Skip to content
Snippets Groups Projects
Commit 31096a1b authored by Vladimir Davydov's avatar Vladimir Davydov
Browse files

memtx: fix use after free in functional index iterator

A memtx tree iterator remembers the last tuple returned to the user and
its hint so that it can restore iteration if the index is changed. To
prevent the tuple from being freed, it references it. The problem is
it's not enough for a functional index, because the latter allocates key
parts separately from tuples (it stores pointers to them in memtx tree
hints). As a result, if a tuple is deleted from the tree, its key parts
will be immediately freed, even if the tuple itself is referenced. Since
key parts are necessary to restore an iterator, this results in a use
after free bug.

To fix the issue, let's store a copy of the current tuple key part in
the iterator along with the tuple. If a key part is small, the copy is
stored in a preallocated fixed-size buffer, otherwise it's allocated
with malloc.

Closes #6786

(cherry picked from commit 51d0a9b2)
parent 0111af29
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment