CouchKVStore invalid read when reading 3.x data

This issue could manifest itself as a segfault during upgrade from 3 to 4

KV-engine metadata has the following 3 evolutions.

epoch (version 0)

struct metadata {

  uint64 cas;

  uint32 expiry;

  uint32 flags;

}

version 1

struct metadata {

  uint64 cas;

  uint32 expiry;

  uint32 flags;

  uint8 ext1;

  uint8 ext2;

}

version 2

struct metadata {

  uint64 cas;

  uint32 expiry;

  uint32 flags;

  uint8 ext1;

  uint8 ext2;

  uint8 conflict_resolution_mode;

}

• 3.x code writes out the version 1 structure (18 bytes of meta)
  • http://src.couchbase.org/source/xref/3.x/ep-engine/src/couch-kvstore/couch-kvstore.cc#1475 (look at fetchDoc)
• 4.x code reads version 0 or version 2 (19 bytes) without checking the length is 19 bytes (i.e. checks only for > 16).
  • http://src.couchbase.org/source/xref/4.0.0/ep-engine/src/couch-kvstore/couch-kvstore.cc#1559

This was discovered when error injecting in unit-tests on the master/watson branch and shows up in valgrind as an invalid read of 1 byte.

(details of test to be uploaded).