CLEANUP: add max field length check in map collection
@@ -1967,6 +1967,7 @@ static void process_mop_delete_complete(conn *c) {
char delimiter = ' ';
char old_delimiter = ','; /* need to keep backwards compatibility */
bool dropped;
+ int i;
if (c->coll_strkeys != NULL) {
#ifdef USE_STRING_MBLOCK_COLL
@@ -1997,6 +1998,15 @@ static void process_mop_delete_complete(conn *c) {
#endif
}
+ if (ret == ENGINE_SUCCESS && c->coll_numkeys != 0) { /* field validation check */
+ for (i = 0; i < c->coll_numkeys; i++) {
+ if (flist[i].length > MAX_FIELD_LENG) {
+ ret = ENGINE_EBADVALUE;
+ break;
+ }
+ }
+ }
+
if (ret == ENGINE_SUCCESS) {
ret = mc_engine.v1->map_elem_delete(mc_engine.v0, c, c->coll_key, c->coll_nkey,
c->coll_numkeys, flist, c->coll_drop, &del_count, &dropped, 0);
@@ -2069,7 +2079,7 @@ static void process_mop_get_complete(conn *c)
bool delete = c->coll_delete;
bool drop_if_empty = c->coll_drop;
bool dropped;
- int need_size = 0;
+ int i, need_size = 0;
if (c->coll_numkeys <= 0 || c->coll_numkeys > MAX_MAP_SIZE) {
need_size = MAX_MAP_SIZE * sizeof(eitem*);
@@ -2116,6 +2126,15 @@ static void process_mop_get_complete(conn *c)
#endif
}
+ if (ret == ENGINE_SUCCESS && c->coll_numkeys != 0) { /* field validation check */
+ for (i = 0; i < c->coll_numkeys; i++) {
+ if (flist[i].length > MAX_FIELD_LENG) {
+ ret = ENGINE_EBADVALUE;
+ break;
+ }
+ }
+ }
+
if (ret == ENGINE_SUCCESS) {
ret = mc_engine.v1->map_elem_get(mc_engine.v0, c, c->coll_key, c->coll_nkey, c->coll_numkeys, flist,
delete, drop_if_empty, elem_array, &elem_count, &flags, &dropped, 0);
