tarantool / tarantool / 5451562649

86%

master: 88%

push

github

memtx: fix heap-use-after-free of tuple stories caused by space alter

When a space is altered, we abort all in-progress transactions and delete
all stories related to that space: the problem is we don't delete the
stories' read gaps, which are also linked to the stories' transactions,
which get cleaned up on transaction destruction — this, in turn, results in
heap-use-after-free. To fix this, clean up stories' read gap in
`memtx_on_space_delete` — we don't do this in `memtx_tx_story_delete` since
it expects the story to not have any read gaps (see
`memtx_tx_story_gc_step`).

Tested this patch manually against Nick Shirokovskiy's experimental
small-ASAN integration branch.

Closes #8781

NO_DOC=bugfix
NO_TEST=<already covered by existing tests, but was not detectable by ASAN>

(cherry picked from commit e1ed31bbe)

62182 of 114040 branches covered (54.53%)

93161 of 108589 relevant lines covered (85.79%)

2876867.1 hits per line