<b>6.0.0.2411</b>
sunliqiang 2026.10.25 11:20:52
Validate index node key size in the duplicate scanner
IndexDuplicateScanner::find() rebuilds each key from a leaf node with
m_keyLength = node.length + node.prefix;
memcpy(currentKey + node.prefix, node.data, node.length);
where prefix and length are taken straight from the index page while
currentKey holds BTR_key_length() bytes.  Nothing checked the expanded
key against the buffer, so a corrupted leaf node with an inflated
prefix (the varint allows up to 16383) made the copy run past the
buffer.  walk_index() in validation.cpp already guards its own scan
this way, the scanner did not.
Add IndexNode::keyFits() and raise BUGCHECK(204) in the scanner when
the node does not fit the key buffer.  Checked with a database whose
unique unvalidated index has a leaf node with prefix = 16383: ALTER
INDEX ... VALIDATE UNIQUE used to crash the engine reading that page,
it now stops with the index inconsistency error, and validating a sane
index still reports duplicates as before.  The range check is covered
by the new IndexNodeTest cases running as part of libEngine14_test.

Changed paths:
  M src/jrd/btn.h
  M src/jrd/btr.cpp
  M src/jrd/tests/IndexNodeTest.cpp