Skip to content

Fix MakeSharedCappedKeySegmentsExtractor with more than 6 widths - #15524

Open
Marti2203 wants to merge 1 commit into
meta:mainfrom
Marti2203:capped-extractor-many-widths
Open

Marti2203 wants to merge 1 commit into
meta:mainfrom
Marti2203:capped-extractor-many-widths

Conversation

@Marti2203

Copy link
Copy Markdown

Summary

MakeSharedCappedKeySegmentsExtractor() crashes for more than 6 byte widths:

auto ex = experimental::MakeSharedCappedKeySegmentsExtractor({1, 1, 1, 1, 1, 1, 1});  // segfault

For 0 to 6 widths it returns a SemiStaticCappedKeySegmentsExtractor<N> (a std::array). For more it returns a DynamicCappedKeySegmentsExtractor, whose constructor assigns ideal_ends_[i] while ideal_ends_ is still an empty std::vector, so it writes past the end of the vector. If it did not crash, Extract() would return no segments, since it copies ideal_ends_.

The fix sizes ideal_ends_ before filling it.

Test plan

DBBloomFilterTest.FixedWidthSegments now also covers a 7-width extractor ({1, 2, 0, 1, 1, 1, 1}): its id, and the extracted segment sizes for an empty key, a short key, an exact-length key and a longer key, matching the 4-width cases already there.

  • Without the fix: the test segfaults while creating the extractor.
  • With the fix: FixedWidthSegments and SstQueryFilter pass.
cmake --build <build> --target db_bloom_filter_test
./db_bloom_filter_test --gtest_filter='DBBloomFilterTest.FixedWidthSegments:DBBloomFilterTest.SstQueryFilter'

Debug build, clang 21. Independent of #15523, which fixes the decoding of SelectKeySegmentRange in the same file.

This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually.

For more than 6 byte widths, MakeSharedCappedKeySegmentsExtractor()
returns a DynamicCappedKeySegmentsExtractor, whose constructor assigned
ideal_ends_[i] without sizing the vector first. Creating such an
extractor wrote past the end of an empty vector (a segfault in
DBBloomFilterTest), and Extract() would have returned no segments.

Size ideal_ends_ before filling it, and cover a 7-width extractor in
DBBloomFilterTest.FixedWidthSegments.
@meta-cla meta-cla Bot added the CLA Signed label Oct 30, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant