Skip to content

[Bug] Fix bug that memory copy may overflow in MemIndex::load_segment #4458

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
morningman merged 2 commits into from
Aug 30, 2020
Merged

[Bug] Fix bug that memory copy may overflow in MemIndex::load_segment #4458

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
082c0c3
[Bug] Fix bug that memory copy may overflow in MemIndex::load_segment
acelyc111 Aug 26, 2020
3c7fe36
fix
acelyc111 Aug 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 26 additions & 13 deletions be/src/olap/olap_index.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,13 +208,16 @@ OLAPStatus MemIndex::load_segment(const char* file, size_t *current_num_rows_per
memory_copy(mem_ptr, storage_ptr, null_byte);

// 2. copy length and content
size_t storage_field_bytes =
*reinterpret_cast<StringLengthType*>(storage_ptr + null_byte);
Slice* slice = reinterpret_cast<Slice*>(mem_ptr + 1);
char* data = reinterpret_cast<char*>(_mem_pool->allocate(storage_field_bytes));
memory_copy(data, storage_ptr + sizeof(StringLengthType) + null_byte, storage_field_bytes);
slice->data = data;
slice->size = storage_field_bytes;
bool is_null = *reinterpret_cast<bool*>(mem_ptr);
if (!is_null) {
size_t storage_field_bytes =
*reinterpret_cast<StringLengthType*>(storage_ptr + null_byte);
Slice* slice = reinterpret_cast<Slice*>(mem_ptr + 1);
char* data = reinterpret_cast<char*>(_mem_pool->allocate(storage_field_bytes));
memory_copy(data, storage_ptr + sizeof(StringLengthType) + null_byte, storage_field_bytes);
slice->data = data;
slice->size = storage_field_bytes;
}

mem_ptr += mem_row_bytes;
storage_ptr += storage_row_bytes;
Expand All @@ -235,11 +238,14 @@ OLAPStatus MemIndex::load_segment(const char* file, size_t *current_num_rows_per
memory_copy(mem_ptr, storage_ptr, null_byte);

// 2. copy length and content
Slice* slice = reinterpret_cast<Slice*>(mem_ptr + 1);
char* data = reinterpret_cast<char*>(_mem_pool->allocate(storage_field_bytes));
memory_copy(data, storage_ptr + null_byte, storage_field_bytes);
slice->data = data;
slice->size = storage_field_bytes;
bool is_null = *reinterpret_cast<bool*>(mem_ptr);
if (!is_null) {
Slice* slice = reinterpret_cast<Slice*>(mem_ptr + 1);
char* data = reinterpret_cast<char*>(_mem_pool->allocate(storage_field_bytes));
memory_copy(data, storage_ptr + null_byte, storage_field_bytes);
slice->data = data;
slice->size = storage_field_bytes;
}

mem_ptr += mem_row_bytes;
storage_ptr += storage_row_bytes;
Expand All @@ -248,7 +254,14 @@ OLAPStatus MemIndex::load_segment(const char* file, size_t *current_num_rows_per
size_t storage_field_bytes = column.index_length();
mem_field_offset += storage_field_bytes + 1;
for (size_t j = 0; j < num_entries; ++j) {
memory_copy(mem_ptr + 1 - null_byte, storage_ptr, storage_field_bytes + null_byte);
// 1. copy null_byte
memory_copy(mem_ptr, storage_ptr, null_byte);

// 2. copy content
bool is_null = *reinterpret_cast<bool*>(mem_ptr);
if (!is_null) {
memory_copy(mem_ptr + 1, storage_ptr + null_byte, storage_field_bytes);
}

mem_ptr += mem_row_bytes;
storage_ptr += storage_row_bytes;
Expand Down
1 change: 1 addition & 0 deletions be/src/olap/rowset/segment_group.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -577,6 +577,7 @@ OLAPStatus SegmentGroup::add_segment() {
return OLAP_ERR_MALLOC_ERROR;
}

memset(_short_key_buf, 0, _short_key_length);
if (_current_index_row.init(*_schema) != OLAP_SUCCESS) {
OLAP_LOG_WARNING("init _current_index_row fail.");
return OLAP_ERR_INIT_FAILED;
Expand Down