tarantool/tarantool

Bug description Some xrow decoders assume a key always fits in a byte, resulting in truncation of long unknown keys and attribution of their values to other keys: tarantool/src/box/xrow.c Lines 2370 to 2371 in fffad3e uint8_t key = mp_decode_uint(&d); switch (key) { So, encoding box.iproto.key.INSTANCE_NAME + 256 key with some value will override the real box.iproto.key.INSTANCE_NAME's value. Reproducer: Run the following script in tarantool in interactive mode and observe log output: nb = require('net.box') msgpack = require('msgpack') uuid = require('uuid') function subscribe(conn, uuidstr, key, value) local header = msgpack.encode({ [box.iproto.key.REQUEST_TYPE] = box.iproto.type.SUBSCRIBE, [box.iproto.key.SYNC] = conn:_next_sync(), }) local body = msgpack.encode({ [box.iproto.key.INSTANCE_UUID

Bug description Most xrow decoders intend to skip unknown keys and their values, like this: tarantool/src/box/xrow.c Lines 977 to 979 in fffad3e if (key < iproto_key_MAX && iproto_key_type[key] != mp_typeof(*value)) goto error; But this check ignores the fact that known keys have gaps below iproto_key_MAX. At the moment of writing, 0x16 key is unassigned, for example (and many others as well). Such keys get MP_NIL as their iproto_key_type, so when such a key is found in a request it's rejected if it has any other value than MP_NIL. Correct handling is implemented in iproto_watch decoder: tarantool/src/box/xrow.c Lines 1798 to 1802 in fffad3e uint64_t key = mp_decode_uint(&data);