Skip to content
Snippets Groups Projects
Commit 651535bc authored by Georgiy Lebedev's avatar Georgiy Lebedev Committed by Aleksandr Lyapunov
Browse files

memtx: fix use-after-free of successor in `tree_iterator_start`

We assumed that the successor tuple's story could not get garbage collected
on clarify of result tuple in `tree_iterator_start`, since they coincide in
case of regular iterators. But this is not the case for reverse iterators:
the result tuple is of-by-one from the successor, which means the
successor's story can get garbage collected along with the tuple itself
getting deleted, leading to use-after-free of successor: remove garbage
collection from `memtx_tx_tuple_clarify` and call it manually.

The crash in #7756 revealed that the `put` in transaction manager's story
hash table was performed incorrectly: fix it and add an assertion that
nothing was replaced.

Closes #7755
Closes #7756

NO_DOC=bugfix
parent 93067481
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment