lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(raft): reject n_peers > RAFT_MAX_PEERS in raft_init

Browse source 
next_index[]/match_index[]/pre_vote_replies[] are fixed-size RAFT_MAX_PEERS
arrays indexed by peer; without an upper-bound check a caller passing
n_peers > 8 would OOB-write in the leader-progress and pre-vote loops.
Add the guard (returns -EINVAL, no mutation) + canary-checked test.

Latent since task 1.1; surfaced by task 2.2 review (first loop writes into
the new arrays). No current caller exceeds the bound (sim caps at 8, HA <= 4).
This commit is contained in:
Rongsong Shen 2026-06-21 15:42:37 +00:00
parent 6ea89569fa
commit fc87a662cd
2 changed files with 37 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/lib/raft/raft.c
View file

@ -15,6 +15,11 @@ int raft_init(raft_state_t *s, const raft_config_t *cfg)
/* Validate required callbacks and n_peers before touching *s */
if (cfg->n_peers < 1)
return -EINVAL;
/* Upper bound: next_index[]/match_index[]/pre_vote_replies[] are fixed-size
* RAFT_MAX_PEERS arrays indexed by peer in [0, n_peers). Reject oversize
* clusters so the leader-progress and pre-vote loops can never OOB-write. */
if (cfg->n_peers > RAFT_MAX_PEERS)
return -EINVAL;
/* Even cluster sizes (>1) have no fault-tolerance advantage over the next
* smaller odd size and can mislead operators into thinking split-brain is
* impossible. Reject to prevent misconfiguration. */