Check iter index access slice bounds (#18213)

Author: kunga

ydb/core/tablet_flat/flat_fwd_cache.h

@@ -6,6 +6,7 @@
 #include "flat_fwd_page.h"
 #include "flat_table_part.h"
 #include "flat_part_slice.h"
+#include <ydb/library/yverify_stream/yverify_stream.h>
 
 namespace NKikimr {
 namespace NTable {
@@ -281,6 +282,7 @@ namespace NFwd {
  TDeque<TPageEx> Pages;
  ui32 PagesBeginOffset = 0, PagesPendingOffset = 0;
  TDeque<TNodeState> Queue;
+ TPageId BeginPageId = Max<TPageId>(), EndPageId = 0;
  };
 
  public:
@@ -302,6 +304,8 @@ namespace NFwd {
  auto& meta = Part->IndexPages.GetBTree(groupId);
  Levels.resize(meta.LevelCount + 1);
  Levels[0].Queue.push_back({meta.GetPageId(), meta.GetDataSize()});
+ Levels[0].BeginPageId = meta.GetPageId();
+ Levels[0].EndPageId = meta.GetPageId() + 1;
  if (meta.LevelCount) {
  IndexPageLocator.Add(meta.GetPageId(), GroupId, 0);
  }
@@ -325,6 +329,9 @@ namespace NFwd {
  return {page, false, true};
  }
 
+ Y_VERIFY_S(level.BeginPageId <= pageId && pageId < level.EndPageId, "Requested page " << pageId << " is out of loaded slice "
+ << BeginRowId << " " << EndRowId << " " << level.BeginPageId << " " << level.EndPageId << " with index " << Part->IndexPages.GetBTree(GroupId).ToString());
+
  DropPagesBefore(level, pageId);
  ShrinkPages(level);
 
@@ -436,8 +443,13 @@ namespace NFwd {
  if (child.GetRowCount() <= BeginRowId) {
  continue;
  }
- Y_ABORT_UNLESS(!Levels[levelId + 1].Queue || Levels[levelId + 1].Queue.back().PageId < child.GetPageId());
- Levels[levelId + 1].Queue.push_back({child.GetPageId(), child.GetDataSize()});
+ auto& nextLevel = Levels[levelId + 1];
+ Y_ABORT_UNLESS(!nextLevel.Queue || nextLevel.Queue.back().PageId < child.GetPageId());
+ nextLevel.Queue.push_back({child.GetPageId(), child.GetDataSize()});
+ if (nextLevel.BeginPageId == Max<TPageId>()) {
+ nextLevel.BeginPageId = child.GetPageId();
+ }
+ nextLevel.EndPageId = child.GetPageId() + 1;
  if (child.GetRowCount() >= EndRowId) {
  break;
  }

ydb/core/tablet_flat/flat_page_btree_index.h

@@ -89,6 +89,8 @@ namespace NKikimr::NTable::NPage {
  TRowId RowCount_;
  ui64 DataSize_;
 
+ auto operator<=>(const TShortChild&) const = default;
+
  inline TPageId GetPageId() const noexcept {
  return PageId_;
  }
@@ -101,7 +103,9 @@ namespace NKikimr::NTable::NPage {
  return DataSize_;
  }
 
- auto operator<=>(const TShortChild&) const = default;
+ TString ToString() const {
+ return TStringBuilder() << "PageId: " << GetPageId() << " RowCount: " << GetRowCount() << " DataSize: " << GetDataSize();
+ }
  } Y_PACKED;
 
  static_assert(sizeof(TShortChild) == 20, "Invalid TBtreeIndexNode TShortChild size");

ydb/core/tablet_flat/flat_part_iter.h

@@ -186,6 +186,11 @@ namespace NTable {
  return EReady::Data;
  }
 
+ if (Page.BaseRow() + Page->Count >= EndRowId) {
+ // Row is outside of bounds
+ return Exhausted();
+ }
+
  if (seek != ESeek::Exact) {
  // The row we seek is on the next page
 

ydb/core/tablet_flat/test/libs/table/test_envs.h

@@ -304,7 +304,7 @@ namespace NTest {
  for (ui32 room : xrange(partStore->Store->GetRoomCount())) {
  if (room < partStore->Store->GetGroupCount()) {
  NPage::TGroupId groupId(room);
- partGroupQueues.push_back(Settle(partStore, room, NFwd::CreateCache(part, PartIndexPageLocator[part], groupId)));
+ partGroupQueues.push_back(Settle(partStore, room, NFwd::CreateCache(part, PartIndexPageLocator[part], groupId, partStore->Slices)));
  } else if (room == partStore->Store->GetOuterRoom()) {
  partGroupQueues.push_back(Settle(partStore, room, MakeOuter(partStore)));
  } else if (room == partStore->Store->GetExternRoom()) {