lucy-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From nwelln...@apache.org
Subject lucy git commit: Guard against ord buffer overflow in SortFieldWriter
Date Thu, 03 Mar 2016 14:39:15 GMT
Repository: lucy
Updated Branches:
  refs/heads/master a7a652f37 -> fb986db61


Guard against ord buffer overflow in SortFieldWriter


Project: http://git-wip-us.apache.org/repos/asf/lucy/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucy/commit/fb986db6
Tree: http://git-wip-us.apache.org/repos/asf/lucy/tree/fb986db6
Diff: http://git-wip-us.apache.org/repos/asf/lucy/diff/fb986db6

Branch: refs/heads/master
Commit: fb986db61293e06db54fe15054f59e7a948add0c
Parents: a7a652f
Author: Nick Wellnhofer <wellnhofer@aevum.de>
Authored: Thu Mar 3 15:38:24 2016 +0100
Committer: Nick Wellnhofer <wellnhofer@aevum.de>
Committed: Thu Mar 3 15:38:24 2016 +0100

----------------------------------------------------------------------
 core/Lucy/Index/SortFieldWriter.c | 8 ++++++++
 1 file changed, 8 insertions(+)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/lucy/blob/fb986db6/core/Lucy/Index/SortFieldWriter.c
----------------------------------------------------------------------
diff --git a/core/Lucy/Index/SortFieldWriter.c b/core/Lucy/Index/SortFieldWriter.c
index f73698c..f761014 100644
--- a/core/Lucy/Index/SortFieldWriter.c
+++ b/core/Lucy/Index/SortFieldWriter.c
@@ -550,6 +550,10 @@ S_write_files(SortFieldWriter *self, OutStream *ord_out, OutStream *ix_out,
     // doc id 0.
     SFWriterElem *elem = (SFWriterElem*)SortFieldWriter_Fetch(self);
     SFWriterElemIVARS *elem_ivars = SFWriterElem_IVARS(elem);
+    if (elem_ivars->doc_id > doc_max) {
+        THROW(ERR, "doc_id %i32 greater than doc_max %i32",
+              elem_ivars->doc_id, doc_max);
+    }
     ords[elem_ivars->doc_id] = ord;
     ords[0] = 0;
 
@@ -571,6 +575,10 @@ S_write_files(SortFieldWriter *self, OutStream *ord_out, OutStream *ix_out,
             DECREF(last_val);
             last_val = INCREF(elem_ivars->value);
         }
+        if (elem_ivars->doc_id > doc_max) {
+            THROW(ERR, "doc_id %i32 greater than doc_max %i32",
+                  elem_ivars->doc_id, doc_max);
+        }
         ords[elem_ivars->doc_id] = ord;
         DECREF(elem);
     }


Mime
View raw message