Skip to content
Snippets Groups Projects
Commit 63f59df4 authored by Vladimir Davydov's avatar Vladimir Davydov Committed by Konstantin Osipov
Browse files

vinyl: fix use-after-free of last_stmt in vy_run_write_page

vy_run_write_page() doesn't take a reference to last_stmt, because it
assumes that the write iterator guarantees it won't be deleted until
'next' is called again. The iterator does pin a statement if it is read
from a run file - see vy_write_iterator_set_tuple() - however there's a
case when the last returned statement can go away under us. This will
happen if the iterator is used for major compaction and the last source
statement is a DELETE. In this case the iterator will unreference the
last statement it returned to the caller, take a reference to the DELETE
instead, but won't return the DELETE - see vy_write_iterator_next(). As
a result, the caller, i.e. vy_run_write_page(), will hit use-after-free
on an attempt to read last_stmt.

To fix this bug, let's make vy_run_write_page() take a reference to
last_stmt as it used to before the write iterator was reworked. A test
case will be added later, after all iterator-related issues have been
fixed.

Closes #2578
parent aff6235c
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment