[PATCH] vinyl: fix crash in run iterator due to uninitialized variable

[PATCH] vinyl: fix crash in run iterator due to uninitialized variable

[Vladimir Davydov]

vy_run_iterator_seek left the return statement uninitialized under
certain conditions. The branch in the code wasn't covered by any test,
because it could only be triggered by an EQ SELECT following range
coalescing, so we only saw it when a customer reported a crash.
Fix it and improve vinyl/select_consistency test to cover this branch.
---
 src/box/vy_run.c                       |  1 +
 test/vinyl/select_consistency.result   | 14 ++++++++++++--
 test/vinyl/select_consistency.test.lua | 14 ++++++++++++--
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/src/box/vy_run.c b/src/box/vy_run.c
index 14975bdf..38ca686f 100644
--- a/src/box/vy_run.c
+++ b/src/box/vy_run.c
@@ -1363,6 +1363,7 @@ vy_run_iterator_seek(struct vy_run_iterator *itr,
 		cmp = vy_stmt_compare_with_key(key, slice->begin, cmp_def);
 		if (cmp < 0 && iterator_type == ITER_EQ) {
 			vy_run_iterator_stop(itr);
+			*ret = NULL;
 			return 0;
 		}
 		if (cmp < 0 || (cmp == 0 && iterator_type != ITER_GT)) {
diff --git a/test/vinyl/select_consistency.result b/test/vinyl/select_consistency.result
index c8f19cac..f27d0ec6 100644
--- a/test/vinyl/select_consistency.result
+++ b/test/vinyl/select_consistency.result
@@ -53,10 +53,20 @@ end;
 ---
 ...
 function dml_loop()
+    local insert = true
     while not stop do
-        gen_insert()
+        if s:len() >= MAX_KEY then
+            insert = false
+        end
+        if s:len() <= MAX_KEY / 2 then
+            insert = true
+        end
+        if insert then
+            gen_insert()
+        else
+            gen_delete()
+        end
         gen_update()
-        gen_delete()
         fiber.sleep(0)
     end
     ch:put(true)
diff --git a/test/vinyl/select_consistency.test.lua b/test/vinyl/select_consistency.test.lua
index 90fcf67e..73b443e8 100644
--- a/test/vinyl/select_consistency.test.lua
+++ b/test/vinyl/select_consistency.test.lua
@@ -34,10 +34,20 @@ function gen_update()
 end;
 
 function dml_loop()
+    local insert = true
     while not stop do
-        gen_insert()
+        if s:len() >= MAX_KEY then
+            insert = false
+        end
+        if s:len() <= MAX_KEY / 2 then
+            insert = true
+        end
+        if insert then
+            gen_insert()
+        else
+            gen_delete()
+        end
         gen_update()
-        gen_delete()
         fiber.sleep(0)
     end
     ch:put(true)
-- 
2.11.0

Re: [PATCH] vinyl: fix crash in run iterator due to uninitialized variable

[Vladimir Davydov]

On Sat, Feb 23, 2019 at 12:17:30AM +0300, Vladimir Davydov wrote:
> vy_run_iterator_seek left the return statement uninitialized under
> certain conditions. The branch in the code wasn't covered by any test,
> because it could only be triggered by an EQ SELECT following range
> coalescing, so we only saw it when a customer reported a crash.
> Fix it and improve vinyl/select_consistency test to cover this branch.

This one is urgent. Pushed to 2.1 and 1.10.

[tarantool-patches] Re: [PATCH] vinyl: fix crash in run iterator due to uninitialized variable

[Konstantin Osipov]

* Vladimir Davydov <vdavydov.dev@gmail.com> [19/02/23 12:44]:
> On Sat, Feb 23, 2019 at 12:17:30AM +0300, Vladimir Davydov wrote:
> > vy_run_iterator_seek left the return statement uninitialized under
> > certain conditions. The branch in the code wasn't covered by any test,
> > because it could only be triggered by an EQ SELECT following range
> > coalescing, so we only saw it when a customer reported a crash.
> > Fix it and improve vinyl/select_consistency test to cover this branch.
> 
> This one is urgent. Pushed to 2.1 and 1.10.
Thanks!


-- 
Konstantin Osipov, Moscow, Russia, +7 903 626 22 32
http://tarantool.io - www.twitter.com/kostja_osipov