From 74d833ce120a38e6e3c8e1f6fe351a4da54e9ae2 Mon Sep 17 00:00:00 2001 From: Daniel Mai Date: Mon, 18 Oct 2021 14:05:51 -0700 Subject: [PATCH] fix(sort): Only filter out nodes with positive offsets. (#8077) Negative offsets (e.g., offset: -4) can cause panics when sorting. This can happen when the query has the following characteristics: 1. The query is sorting on an indexed predicate 2. The results include nodes that also don't have the sorted predicate 3. A negative offset is used. (panic trace is from v20.11.2-rc1-23-gaf5030a5) panic: runtime error: slice bounds out of range [-4:] goroutine 1762633 [running]: github.com/dgraph-io/dgraph/worker.sortWithIndex(0x1fb12e0, 0xc00906a880, 0xc009068660, 0x0) /ext-go/1/src/github.com/dgraph-io/dgraph/worker/sort.go:330 +0x244d github.com/dgraph-io/dgraph/worker.processSort.func2(0x1fb12e0, 0xc00906a880, 0xc009068660, 0xc0090686c0) /ext-go/1/src/github.com/dgraph-io/dgraph/worker/sort.go:515 +0x3f created by github.com/dgraph-io/dgraph/worker.processSort /ext-go/1/src/github.com/dgraph-io/dgraph/worker/sort.go:514 +0x52a --- worker/sort.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/worker/sort.go b/worker/sort.go index 96da8aebe26..91e392bd579 100644 --- a/worker/sort.go +++ b/worker/sort.go @@ -329,7 +329,9 @@ BUCKETS: // Apply the offset on null nodes, if the nodes with value were not enough. if out[i].offset < len(nullNodes) { - nullNodes = nullNodes[out[i].offset:] + if out[i].offset >= 0 { + nullNodes = nullNodes[out[i].offset:] + } } else { nullNodes = nullNodes[:0] }