From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id A86983051A for ; Wed, 5 Dec 2018 15:23:23 -0500 (EST) Received: from turing.freelists.org ([127.0.0.1]) by localhost (turing.freelists.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HX0f6Aerqekp for ; Wed, 5 Dec 2018 15:23:23 -0500 (EST) Received: from smtpng3.m.smailru.net (smtpng3.m.smailru.net [94.100.177.149]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTPS id 6918A3050F for ; Wed, 5 Dec 2018 15:23:23 -0500 (EST) Subject: [tarantool-patches] Re: [PATCH v1 1/1] sql: fix tarantoolSqlite3TupleColumnFast References: From: Vladislav Shpilevoy Message-ID: Date: Wed, 5 Dec 2018 23:23:20 +0300 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: tarantool-patches-bounce@freelists.org Errors-to: tarantool-patches-bounce@freelists.org Reply-To: tarantool-patches@freelists.org List-help: List-unsubscribe: List-software: Ecartis version 1.0.0 List-Id: tarantool-patches List-subscribe: List-owner: List-post: List-archive: To: Kirill Shcherbatov , tarantool-patches@freelists.org Hi! Thanks for the patch! See 1 comment below. On 04/12/2018 20:39, Kirill Shcherbatov wrote: > http://github.com/tarantool/tarantool/tree/kshch/gh-3772-dirty-memory-access > https://github.com/tarantool/tarantool/issues/3772 > > The tarantoolSqlite3TupleColumnFast routine used to lookup > offset_slot in unallocated memory in some cases. In which 'some'? Yes, assert is wrong, but I do not understand how is it possible that fieldno >= field_count if such errors are caught during parsing stage. > The assert with exact_field_count from 7a8de28 is not correct. > assert(format->exact_field_count == 0 || > fieldno < format->exact_field_count); > The tarantoolSqlite3TupleColumnFast routine requires offset_slot > that has been allocated during tuple_format_create call. This > value is stored in indexed field with index that limited with > index_field_count that is <= field_count. > Look at tuple_format_alloc for more details. > > Closes #3772 > --- > src/box/sql.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/src/box/sql.c b/src/box/sql.c > index 171fd966a..25b3213fd 100644 > --- a/src/box/sql.c > +++ b/src/box/sql.c > @@ -199,9 +199,8 @@ tarantoolSqlite3TupleColumnFast(BtCursor *pCur, u32 fieldno, u32 *field_size) > assert(pCur->last_tuple != NULL); > > struct tuple_format *format = tuple_format(pCur->last_tuple); > - assert(format->exact_field_count == 0 > - || fieldno < format->exact_field_count); > - if (format->fields[fieldno].offset_slot == TUPLE_OFFSET_SLOT_NIL) > + if (fieldno >= format->field_count || > + format->fields[fieldno].offset_slot == TUPLE_OFFSET_SLOT_NIL) > return NULL; > const char *field = tuple_field(pCur->last_tuple, fieldno); > const char *end = field; >