lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(lib,scheduler): zarray_get rejects negative indexes; info resource bounds by capacity (bug-1824)

Browse source 
zarray_get_ex() checked only idx >= caps, so a negative index read
array->data[idx] out of bounds -- reachable through a resource whose
registration failed and kept idx == -1 (xcelimit.c add_vres()). It now
returns NULL for idx < 0.

repl_info_resource_one() bounded a shared resource's slot by
sharedInst.count / sharedInUse.count, the number of populated slots, not
the capacity: a populated slot above that count showed as value=(none).
It now relies on zarray_get()'s own bounds check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-09-30 03:34:57 +00:00
parent fd61721bab
commit 16b7aa4b60
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
4 changed files with 90 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/lib/testsuite/test_zarray.c
View file

@ -210,6 +210,25 @@ static void test_zarray_fini_resets_bounds_for_reuse()
zarray_fini(&array);
}
/* bug-1824: zarray_get_ex() only checked idx >= caps, so a negative index
* read array->data[idx] out of bounds. A resource whose registration fails
* keeps idx == -1 (xcelimit.c add_vres()), so a caller can pass one. */
static void test_zarray_get_negative_index_returns_null(void)
{
zarray_t z;
int v = 7;
zarray_init(&z, 4, NULL);
TEST_ASSERT_TRUE(zarray_put(&z, 0, &v) >= 0);
TEST_ASSERT_NULL(zarray_get(&z, -1));
TEST_ASSERT_NULL(zarray_get(&z, -1000));
TEST_ASSERT_EQUAL_PTR(&v, zarray_get(&z, 0));
zarray_fini(&z);
}
void test_zarray(void)
{
printf("\n>> zarray test\n\n");
@ -221,4 +240,5 @@ void test_zarray(void)
RUN_TEST(test_zarray_put_get_vec);
RUN_TEST(test_zarray_iter);
RUN_TEST(test_zarray_fini_resets_bounds_for_reuse);
RUN_TEST(test_zarray_get_negative_index_returns_null);
}

3
src/lib/zarray.c
View file

@ -350,7 +350,8 @@ int zarray_get_ex(zarray_t* array, int count, int* idxs, void** data)
for (i = 0; i < count; i++) {
int idx = idxs[i];
if (idx >= array->caps) {
/* bug-1824: a negative idx read array->data[idx] out of bounds */
if ((idx < 0) || (idx >= array->caps)) {
data[i] = NULL;
} else {
data[i] = array->data[idx];