You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucy.apache.org by nw...@apache.org on 2016/03/03 15:39:15 UTC
lucy git commit: Guard against ord buffer overflow in SortFieldWriter
Repository: lucy
Updated Branches:
refs/heads/master a7a652f37 -> fb986db61
Guard against ord buffer overflow in SortFieldWriter
Project: http://git-wip-us.apache.org/repos/asf/lucy/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucy/commit/fb986db6
Tree: http://git-wip-us.apache.org/repos/asf/lucy/tree/fb986db6
Diff: http://git-wip-us.apache.org/repos/asf/lucy/diff/fb986db6
Branch: refs/heads/master
Commit: fb986db61293e06db54fe15054f59e7a948add0c
Parents: a7a652f
Author: Nick Wellnhofer <we...@aevum.de>
Authored: Thu Mar 3 15:38:24 2016 +0100
Committer: Nick Wellnhofer <we...@aevum.de>
Committed: Thu Mar 3 15:38:24 2016 +0100
----------------------------------------------------------------------
core/Lucy/Index/SortFieldWriter.c | 8 ++++++++
1 file changed, 8 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucy/blob/fb986db6/core/Lucy/Index/SortFieldWriter.c
----------------------------------------------------------------------
diff --git a/core/Lucy/Index/SortFieldWriter.c b/core/Lucy/Index/SortFieldWriter.c
index f73698c..f761014 100644
--- a/core/Lucy/Index/SortFieldWriter.c
+++ b/core/Lucy/Index/SortFieldWriter.c
@@ -550,6 +550,10 @@ S_write_files(SortFieldWriter *self, OutStream *ord_out, OutStream *ix_out,
// doc id 0.
SFWriterElem *elem = (SFWriterElem*)SortFieldWriter_Fetch(self);
SFWriterElemIVARS *elem_ivars = SFWriterElem_IVARS(elem);
+ if (elem_ivars->doc_id > doc_max) {
+ THROW(ERR, "doc_id %i32 greater than doc_max %i32",
+ elem_ivars->doc_id, doc_max);
+ }
ords[elem_ivars->doc_id] = ord;
ords[0] = 0;
@@ -571,6 +575,10 @@ S_write_files(SortFieldWriter *self, OutStream *ord_out, OutStream *ix_out,
DECREF(last_val);
last_val = INCREF(elem_ivars->value);
}
+ if (elem_ivars->doc_id > doc_max) {
+ THROW(ERR, "doc_id %i32 greater than doc_max %i32",
+ elem_ivars->doc_id, doc_max);
+ }
ords[elem_ivars->doc_id] = ord;
DECREF(elem);
}