From 5e12b4a1a55d41f7f35b352b2a2d171f82ee0c57 Mon Sep 17 00:00:00 2001 From: Vitaliy Filippov Date: Sat, 20 Jun 2026 02:02:35 +0300 Subject: [PATCH] Fix OOB read in old store checksum read if block count exceeds IOV_MAX (almost unreachable) May be fun to write a regression test for it :) IOV_MAX is 1024, so it requires at least a 4 MB object... --- src/blockstore/v1/read.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/blockstore/v1/read.cpp b/src/blockstore/v1/read.cpp index 3a793007..ea33974c 100644 --- a/src/blockstore/v1/read.cpp +++ b/src/blockstore/v1/read.cpp @@ -397,10 +397,10 @@ bool blockstore_impl_t::read_checksum_block(blockstore_op_t *op, int rv_pos, uin PRIV(op)->pending_ops++; io_uring_prep_readv(sqe, submit_fd, iov + n_pos, n_cur, submit_offset + clean_loc + item_start + d_pos); data->callback = [this, op](ring_data_t *data) { handle_read_event(data, op); }; - if (n_pos > 0 || n_pos + IOV_MAX < n_iov) + if (n_pos > 0 || n_iov > IOV_MAX) { uint32_t d_len = 0; - for (int i = 0; i < IOV_MAX; i++) + for (int i = 0; i < n_cur; i++) d_len += iov[n_pos+i].iov_len; data->iov.iov_len = d_len; d_pos += d_len;