[Xapian-tickets] [Xapian] #592: (crash) ChertTable::add_item_to_block on a seemingly corrupted block

[Xapian]

#592: (crash) ChertTable::add_item_to_block on a seemingly corrupted block
---------------------------+------------------------------------------------
 Reporter:  static-void    |       Owner:  olly 
     Type:  defect         |      Status:  new  
 Priority:  normal         |   Milestone:       
Component:  Backend-Chert  |     Version:  1.2.5
 Severity:  normal         |    Keywords:       
Blockedby:                 |    Platform:  Linux
 Blocking:                 |  
---------------------------+------------------------------------------------
 Xapian crashes when trying to flush Xapian !WritableDatabase.

 Environment: Ubuntu 11.10 x64; Xapian is used in zeitgeist-daemon (fts
 extension) through python bindings.

 I've tried to diag the crash with gdb. The simple reason is as follows:

 {{{
 Inside of:
 (backends/chert/chert_table.cc:683)
 void
 ChertTable::add_item_to_block(byte * p, Item_wr kt_, int c):

 DIR_END(p) is zero, and the following line:

 699     memmove(p + c + D2, p + c, dir_end - c);

 causes to pass memmove an insane len arg (like len=18446744073709551599).

 Dump of the first 16 bytes of the block p:

 (gdb) x /16xb $rbx
 0x151c3d0:      0x00    0x00    0x00    0x00    0x00    0xca    0xd9
 0xca
 0x151c3d8:      0xd9    0x00    0x00    0x00    0x00    0x00    0x00
 0x00
 }}}

 Backtrace is attached.

-- 
Ticket URL: <http://trac.xapian.org/ticket/592>
Xapian <http://xapian.org/>
Xapian