tarantool / tarantool / 5466470474

85%

master: 88%

push

github

memtx: fix heap-use-after-free of tuple stories caused by space alter

When a space is altered, we abort all in-progress transactions and delete
all stories related to that space: the problem is we don't delete the
stories' read gaps, which are also linked to the stories' transactions,
which get cleaned up on transaction destruction — this, in turn, results in
heap-use-after-free. To fix this, clean up stories' read gap in
`memtx_on_space_delete` — we don't do this in `memtx_tx_story_delete` since
it expects the story to not have any read gaps (see
`memtx_tx_story_gc_step`).

Tested this patch manually against Nick Shirokovskiy's experimental
small-ASAN integration branch.

Closes #8781

NO_DOC=bugfix
NO_TEST=<already covered by existing tests, but was not detectable by ASAN>

(cherry picked from commit e1ed31bbe)

59282 of 108206 branches covered (54.79%)

7 of 7 new or added lines in 1 file covered. (100.0%)

90438 of 106133 relevant lines covered (85.21%)

2496891.43 hits per line