Work around UB in LMDB bindings (sigp#6211)

* Work around UB in LMDB bindings
AgeManning · Sep 3, 2024 · 71c2e37 · 71c2e37
1 parent c356488
commit 71c2e37
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/slasher/src/database/lmdb_impl.rs b/slasher/src/database/lmdb_impl.rs
@@ -165,8 +165,12 @@ impl<'env> Cursor<'env> {
     }
 
     pub fn get_current(&mut self) -> Result<Option<(Key<'env>, Value<'env>)>, Error> {
+        // FIXME: lmdb has an extremely broken API which can mutate the SHARED REFERENCE
+        // `value` after `get_current` is called. We need to convert it to a Vec here in order
+        // to avoid `value` changing after another cursor operation. I think this represents a bug
+        // in the LMDB bindings, as shared references should be immutable.
         if let Some((Some(key), value)) = self.cursor.get(None, None, MDB_GET_CURRENT).optional()? {
-            Ok(Some((Cow::Borrowed(key), Cow::Borrowed(value))))
+            Ok(Some((Cow::Borrowed(key), Cow::Owned(value.to_vec()))))
         } else {
             Ok(None)
         }

diff --git a/slasher/tests/random.rs b/slasher/tests/random.rs
@@ -235,3 +235,8 @@ fn no_crash_blocks_example1() {
         },
     );
 }
+
+#[test]
+fn no_crash_aug_24() {
+    random_test(13519442335106054152, TestConfig::default())
+}
-Original file line number
+Diff line change
@@ Expand Up / @@ -235,3 +235,8 @@ fn no_crash_blocks_example1() { @@
             },
         );
     }
+    #[test]
+    fn no_crash_aug_24() {
+        random_test(13519442335106054152, TestConfig::default())
+    }