CRoaring icon indicating copy to clipboard operation
CRoaring copied to clipboard

Fix segfault with roaring64 intersect_with_range and empty bitmap

Open Dr-Emann opened this issue 7 months ago • 5 comments

Fixes #635, and adds some tests

@SLieve, is this the right place to do this? The segfault under valgrind:

[ RUN      ] test_intersect_with_range
==648093== Invalid read of size 1
==648093==    at 0x12A894: art_node_iterator_lower_bound (art.c:1633)
==648093==    by 0x12AB9F: art_iterator_lower_bound (art.c:1696)
==648093==    by 0x120D2B: roaring64_iterator_move_equalorlarger (roaring64.c:2087)
==648093==    by 0x11E5DB: roaring64_bitmap_intersect_with_range (roaring64.c:1126)
==648093==    by 0x10F3F7: (anonymous namespace)::test_intersect_with_range(void**) (roaring64_unit.cpp:1058)
==648093==    by 0x15B74B: cmocka_run_one_test_or_fixture (cmocka.c:2801)
==648093==    by 0x15BA3F: cmocka_run_one_tests (cmocka.c:2909)
==648093==    by 0x15BF67: _cmocka_run_group_tests (cmocka.c:3040)
==648093==    by 0x112E17: main (roaring64_unit.cpp:1897)
==648093==  Address 0x1 is not stack'd, malloc'd or (recently) free'd
==648093==
[  ERROR   ] --- Test failed with exception: Segmentation fault(11)
[  FAILED  ] test_intersect_with_range

The actual error seems to comes from art_node_iterator_lower_bound when passed a NULL node, not sure if this is the right place to guard, or if something lower down in the call chain should handle an empty bitmap better.

Dr-Emann avatar Jun 26 '24 02:06 Dr-Emann