-
Notifications
You must be signed in to change notification settings - Fork 403
Closed
Labels
2.11Target is 2.11 and all newer release/master branchesTarget is 2.11 and all newer release/master branchesbugSomething isn't workingSomething isn't workinggood first issueGood for newcomersGood for newcomers
Description
If an index definition is inserted directly into box.space._index which has an empty parts list, there's an out of bounds read in key_def_contains_sequential_parts.
This line contains a bug
tarantool/src/box/tuple_extract_key.cc
Line 26 in 1315923
| for (uint32_t i = 0; i < def->part_count - 1; ++i) { |
Because def->part_count is 0 and ((uint32_t)0) - 1 == UINT32_MAX.
This doesn't always result in a segfault, but you can verify in the debugger that in this loop out bounds memory is being read.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
2.11Target is 2.11 and all newer release/master branchesTarget is 2.11 and all newer release/master branchesbugSomething isn't workingSomething isn't workinggood first issueGood for newcomersGood for newcomers