[
https://issues.apache.org/jira/browse/IGNITE-21637?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ilya Shishkov updated IGNITE-21637:
-----------------------------------
Description:
Ignite Node can fail with segmentation violation because of integer overflow
when eviction policy is used and large amount pages is allocated.
One of the problematic places: {{Random2LruPageEvictionTracker#touchPage}} [1].
In this place we can get incorrect offset value when {{trackingIdx}} is more
than {{Integer.MAX_VALUE / 8}}:
{{trackingArrPtr (long) + trackingIdx (int) * 8}}.
#
https://github.com/apache/ignite/blob/5ad698dab9835f6e6efb6a8b12da34515bd78349/modules/core/src/main/java/org/apache/ignite/internal/processors/cache/persistence/evict/Random2LruPageEvictionTracker.java#L95
was:
Ignite Node can fail with segmentation violation because of integer overflow
when eviction policy is used and large amount pages is allocated.
One of the problematic places: {{Random2LruPageEvictionTracker#touchPage}} [1].
In this place we can get incorrect address value when {{trackingIdx}} is more
than {{Integer.MAX_VALUE / 8}}:
{{trackingArrPtr (long) + trackingIdx (int) * 8}}.
#
https://github.com/apache/ignite/blob/5ad698dab9835f6e6efb6a8b12da34515bd78349/modules/core/src/main/java/org/apache/ignite/internal/processors/cache/persistence/evict/Random2LruPageEvictionTracker.java#L95
> Integer overflow in page eviction trackers
> ------------------------------------------
>
> Key: IGNITE-21637
> URL: https://issues.apache.org/jira/browse/IGNITE-21637
> Project: Ignite
> Issue Type: Bug
> Reporter: Ilya Shishkov
> Priority: Critical
> Labels: ise
>
> Ignite Node can fail with segmentation violation because of integer overflow
> when eviction policy is used and large amount pages is allocated.
> One of the problematic places: {{Random2LruPageEvictionTracker#touchPage}}
> [1]. In this place we can get incorrect offset value when {{trackingIdx}} is
> more than {{Integer.MAX_VALUE / 8}}:
> {{trackingArrPtr (long) + trackingIdx (int) * 8}}.
> #
> https://github.com/apache/ignite/blob/5ad698dab9835f6e6efb6a8b12da34515bd78349/modules/core/src/main/java/org/apache/ignite/internal/processors/cache/persistence/evict/Random2LruPageEvictionTracker.java#L95
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
