DAOS-15276 object: refine sgl valid check

Refine sgl check to avoid segfault for special sgl parameter.
Add a test case for it.

Required-githooks: true

Signed-off-by: Xuezhao Liu <xuezhao.liu@intel.com>

src/object/cli_obj.c

@@ -2216,6 +2216,18 @@ obj_iod_sgl_valid(daos_obj_id_t oid, unsigned int nr, daos_iod_t *iods,
 				return -DER_INVAL;
 			}
 		}
+		if (sgls != NULL && sgls[i].sg_nr > 0) {
+			d_sg_list_t	*sg = &sgls[i];
+			d_iov_t		*iov;
+
+			for (j = 0; j < sg->sg_nr; j++) {
+				iov = sg->sg_iovs + j;
+				if (iov == NULL || (iov->iov_buf_len > 0 && iov->iov_buf == NULL)) {
+					D_ERROR("Bad iov\n");
+					return -DER_INVAL;
+				}
+			}
+		}
 
 		switch (iods[i].iod_type) {
 		default:

src/tests/suite/daos_obj.c

@@ -2431,7 +2431,7 @@ fetch_size(void **state)
 	char		*akey[NUM_AKEYS];
 	const char	*akey_fmt = "akey%d";
 	int		 i, rc;
-	daos_size_t	 size = 131071;
+	daos_size_t	 size = 131071, tmp_sz;
 
 	/** open object */
 	oid = daos_test_oid_gen(arg->coh, dts_obj_class, 0, 0, arg->myrank);
@@ -2480,6 +2480,17 @@ fetch_size(void **state)
 	for (i = 0; i < NUM_AKEYS; i++)
 		assert_int_equal(iod[i].iod_size, size * (i+1));
 
+	print_message("fetch with invalid sgl - NULL sg_iovs with non-zero sg_nr\n");
+	sgl->sg_iovs = NULL;
+	tmp_sz = iod->iod_size;
+	iod->iod_size = 0;
+	rc = daos_obj_fetch(oh, DAOS_TX_NONE, 0, &dkey, NUM_AKEYS, iod, sgl,
+			    NULL, NULL);
+	assert_rc_equal(rc, -DER_INVAL);
+
+	iod->iod_size = tmp_sz;
+	for (i = 0; i < NUM_AKEYS; i++)
+		sgl[i].sg_iovs		= &sg_iov[i];
 	print_message("fetch with unknown iod_size and less buffer\n");
 	for (i = 0; i < NUM_AKEYS; i++) {
 		d_iov_set(&sg_iov[i], buf[i], size * (i+1) - 1);