tarantool / tarantool / 16404

83%

master: 88%

push

travis-ci

<a href="https://github.com/tarantool/tarantool/commit/<a class=hub.com/tarantool/tarantool/commit/1e7646d71596c159d4053d4199b758f04d15365b">1e7646d71<a href="https://github.com/tarantool/tarantool/commit/1e7646d71596c159d4053d4199b758f04d15365b">&quot;&gt;box: fix use-after-free in space_truncate

space_truncate allocates a statement on the stack which is grossly
incorrect as the stack may be purged once the function returns while
box_process_rw expects the statement to be valid until the end of
the transaction. By happy accident, it worked fine until commit
1f7b0d6577f4 (&amp;quot;Require for single statement not autocommit in case of
ddl&amp;quot;), which made it possible to run this function from a transaction
and hence increased the probability of hitting the use-after-free bug.
The fix is trivial: allocate a truncation statement on the region.

Fixes commit 353bcdc5d010 (&amp;quot;Rework space truncation&amp;quot;).

Closes #4093

(cherry picked from commit </a><a class="double-link" href="https://github.com/tarantool/tarantool/commit/<a class="double-link" href="https://github.com/tarantool/tarantool/commit/b76542c42b82c08f651f24b41e15803f29556a2d">b76542c42</a>">b76542c42</a><a href="https://github.com/tarantool/tarantool/commit/1e7646d71596c159d4053d4199b758f04d15365b">)

7 of 7 new or added lines in 1 file covered. (100.0%)

41495 of 50278 relevant lines covered (82.53%)

843219.24 hits per line