diff options
| author |  Gil <mcg@google.com> | 2018-04-16 09:03:38 -0700 |
|---|---|---|
| committer |  GitHub <noreply@github.com> | 2018-04-16 09:03:38 -0700 |
| commit | 6ac9fb4b98df0eaaaff75770b28ad4e37010db46 (patch) | |
| tree | ec8158ecace031845f4abdcac48317d19439a592 /Firestore/core | |
| parent | 7ae48c7d2e9e4f81dbae111dfbaaca5dab0ae6b8 (diff) | |
Fix iteration past end in LevelDBTransaction::Iterator (#1105)
Change Next() to avoid advancing past the end of either iterator by only
advancing if !advanced and if the iterator is still valid.
If Next() is called after the last entry is deleted, SyncToTransaction()
returns false indicating it hasn't advanced but at that point is_valid_
is false. Previously Next() would then attempt to advance one of the
underlying iterators and if it was the mutations_iter_ would advance
past the end, which would cause the next UpdateCurrent() to dereference
random memory.
Diffstat (limited to 'Firestore/core')
| -rw-r--r-- | Firestore/core/src/firebase/firestore/local/leveldb_transaction.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Firestore/core/src/firebase/firestore/local/leveldb_transaction.cc b/Firestore/core/src/firebase/firestore/local/leveldb_transaction.cc index f998550..561d1e2 100644 --- a/Firestore/core/src/firebase/firestore/local/leveldb_transaction.cc +++ b/Firestore/core/src/firebase/firestore/local/leveldb_transaction.cc @@ -123,7 +123,7 @@ void LevelDbTransaction::Iterator::AdvanceLDB() { void LevelDbTransaction::Iterator::Next() { FIREBASE_ASSERT_MESSAGE(Valid(), "Next() called on invalid iterator"); bool advanced = SyncToTransaction(); - if (!advanced) { + if (!advanced && is_valid_) { if (is_mutation_) { // A mutation might be shadowing leveldb. If so, advance both. if (db_iter_->Valid() && db_iter_->key() == mutations_iter_->first) { |