Read the count MEOS writes at the start of its int - #114
Merged
estebanzimanyi merged 1 commit intoSep 30, 2026
Merged
estebanzimanyi merged 1 commit into
estebanzimanyi merged 1 commit into
Conversation
Fifteen methods of the object layer read the count a MEOS function writes into an int out-parameter, or the int it writes into a result buffer, at offset 0 of the four bytes they allocate: Temporal.time_split and time_split_n, TNumber.value_split and value_time_split, TPoint.values, stboxes and make_simple, STBox.quad_split_flat, IntSet.element_n, and value_set of TBool, TInt, TFloat, TText, TGeomPoint and TGeogPoint. Witness. Each read the int at offset 4 of a four-byte buffer. On the heap buffer Memory.allocate returns, getInt(4) throws ArrayIndexOutOfBoundsException: Index 4 out of bounds for length 4, so every one of these methods threw on any input; on the direct buffer of intset_value_n, IntSet.element_n read the four bytes past it. Measured. Against the catalog and libmeos of MobilityDB a362004728 with MEOS-API 20efba81be, nine of the fifteen answer, and the tests testValueSet, testValueSplit and testTimeSplit of TIntTest, testValuesStboxesMakeSimple of TGeomPointTest, testQuadSplitFlat of STBoxTest and testElementN of IntSetTest state their answers. The build succeeds and the suites run 106 and 1,805 tests, all passing. The other six stop further on: value_set of TBool, TFloat, TText, TGeomPoint and TGeogPoint appends to a null StringBuilder, and value_time_split hands MEOS a null argument. Why. MEOS writes an int out-parameter at its address, and the object layer reads it there.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fifteen methods of the object layer read the count a MEOS function writes into an int
out-parameter, or the int it writes into a result buffer, at offset 0 of the four bytes
they allocate: Temporal.time_split and time_split_n, TNumber.value_split and
value_time_split, TPoint.values, stboxes and make_simple, STBox.quad_split_flat,
IntSet.element_n, and value_set of TBool, TInt, TFloat, TText, TGeomPoint and TGeogPoint.
Witness. Each read the int at offset 4 of a four-byte buffer. On the heap buffer
Memory.allocate returns, getInt(4) throws ArrayIndexOutOfBoundsException: Index 4 out of
bounds for length 4, so every one of these methods threw on any input; on the direct
buffer of intset_value_n, IntSet.element_n read the four bytes past it.
Measured. Against the catalog and libmeos of MobilityDB a362004728 with MEOS-API
20efba81be, nine of the fifteen answer, and the tests testValueSet, testValueSplit and
testTimeSplit of TIntTest, testValuesStboxesMakeSimple of TGeomPointTest,
testQuadSplitFlat of STBoxTest and testElementN of IntSetTest state their answers. The
build succeeds and the suites run 106 and 1,805 tests, all passing. The other six stop
further on: value_set of TBool, TFloat, TText, TGeomPoint and TGeogPoint appends to a null
StringBuilder, and value_time_split hands MEOS a null argument.
Why. MEOS writes an int out-parameter at its address, and the object layer reads it there.