 	}
 }
 
+func TestCompileMetricsQueryRangeExemplarsHint(t *testing.T) {
+	tc := []struct {
+		name              string
+		q                 string
+		defaultExemplars  int
+		allowUnsafe       bool
+		expectedExemplars int
+	}{
+		{
+			name:              "hint below maxExemplarsHint uses maxExemplarsHint as floor",
+			q:                 `{} | rate() with(exemplars=5000)`,
+			defaultExemplars:  0,
+			allowUnsafe:       true,
+			expectedExemplars: 5000,
+		},
+		{
+			name:              "hint above maxExemplarsHint uses hint value",
+			q:                 `{} | rate() with(exemplars=500000)`,
+			defaultExemplars:  0,
+			allowUnsafe:       true,
+			expectedExemplars: maxExemplarsHint,
+		},
+		{
+			name:              "no exemplars hint uses default",
+			q:                 `{} | rate()`,
+			defaultExemplars:  42,
+			allowUnsafe:       false,
+			expectedExemplars: 42,
+		},
+	}
+
+	for _, c := range tc {
+		t.Run(c.name, func(t *testing.T) {
+			eval, err := NewEngine().CompileMetricsQueryRange(&tempopb.QueryRangeRequest{
+				Query: c.q,
+				Start: 1,
+				End:   2,
+				Step:  3,
+			}, c.defaultExemplars, 0, c.allowUnsafe)
+			require.NoError(t, err)
+			require.Equal(t, c.expectedExemplars, eval.maxExemplars)
+		})
+	}
+}
+
 func TestCompileMetricsQueryRangeFetchSpansRequest(t *testing.T) {
 	tc := map[string]struct {
 		q           string