Fix key verification in sequential access.

This fixes https://oss-fuzz.com/testcase-detail/6317999997452288
and improves 4046a0af.

* src/bucket.c (gdbm_dir_entry_valid_p): Move to proto.
* src/proto.h (gdbm_dir_entry_valid_p): New inline function.
* src/gdbmseq.c (gdbm_valid_key_p): Use gdbm_dir_entry_valid_p to
validate the buffer index.  Reorder the checks.

1 files changed, 16 insertions, 0 deletions

diff --git a/src/proto.h b/src/proto.h
index 56e7daa..a5d6d10 100644
--- a/src/proto.h
+++ b/src/proto.h
@@ -28,6 +28,22 @@ int _gdbm_cache_init   (GDBM_FILE, size_t);
 void _gdbm_cache_free  (GDBM_FILE dbf);
 int _gdbm_cache_flush  (GDBM_FILE dbf);
 
+/* Return true if the directory entry at DIR_INDEX can be considered
+   valid. This means that DIR_INDEX is in the valid range for addressing
+   the dir array, and the offset stored in dir[DIR_INDEX] points past
+   first two blocks in file. This does not necessarily mean that there's
+   a valid bucket or data block at that offset. All this implies is that
+   it is safe to use the offset for look up in the bucket cache and to
+   attempt to read a block at that offset. */
+static inline int
+gdbm_dir_entry_valid_p (GDBM_FILE dbf, int dir_index)
+{
+  return dir_index >= 0
+         && dir_index < GDBM_DIR_COUNT (dbf)
+         && dbf->dir[dir_index] >= dbf->header->block_size;
+}
+
+
 /* From falloc.c */
 off_t _gdbm_alloc       (GDBM_FILE, int);
 int  _gdbm_free         (GDBM_FILE, off_t, int);