[LUCENE-10678] computing the partition point on a BKD tree merge can overflow

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.11.3, 9.4, 9.3.1
• Lucene Fields: New
• Assignee: Ignacio Vera
• Reporter: Ignacio Vera
• Created: 10/Aug/22 14:01
• Updated: 28/Aug/22 16:44
• Resolved: 11/Aug/22 13:49

Description

I just discover a bad bug in the BKD tree when doing merges. Before calling the BKDTreeRadix selector we need to compute the partition point which is dome multiplying two integers. If the partition point is > Integer.MAX_VALUE then it will overflow.

https://github.com/apache/lucene/blob/35ca2d79f73c6dfaf5e648fe241f7e0b37084a90/lucene/core/src/java/org/apache/lucene/util/bkd/BKDWriter.java#L2021

 

Issue Links

• links to: GitHub Pull Request #1065
• links to: GitHub Pull Request #2668