Skip to content

Commit 42f2369

Browse files
daverigbytrondn
authored andcommitted
MB-29527: subdoc: Avoid undefined behaviour in operate_single_doc()
As identified by UBSan, if a sub-document operation results in a zero-length result (which is valid); the current implementation passes a null pointer to memcpy, which is undefined behaviour: [ RUN ] TransportProtocols/XattrTest.SetXattrAndDeleteBasic/Mcbp_XattrYes_JsonYes_SnappyYes runtime error: null pointer passed as argument 2, which is declared to never be null #0 0xd32951 in operate_single_doc kv_engine/daemon/subdocument.cc:776 couchbase#1 0xd3522d in do_body_phase kv_engine/daemon/subdocument.cc:1136 couchbase#2 0xd3522d in subdoc_operate kv_engine/daemon/subdocument.cc:1183 couchbase#3 0xd3522d in subdoc_executor kv_engine/daemon/subdocument.cc:431 Fix by using std::copy instead. Change-Id: Ia5e4d7f76fd57a81c62b930ded7b85dd31a1ae24 Reviewed-on: http://review.couchbase.org/93766 Tested-by: Build Bot <[email protected]> Reviewed-by: Trond Norbye <[email protected]>
1 parent 7343e0d commit 42f2369

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

daemon/subdocument.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -773,7 +773,7 @@ static bool operate_single_doc(SubdocCmdContext& context,
773773

774774
size_t offset = 0;
775775
for (auto& loc : op->result.newdoc()) {
776-
std::memcpy(temp.get() + offset, loc.at, loc.length);
776+
std::copy(loc.at, loc.at + loc.length, temp.get() + offset);
777777
offset += loc.length;
778778
}
779779

0 commit comments

Comments
 (0)