tarantool / tarantool / 6143722560

88%

push

github

box: fix out of bound write in error_payload_destroy()

If `strlen(name)` is 1, `value_size` is 1, and `extra` is 0, then 15 bytes
are allocated for `struct error_field` in error_payload_prepare(). However,
the size of this structure is 16 because of the padding for the alignment.
Thus TRASH() in error_payload_destroy() writes 1 byte beyond the structure.

Closes #9098

NO_DOC=bugfix

64182 of 115883 branches covered (0.0%)

13 of 13 new or added lines in 1 file covered. (100.0%)

96032 of 111211 relevant lines covered (86.35%)

2601544.92 hits per line