[
https://issues.apache.org/jira/browse/LUCENE-8164?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16356313#comment-16356313
]
Robert Muir commented on LUCENE-8164:
-------------------------------------
Basically was looking at this in response to Tony Ma's thread on the user list
"Lucene 4.5.1 payload corruption - ArrayIndexOutOfBoundsException"
I'm not sure what IW actually does with it, but e.g. if it actually writes less
bytes than {{offset + length}}, then i can see pointers getting screwed up or
something. Maybe the test would need to write enough to produce skipdata or
whatever to get an obviously corrupt index.
> IndexWriter silently accepts broken payload
> -------------------------------------------
>
> Key: LUCENE-8164
> URL: https://issues.apache.org/jira/browse/LUCENE-8164
> Project: Lucene - Core
> Issue Type: Bug
> Reporter: Robert Muir
> Priority: Major
> Attachments: LUCENE-8164_test.patch
>
>
> IndexWriter seems to be missing bounds checks for payloads completely.
> If you pass a "broken" payload (e.g. BytesRef's offset + length is out of
> bounds), it will silently index it as if nothing went wrong. What actually
> happens? Doesn't matter, we should be getting an exception.
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
