Skip to content

Commit acc67a3

Browse files
daverigbytrondn
authored andcommitted
MB-29522: CouchKVStore::rollback: check return result of readVBState
As identified by UBSan, CouchKVStore::rollback() doesn't check the return value of resdVBState; which can result in it attempting to write a null local document to the rolled-back vBucket: [ RUN ] CouchKVStoreErrorInjectionTest.readVBState_open_local_document runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x7ffff7b5f30a in encode_root couchstore/src/node_types.cc:75 #1 0x7ffff7b36033 in db_write_header couchstore/src/couch_db.cc:175 #2 0x7ffff7b3f487 in couchstore_commit couchstore/src/couch_db.cc:255 #3 0x12c0e6d in CouchKVStore::rollback(unsigned short, unsigned long, std::shared_ptr<RollbackCB>) kv_engine/engines/ep/src/couch-kvstore/couch-kvstore.cc:2674 #4 0xd15cc6 in CouchKVStoreErrorInjectionTest_readVBState_open_local_document_Test::TestBody() kv_engine/engines/ep/tests/module_tests/kvstore_test.cc:1030 The local document is essential to interpreting the vBucket file; so if we can't read it we need to fail the rollback. Change-Id: I83871de2d4a96197bce17cbc9f1147792795a783 Reviewed-on: http://review.couchbase.org/93761 Tested-by: Build Bot <[email protected]> Reviewed-by: Trond Norbye <[email protected]>
1 parent 38ba836 commit acc67a3

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

engines/ep/src/couch-kvstore/couch-kvstore.cc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2666,7 +2666,9 @@ RollbackResult CouchKVStore::rollback(uint16_t vbid, uint64_t rollbackSeqno,
26662666
return RollbackResult(false, 0, 0, 0);
26672667
}
26682668

2669-
readVBState(newdb, vbid);
2669+
if (readVBState(newdb, vbid) != ENGINE_SUCCESS) {
2670+
return RollbackResult(false, 0, 0, 0);
2671+
}
26702672
cachedDeleteCount[vbid] = info.deleted_count;
26712673
cachedDocCount[vbid] = info.doc_count;
26722674

0 commit comments

Comments
 (0)