Unchecked Vector Access in Cluster Slot Migration

Location: src/server/cluster/cluster_family.cc:1017-1051, src/server/cluster/incoming_slot_migration.cc:306-307 Classification: Remote Memory Corruption / Out-of-Bounds Vector Dereference

Analysis

In ClusterFamily::DflyMigrateFlow:

auto [source_id, shard_id] = parser.Next<std::string_view, uint32_t>();
...
migration->StartFlow(shard_id, conn_cntx->conn()->socket());

Inside IncomingSlotMigration::StartFlow:

void IncomingSlotMigration::StartFlow(uint32_t shard, util::FiberSocketBase* source) {
  shard_flows_[shard]->Start(&cntx_, source);
  ...
}

The vector shard_flows_ is allocated with shards_num elements (shard_flows_.resize(shards_num)). The incoming shard_id argument parsed from the network protocol is passed directly as shard without validating that shard < shard_flows_.size().

Impact

An attacker with access to the cluster port (or during cluster rebalancing) can send:

DFLYMIGRATE FLOW <valid_source_node_id> 99999999

shard_flows_[shard] reads memory beyond the vector bounds. In release builds, this causes an immediate segmentation fault (SIGSEGV) when calling ->Start(), crashing the Dragonfly node.

Remediation

Add boundary validation before accessing shard_flows_:

if (shard >= shard_flows_.size()) {
  return; // or report error
}