[tarantool-patches] [PATCH v2 1/1] sql: check that received iterator is not NULL

[imeevma@tarantool.org]

Hi! Thank you for review! Diff between version, new patch and my
answers below.

https://github.com/tarantool/tarantool/issues/3857
https://github.com/tarantool/tarantool/tree/imeevma/gh-3857-add-check-for-received-iterator

On 12/17/18 8:41 PM, n.pettik wrote:
>
>
> I’ve rephrased your commit message:
>
> If the user does not have permission to read from the “_collation”
> space, the “PRAGMA collation_list” command causes a segmentation
> fault. This happens due to the fact that box_index_iterator() may fail
> and return NULL. Lets add check on this and if iterator is NULL, return
> with an error.

Applied.

> Btw, have you checked this case with other pragmas?

Yes, I haven't find any errors besides ones I fixed in patches for
3832.

>> +-- gh-3857 "PRAGMA collation_list" invokes segmentation fault.
> …without enough permission granted to user.

Added.


Diff between versions:

commit 0d5b9ec662b940a7a3e9e5e8d4e0febae6055db0
Author: Mergen Imeev <imeevma@gmail.com>
Date:   Tue Dec 18 19:24:15 2018 +0300

    sql: check that received iterator is not NULL
    
    If the user does not have permission to read from the “_collation”
    space, the “PRAGMA collation_list” command causes a segmentation
    fault. This happens due to the fact that box_index_iterator() may
    fail and return NULL. Lets add check on this and if iterator is
    NULL, return with an error.
    
    Closes #3857

diff --git a/test/sql/collation.result b/test/sql/collation.result
index 148a1a1..7f5d761 100644
--- a/test/sql/collation.result
+++ b/test/sql/collation.result
@@ -243,7 +243,10 @@ box.sql.execute("DROP TABLE t;")
 box.schema.user.revoke('guest', 'read,write,execute', 'universe')
 ---
 ...
--- gh-3857 "PRAGMA collation_list" invokes segmentation fault.
+--
+-- gh-3857 "PRAGMA collation_list" invokes segmentation fault
+-- without enough permission granted to user.
+--
 box.schema.user.create('tmp')
 ---
 ...
diff --git a/test/sql/collation.test.lua b/test/sql/collation.test.lua
index ade3a69..26652a9 100644
--- a/test/sql/collation.test.lua
+++ b/test/sql/collation.test.lua
@@ -95,7 +95,10 @@ box.sql.execute("SELECT b COLLATE \"unicode\" FROM t UNION SELECT a FROM t;")
 box.sql.execute("DROP TABLE t;")
 box.schema.user.revoke('guest', 'read,write,execute', 'universe')
 
--- gh-3857 "PRAGMA collation_list" invokes segmentation fault.
+--
+-- gh-3857 "PRAGMA collation_list" invokes segmentation fault
+-- without enough permission granted to user.
+--
 box.schema.user.create('tmp')
 box.session.su('tmp')
 -- Error: read access to space is denied.

New version:

commit 4c3e6e6dbb655d11b316e5c336cd195fce5b2239
Author: Mergen Imeev <imeevma@gmail.com>
Date:   Sat Dec 8 13:12:15 2018 +0300

    sql: check that received iterator is not NULL
    
    If the user does not have permission to read from the “_collation”
    space, the “PRAGMA collation_list” command causes a segmentation
    fault. This happens due to the fact that box_index_iterator() may
    fail and return NULL. Lets add check on this and if iterator is
    NULL, return with an error.
    
    Closes #3857

diff --git a/src/box/sql/pragma.c b/src/box/sql/pragma.c
index 5c35017..2b0d812 100644
--- a/src/box/sql/pragma.c
+++ b/src/box/sql/pragma.c
@@ -521,6 +521,11 @@ sqlite3Pragma(Parse * pParse, Token * pId,	/* First part of [schema.]id field */
 		box_tuple_t *tuple;
 		box_iterator_t* iter;
 		iter = box_index_iterator(space->def->id, 0,ITER_ALL, key_buf, key_end);
+		if (iter == NULL) {
+			pParse->rc = SQL_TARANTOOL_ERROR;
+			pParse->nErr++;
+			goto pragma_out;
+		}
 		int rc = box_iterator_next(iter, &tuple);
 		(void) rc;
 		assert(rc == 0);
diff --git a/test/sql/collation.result b/test/sql/collation.result
index f98e9cb..7f5d761 100644
--- a/test/sql/collation.result
+++ b/test/sql/collation.result
@@ -243,3 +243,24 @@ box.sql.execute("DROP TABLE t;")
 box.schema.user.revoke('guest', 'read,write,execute', 'universe')
 ---
 ...
+--
+-- gh-3857 "PRAGMA collation_list" invokes segmentation fault
+-- without enough permission granted to user.
+--
+box.schema.user.create('tmp')
+---
+...
+box.session.su('tmp')
+---
+...
+-- Error: read access to space is denied.
+box.sql.execute("pragma collation_list")
+---
+- error: Read access to space '_collation' is denied for user 'tmp'
+...
+box.session.su('admin')
+---
+...
+box.schema.user.drop('tmp')
+---
+...
diff --git a/test/sql/collation.test.lua b/test/sql/collation.test.lua
index c4c31fc..26652a9 100644
--- a/test/sql/collation.test.lua
+++ b/test/sql/collation.test.lua
@@ -94,3 +94,14 @@ box.sql.execute("SELECT b COLLATE \"unicode\" FROM t UNION SELECT a FROM t;")
 
 box.sql.execute("DROP TABLE t;")
 box.schema.user.revoke('guest', 'read,write,execute', 'universe')
+
+--
+-- gh-3857 "PRAGMA collation_list" invokes segmentation fault
+-- without enough permission granted to user.
+--
+box.schema.user.create('tmp')
+box.session.su('tmp')
+-- Error: read access to space is denied.
+box.sql.execute("pragma collation_list")
+box.session.su('admin')
+box.schema.user.drop('tmp')
-- 
2.7.4