提交 99e31ce5 编写于 作者: M Minglei Jin

coverity 278651: Skip walHead if len is out of range

上级 f546a563
...@@ -297,16 +297,14 @@ static int32_t walRestoreWalFile(SWal *pWal, void *pVnode, FWalWrite writeFp, ch ...@@ -297,16 +297,14 @@ static int32_t walRestoreWalFile(SWal *pWal, void *pVnode, FWalWrite writeFp, ch
} }
} }
if (pHead->len > size - sizeof(SWalHead)) { if (pHead->len < 0 || pHead->len > size - sizeof(SWalHead)) {
size = sizeof(SWalHead) + pHead->len; wError("vgId:%d, file:%s, wal head len out of range, hver:%" PRIu64 " len:%d offset:%" PRId64, pWal->vgId, name,
buffer = realloc(buffer, size); pHead->version, pHead->len, offset);
if (buffer == NULL) { code = walSkipCorruptedRecord(pWal, pHead, tfd, &offset);
wError("vgId:%d, file:%s, failed to open for restore since %s", pWal->vgId, name, strerror(errno)); if (code != TSDB_CODE_SUCCESS) {
code = TAOS_SYSTEM_ERROR(errno); walFtruncate(pWal, tfd, offset);
break; break;
} }
pHead = buffer;
} }
ret = tfRead(tfd, pHead->cont, pHead->len); ret = tfRead(tfd, pHead->cont, pHead->len);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册