Skip to content

Out of bound read in on_replace when inserting into _index with 0 parts. #8688

@gmoshkin

Description

@gmoshkin

If an index definition is inserted directly into box.space._index which has an empty parts list, there's an out of bounds read in key_def_contains_sequential_parts.

This line contains a bug

for (uint32_t i = 0; i < def->part_count - 1; ++i) {

Because def->part_count is 0 and ((uint32_t)0) - 1 == UINT32_MAX.

This doesn't always result in a segfault, but you can verify in the debugger that in this loop out bounds memory is being read.

Metadata

Metadata

Assignees

Labels

2.11Target is 2.11 and all newer release/master branchesbugSomething isn't workinggood first issueGood for newcomers

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions