[tarantool-patches] Re: [PATCH v1 1/1] sql: fix tarantoolSqlite3TupleColumnFast

[Vladislav Shpilevoy <v.shpilevoy@tarantool.org>]

Hi! Thanks for the patch! See 1 comment below.

On 04/12/2018 20:39, Kirill Shcherbatov wrote:
> http://github.com/tarantool/tarantool/tree/kshch/gh-3772-dirty-memory-access
> https://github.com/tarantool/tarantool/issues/3772
> 
> The tarantoolSqlite3TupleColumnFast routine used to lookup
> offset_slot in unallocated memory in some cases.

In which 'some'? Yes, assert is wrong, but I do not understand
how is it possible that fieldno >= field_count if such errors
are caught during parsing stage.

> The assert with exact_field_count from 7a8de28 is not correct.
> assert(format->exact_field_count == 0 ||
>         fieldno < format->exact_field_count);
> The tarantoolSqlite3TupleColumnFast routine requires offset_slot
> that has been allocated during tuple_format_create call. This
> value is stored in indexed field with index that limited with
> index_field_count that is <= field_count.
> Look at tuple_format_alloc for more details.
> 
> Closes #3772
> ---
>   src/box/sql.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/src/box/sql.c b/src/box/sql.c
> index 171fd966a..25b3213fd 100644
> --- a/src/box/sql.c
> +++ b/src/box/sql.c
> @@ -199,9 +199,8 @@ tarantoolSqlite3TupleColumnFast(BtCursor *pCur, u32 fieldno, u32 *field_size)
>   	assert(pCur->last_tuple != NULL);
>   
>   	struct tuple_format *format = tuple_format(pCur->last_tuple);
> -	assert(format->exact_field_count == 0
> -	       || fieldno < format->exact_field_count);
> -	if (format->fields[fieldno].offset_slot == TUPLE_OFFSET_SLOT_NIL)
> +	if (fieldno >= format->field_count ||
> +	    format->fields[fieldno].offset_slot == TUPLE_OFFSET_SLOT_NIL)
>   		return NULL;
>   	const char *field = tuple_field(pCur->last_tuple, fieldno);
>   	const char *end = field;
>