Check iter index access slice bounds (#18213) (#18267)

Author: maximyurchuk

ydb/core/tablet_flat/flat_fwd_cache.h

@@ -6,6 +6,7 @@
 #include "flat_fwd_page.h"
 #include "flat_table_part.h"
 #include "flat_part_slice.h"
+#include <ydb/library/yverify_stream/yverify_stream.h>
 
 namespace NKikimr {
 namespace NTable {
@@ -281,6 +282,7 @@ namespace NFwd {
             TDeque<TPageEx> Pages;
             ui32 PagesBeginOffset = 0, PagesPendingOffset = 0;
             TDeque<TNodeState> Queue;
+            TPageId BeginPageId = Max<TPageId>(), EndPageId = 0;
         };
 
     public:
@@ -302,6 +304,8 @@ namespace NFwd {
             auto& meta = Part->IndexPages.GetBTree(groupId);
             Levels.resize(meta.LevelCount + 1);
             Levels[0].Queue.push_back({meta.GetPageId(), meta.GetDataSize()});
+            Levels[0].BeginPageId = meta.GetPageId();
+            Levels[0].EndPageId = meta.GetPageId() + 1;
             if (meta.LevelCount) {
                 IndexPageLocator.Add(meta.GetPageId(), GroupId, 0);
             }
@@ -325,6 +329,9 @@ namespace NFwd {
                 return {page, false, true};
             }
 
+            Y_VERIFY_S(level.BeginPageId <= pageId && pageId < level.EndPageId, "Requested page " << pageId << " is out of loaded slice "
+                << BeginRowId << " " << EndRowId << " " << level.BeginPageId << " " << level.EndPageId << " with index " << Part->IndexPages.GetBTree(GroupId).ToString());
+
             DropPagesBefore(level, pageId);
             ShrinkPages(level);
 
@@ -436,8 +443,13 @@ namespace NFwd {
                         if (child.GetRowCount() <= BeginRowId) {
                             continue;
                         }
-                        Y_ABORT_UNLESS(!Levels[levelId + 1].Queue || Levels[levelId + 1].Queue.back().PageId < child.GetPageId());
-                        Levels[levelId + 1].Queue.push_back({child.GetPageId(), child.GetDataSize()});
+                        auto& nextLevel = Levels[levelId + 1];
+                        Y_ABORT_UNLESS(!nextLevel.Queue || nextLevel.Queue.back().PageId < child.GetPageId());
+                        nextLevel.Queue.push_back({child.GetPageId(), child.GetDataSize()});
+                        if (nextLevel.BeginPageId == Max<TPageId>()) {
+                            nextLevel.BeginPageId = child.GetPageId();
+                        }
+                        nextLevel.EndPageId = child.GetPageId() + 1;
                         if (child.GetRowCount() >= EndRowId) {
                             break;
                         }

ydb/core/tablet_flat/flat_page_btree_index.h

@@ -89,6 +89,8 @@ namespace NKikimr::NTable::NPage {
             TRowId RowCount_;
             ui64 DataSize_;
 
+            auto operator<=>(const TShortChild&) const = default;
+
             inline TPageId GetPageId() const noexcept {
                 return PageId_;
             }
@@ -101,7 +103,9 @@ namespace NKikimr::NTable::NPage {
                 return DataSize_;
             }
 
-            auto operator<=>(const TShortChild&) const = default;
+            TString ToString() const {
+                return TStringBuilder() << "PageId: " << GetPageId() << " RowCount: " << GetRowCount() << " DataSize: " << GetDataSize();
+            }
         } Y_PACKED;
 
         static_assert(sizeof(TShortChild) == 20, "Invalid TBtreeIndexNode TShortChild size");

ydb/core/tablet_flat/flat_part_iter.h

@@ -186,6 +186,11 @@ namespace NTable {
                 return EReady::Data;
             }
 
+            if (Page.BaseRow() + Page->Count >= EndRowId) {
+                // Row is outside of bounds
+                return Exhausted();
+            }
+
             if (seek != ESeek::Exact) {
                 // The row we seek is on the next page
 

ydb/core/tablet_flat/test/libs/table/test_envs.h

@@ -304,7 +304,7 @@ namespace NTest {
                 for (ui32 room : xrange(partStore->Store->GetRoomCount())) {
                     if (room < partStore->Store->GetGroupCount()) {
                         NPage::TGroupId groupId(room);
-                        partGroupQueues.push_back(Settle(partStore, room, NFwd::CreateCache(part, PartIndexPageLocator[part], groupId)));
+                        partGroupQueues.push_back(Settle(partStore, room, NFwd::CreateCache(part, PartIndexPageLocator[part], groupId, partStore->Slices)));
                     } else if (room == partStore->Store->GetOuterRoom()) {
                         partGroupQueues.push_back(Settle(partStore, room, MakeOuter(partStore)));
                     } else if (room == partStore->Store->GetExternRoom()) {