Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

CCBC-104 Fix illegal memory access

==19659==  General Protection Fault
==19659==    at 0x4E93216: ringbuffer_write (ringbuffer.c:127)
==19659==    by 0x4E90ACA: relocate_packets (instance.c:523)
==19659==    by 0x4E90E5E: lcb_update_serverlist (instance.c:583)
==19659==    by 0x4E91B83: vbucket_stream_handler (instance.c:964)
==19659==    by 0x60B7599: event_base_loop (in /usr/lib64/libevent-1.4.so.2.1.3)
==19659==    by 0x5EB0320: lcb_io_run_event_loop (plugin-libevent.c:320)
==19659==    by 0x4E982B4: lcb_wait (wait.c:112)

Change-Id: I6d8657433665b74ec5700f7665103f346bcfd46b
Reviewed-on: http://review.couchbase.org/22691
Tested-by: Sergey Avseyev <sergey.avseyev@gmail.com>
Reviewed-by: Trond Norbye <trond.norbye@gmail.com>
  • Loading branch information...
commit 865857534c8ddd8529ea34d0386d7152588455ec 1 parent 6e44bfd
Sergey Avseyev avsej authored trondn committed
Showing with 9 additions and 3 deletions.
  1. +9 −3 src/instance.c
12 src/instance.c
View
@@ -497,7 +497,7 @@ static void relocate_packets(lcb_server_t *src,
lcb_server_t *dst;
lcb_size_t nbody, npacket;
char *body;
- lcb_size_t idx;
+ int idx;
lcb_vbucket_t vb;
while (ringbuffer_read(&src->cmd_log, cmd.bytes, sizeof(cmd.bytes))) {
@@ -511,8 +511,14 @@ static void relocate_packets(lcb_server_t *src,
}
assert(ringbuffer_read(&src->cmd_log, body, nbody) == nbody);
vb = ntohs(cmd.request.vbucket);
- idx = (lcb_size_t)vbucket_get_master(dst_instance->vbucket_config, vb);
- dst = dst_instance->servers + idx;
+ idx = vbucket_get_master(dst_instance->vbucket_config, vb);
+ if (idx < 0) {
+ /* looks like master isn't ready to accept the data, try another
+ * one, maybe from fast forward map. this function will never
+ * give -1 */
+ idx = vbucket_found_incorrect_master(dst_instance->vbucket_config, vb, idx);
+ }
+ dst = dst_instance->servers + (lcb_size_t)idx;
if (src->connected) {
assert(ringbuffer_read(&src->output_cookies, &ct, sizeof(ct)) == sizeof(ct));
} else {
Please sign in to comment.
Something went wrong with that request. Please try again.