Jelajahi Sumber

LibSQL: Prevent writing to free heap blocks

Each block index should have been requested before a write happens to
it. If this is not the case, return an error.
Jelle Raaijmakers 2 tahun lalu
induk
melakukan
c05e08decb
2 mengubah file dengan 7 tambahan dan 2 penghapusan
  1. 1 0
      Tests/LibSQL/TestSqlHeap.cpp
  2. 6 2
      Userland/Libraries/LibSQL/Heap.cpp

+ 1 - 0
Tests/LibSQL/TestSqlHeap.cpp

@@ -186,6 +186,7 @@ TEST_CASE(heap_free_storage)
     TRY_OR_FAIL(heap->free_storage(storage_block_id));
     TRY_OR_FAIL(heap->free_storage(storage_block_id));
 
 
     // Again, write some large storage spanning multiple blocks
     // Again, write some large storage spanning multiple blocks
+    storage_block_id = heap->request_new_block_index();
     TRY_OR_FAIL(heap->write_storage(storage_block_id, long_string.bytes()));
     TRY_OR_FAIL(heap->write_storage(storage_block_id, long_string.bytes()));
     MUST(heap->flush());
     MUST(heap->flush());
     auto new_heap_size = MUST(heap->file_size_in_bytes());
     auto new_heap_size = MUST(heap->file_size_in_bytes());

+ 6 - 2
Userland/Libraries/LibSQL/Heap.cpp

@@ -118,8 +118,12 @@ ErrorOr<ByteBuffer> Heap::read_storage(Block::Index index)
 ErrorOr<void> Heap::write_storage(Block::Index index, ReadonlyBytes data)
 ErrorOr<void> Heap::write_storage(Block::Index index, ReadonlyBytes data)
 {
 {
     dbgln_if(SQL_DEBUG, "{}({}, {} bytes)", __FUNCTION__, index, data.size());
     dbgln_if(SQL_DEBUG, "{}({}, {} bytes)", __FUNCTION__, index, data.size());
-    VERIFY(index > 0);
-    VERIFY(data.size() > 0);
+    if (index == 0)
+        return Error::from_string_view("Writing to zero block is not allowed"sv);
+    if (data.is_empty())
+        return Error::from_string_view("Writing empty data is not allowed"sv);
+    if (m_free_block_indices.contains_slow(index))
+        return Error::from_string_view("Invalid write to a free block index"sv);
 
 
     // Split up the storage across multiple blocks if necessary, creating a chain
     // Split up the storage across multiple blocks if necessary, creating a chain
     u32 remaining_size = static_cast<u32>(data.size());
     u32 remaining_size = static_cast<u32>(data.size());