gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-25 13:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ecstore): reject zero erasure block_size in codec streaming read (#4340)

Browse Source 
The codec streaming GET reader divides by erasure.block_size in
build_codec_streaming_part_reader without validating the erasure
dimensions, unlike the legacy multipart path which already rejects
block_size==0 / data_shards==0. FileInfo::is_valid() does not check
block_size, so corrupted on-disk metadata (block_size==0, data_blocks>0)
passes validation and panics the read task with a divide-by-zero.

Add Erasure::has_valid_dimensions() and reject invalid dimensions at the
codec streaming entry before any disk access, mirroring the legacy guard
(which now reuses the same predicate).

Refs backlog#868 (868-1).
This commit is contained in:
Zhengchao An
2026-07-07 07:17:58 +08:00
committed by GitHub
parent 8b2c67a100
commit b813fc7739
2 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/ecstore/src/set_disk/read.rs
+41 -3
View File
@@ -597,7 +597,7 @@ impl SetDisks {
// Erasure params come from on-disk metadata; zero values must fail the read
// instead of panicking on the block/shard divisions below.
if erasure.block_size == 0 || erasure.data_shards == 0 {
if !erasure.has_valid_dimensions() {
return Err(Error::other(format!(
"invalid erasure metadata for {bucket}/{object}: block_size={}, data_blocks={}",
erasure.block_size, erasure.data_shards
@@ -959,8 +959,6 @@ impl SetDisks {
metrics_size_bucket: &'static str,
prefer_data_blocks_first_reader_setup: bool,
) -> Result<GetCodecStreamingReaderBuildOutcome> {
let (disks, files) = Self::shuffle_disks_and_parts_metadata_by_index(disks, files, fi);
let erasure = coding::Erasure::new_with_options(
fi.erasure.data_blocks,
fi.erasure.parity_blocks,
@@ -968,6 +966,18 @@ impl SetDisks {
fi.uses_legacy_checksum,
);
// Erasure params come from on-disk metadata; zero values must fail the read
// instead of panicking on the block/shard divisions inside the codec
// streaming reader below. Mirrors the legacy multipart guard.
if !erasure.has_valid_dimensions() {
return Err(Error::other(format!(
"invalid erasure metadata for {bucket}/{object}: block_size={}, data_blocks={}",
erasure.block_size, erasure.data_shards
)));
}
let (disks, files) = Self::shuffle_disks_and_parts_metadata_by_index(disks, files, fi);
if fi.parts.len() == 1 {
let part = &fi.parts[0];
let part_length =
@@ -2296,6 +2306,34 @@ mod tests {
)
}
#[tokio::test]
async fn codec_streaming_reader_rejects_zero_block_size_metadata() {
// Corrupted on-disk metadata: valid data/parity blocks but block_size == 0.
// The codec streaming entry must reject this and return an error instead of
// panicking on the block_size division inside the reader (mirrors the legacy
// multipart guard). The guard fires before any disk access, so empty disk /
// parts-metadata slices are sufficient.
let mut fi = codec_streaming_test_fileinfo(1024, 1);
fi.erasure.block_size = 0;
let result = SetDisks::get_object_decode_reader_with_fileinfo(
CODEC_STREAMING_TEST_BUCKET,
CODEC_STREAMING_TEST_OBJECT,
&fi,
&[],
&[],
0,
0,
false,
"test-object-class",
"test-size-bucket",
false,
)
.await;
assert!(result.is_err(), "zero block_size metadata must be rejected, not panic");
}
#[tokio::test]
async fn multipart_codec_streaming_reader_reads_parts_in_order() {
let readers: Vec<Box<dyn AsyncRead + Unpin + Send + Sync>> = vec![