Take care with __wt_buf_grow if the data field may be an offset into the buffer.

4 files changed, 42 insertions, 42 deletions

diff --git a/src/btree/bt_page.c b/src/btree/bt_page.c
index 5a0c17dcf5f..cd74e3cdc87 100644
--- a/src/btree/bt_page.c
+++ b/src/btree/bt_page.c
@@ -399,13 +399,13 @@ __inmem_row_int(WT_SESSION_IMPL *session, WT_PAGE *page, size_t *inmem_sizep)
 
 		/*
 		 * If Huffman decoding is required or it's an overflow record,
-		 * use the heavy-weight __wt_cell_unpack_copy() call to build
-		 * the key.  Else, we can do it faster internally as we don't
-		 * have to shuffle memory around as much.
+		 * unpack the cell to build the key, then resolve the prefix.
+		 * Else, we can do it faster internally as we don't have to
+		 * shuffle memory around as much.
 		 */
 		prefix = unpack->prefix;
 		if (huffman != NULL || unpack->ovfl) {
-			WT_ERR(__wt_cell_unpack_copy(session, unpack, current));
+			WT_ERR(__wt_cell_unpack_ref(session, unpack, current));
 
 			/*
 			 * If there's a prefix, make sure there's enough buffer
@@ -415,10 +415,10 @@ __inmem_row_int(WT_SESSION_IMPL *session, WT_PAGE *page, size_t *inmem_sizep)
 			if (prefix != 0) {
 				WT_ERR(__wt_buf_grow(
 				    session, current, prefix + current->size));
-				memmove((uint8_t *)current->data +
-				    prefix, current->data, current->size);
-				memcpy(
-				    (void *)current->data, last->data, prefix);
+				memmove((uint8_t *)current->mem + prefix,
+				    current->data, current->size);
+				memcpy(current->mem, last->data, prefix);
+				current->data = current->mem;
 				current->size += prefix;
 			}
 		} else {
@@ -426,15 +426,14 @@ __inmem_row_int(WT_SESSION_IMPL *session, WT_PAGE *page, size_t *inmem_sizep)
 			 * Get the cell's data/length and make sure we have
 			 * enough buffer space.
 			 */
-			WT_ERR(__wt_buf_grow(
+			WT_ERR(__wt_buf_init(
 			    session, current, prefix + unpack->size));
 
 			/* Copy the prefix then the data into place. */
 			if (prefix != 0)
-				memcpy((void *)
-				    current->data, last->data, prefix);
-			memcpy((uint8_t *)
-			    current->data + prefix, unpack->data, unpack->size);
+				memcpy(current->mem, last->data, prefix);
+			memcpy((uint8_t *)current->mem + prefix, unpack->data,
+			    unpack->size);
 			current->size = prefix + unpack->size;
 		}
 
diff --git a/src/btree/bt_vrfy_dsk.c b/src/btree/bt_vrfy_dsk.c
index 7f1ad32dc2c..f0ffa207a0a 100644
--- a/src/btree/bt_vrfy_dsk.c
+++ b/src/btree/bt_vrfy_dsk.c
@@ -239,7 +239,7 @@ __verify_dsk_row(
 		case WT_CELL_KEY:
 			break;
 		case WT_CELL_KEY_OVFL:
-			WT_ERR(__wt_cell_unpack_copy(session, unpack, current));
+			WT_ERR(__wt_cell_unpack_ref(session, unpack, current));
 			goto key_compare;
 		default:
 			/* Not a key -- continue with the next cell. */
@@ -270,43 +270,43 @@ __verify_dsk_row(
 			    cell_num, addr, prefix, last->size);
 
 		/*
-		 * If Huffman decoding required, use the heavy-weight call to
-		 * __wt_cell_unpack_copy() to build the key, up to the prefix.
-		 * Else, we can do it faster internally because we don't have
-		 * to shuffle memory around as much.
+		 * If Huffman decoding required, unpack the cell to build the
+		 * key, then resolve the prefix.  Else, we can do it faster
+		 * internally because we don't have to shuffle memory around as
+		 * much.
 		 */
-		if (huffman == NULL) {
-			/*
-			 * Get the cell's data/length and make sure we have
-			 * enough buffer space.
-			 */
-			WT_ERR(__wt_buf_grow(
-			    session, current, prefix + unpack->size));
-
-			/* Copy the prefix then the data into place. */
-			if (prefix != 0)
-				memcpy((void *)
-				    current->data, last->data, prefix);
-			memcpy((uint8_t *)
-			    current->data + prefix, unpack->data, unpack->size);
-			current->size = prefix + unpack->size;
-		} else {
-			WT_ERR(__wt_cell_unpack_copy(session, unpack, current));
+		if (huffman != NULL) {
+			WT_ERR(__wt_cell_unpack_ref(session, unpack, current));
 
 			/*
 			 * If there's a prefix, make sure there's enough buffer
 			 * space, then shift the decoded data past the prefix
-			 * and copy the prefix into place.
+			 * and copy the prefix into place.  Take care with the
+			 * pointers: current->data may be pointing inside the
 			 */
 			if (prefix != 0) {
 				WT_ERR(__wt_buf_grow(
 				    session, current, prefix + current->size));
-				memmove((uint8_t *)current->data +
-				    prefix, current->data, current->size);
-				memcpy(
-				    (void *)current->data, last->data, prefix);
+				memmove((uint8_t *)current->mem + prefix,
+				    current->data, current->size);
+				memcpy(current->mem, last->data, prefix);
+				current->data = current->mem;
 				current->size += prefix;
 			}
+		} else {
+			/*
+			 * Get the cell's data/length and make sure we have
+			 * enough buffer space.
+			 */
+			WT_ERR(__wt_buf_init(
+			    session, current, prefix + unpack->size));
+
+			/* Copy the prefix then the data into place. */
+			if (prefix != 0)
+				memcpy(current->mem, last->data, prefix);
+			memcpy((uint8_t *)current->mem + prefix, unpack->data,
+			    unpack->size);
+			current->size = prefix + unpack->size;
 		}
 
 key_compare:	/*
diff --git a/src/support/scratch.c b/src/support/scratch.c
index f9cff2d0343..d0cbc6af9ac 100644
--- a/src/support/scratch.c
+++ b/src/support/scratch.c
@@ -49,6 +49,7 @@ __wt_buf_grow(WT_SESSION_IMPL *session, WT_ITEM *buf, size_t size)
 		} else if (buf->data >= buf->mem &&
 		    (uint8_t *)buf->data < (uint8_t *)buf->mem + buf->memsize) {
 			offset = WT_PTRDIFF(buf->data, buf->mem);
+			WT_ASSERT(session, offset == 0);
 			set_data = 1;
 		} else {
 			offset = 0;
@@ -75,8 +76,8 @@ __wt_buf_grow(WT_SESSION_IMPL *session, WT_ITEM *buf, size_t size)
 int
 __wt_buf_init(WT_SESSION_IMPL *session, WT_ITEM *buf, size_t size)
 {
-	WT_RET(__wt_buf_grow(session, buf, size));
 	buf->data = buf->mem;
+	WT_RET(__wt_buf_grow(session, buf, size));
 	buf->size = 0;
 
 	return (0);
diff --git a/test/suite/test_base05.py b/test/suite/test_base05.py
index e4a9ad97bb7..31ba8381e38 100644
--- a/test/suite/test_base05.py
+++ b/test/suite/test_base05.py
@@ -158,7 +158,7 @@ class test_base05(wttest.WiredTigerTestCase):
         create_args = 'key_format=S,value_format=S,' + self.config_string()
         self.session_create("table:" + self.table_name1, create_args)
         self.pr('creating cursor')
-        cursor = self.session.open_cursor('table:' + self.table_name1, None, None)
+        cursor = self.session.open_cursor('table:' + self.table_name1)
         numbers = {}
         for i in range(0, self.nentries):
             numbers[i] = i