vinyl: fix use-after-free of last_stmt in vy_run_write_page
vy_run_write_page() doesn't take a reference to last_stmt, because it assumes that the write iterator guarantees it won't be deleted until 'next' is called again. The iterator does pin a statement if it is read from a run file - see vy_write_iterator_set_tuple() - however there's a case when the last returned statement can go away under us. This will happen if the iterator is used for major compaction and the last source statement is a DELETE. In this case the iterator will unreference the last statement it returned to the caller, take a reference to the DELETE instead, but won't return the DELETE - see vy_write_iterator_next(). As a result, the caller, i.e. vy_run_write_page(), will hit use-after-free on an attempt to read last_stmt. To fix this bug, let's make vy_run_write_page() take a reference to last_stmt as it used to before the write iterator was reworked. A test case will be added later, after all iterator-related issues have been fixed. Closes #2578
Loading
Please register or sign in to comment