Repository: lucy Updated Branches: refs/heads/master a7a652f37 -> fb986db61
Guard against ord buffer overflow in SortFieldWriter Project: http://git-wip-us.apache.org/repos/asf/lucy/repo Commit: http://git-wip-us.apache.org/repos/asf/lucy/commit/fb986db6 Tree: http://git-wip-us.apache.org/repos/asf/lucy/tree/fb986db6 Diff: http://git-wip-us.apache.org/repos/asf/lucy/diff/fb986db6 Branch: refs/heads/master Commit: fb986db61293e06db54fe15054f59e7a948add0c Parents: a7a652f Author: Nick Wellnhofer <wellnho...@aevum.de> Authored: Thu Mar 3 15:38:24 2016 +0100 Committer: Nick Wellnhofer <wellnho...@aevum.de> Committed: Thu Mar 3 15:38:24 2016 +0100 ---------------------------------------------------------------------- core/Lucy/Index/SortFieldWriter.c | 8 ++++++++ 1 file changed, 8 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/lucy/blob/fb986db6/core/Lucy/Index/SortFieldWriter.c ---------------------------------------------------------------------- diff --git a/core/Lucy/Index/SortFieldWriter.c b/core/Lucy/Index/SortFieldWriter.c index f73698c..f761014 100644 --- a/core/Lucy/Index/SortFieldWriter.c +++ b/core/Lucy/Index/SortFieldWriter.c @@ -550,6 +550,10 @@ S_write_files(SortFieldWriter *self, OutStream *ord_out, OutStream *ix_out, // doc id 0. SFWriterElem *elem = (SFWriterElem*)SortFieldWriter_Fetch(self); SFWriterElemIVARS *elem_ivars = SFWriterElem_IVARS(elem); + if (elem_ivars->doc_id > doc_max) { + THROW(ERR, "doc_id %i32 greater than doc_max %i32", + elem_ivars->doc_id, doc_max); + } ords[elem_ivars->doc_id] = ord; ords[0] = 0; @@ -571,6 +575,10 @@ S_write_files(SortFieldWriter *self, OutStream *ord_out, OutStream *ix_out, DECREF(last_val); last_val = INCREF(elem_ivars->value); } + if (elem_ivars->doc_id > doc_max) { + THROW(ERR, "doc_id %i32 greater than doc_max %i32", + elem_ivars->doc_id, doc_max); + } ords[elem_ivars->doc_id] = ord; DECREF(elem); }