stack-buffer-overflow PaLite

XMLWordPrintableJSON

    • Storage Engines, Storage Engines - Persistence
    • None
    • None

      As reproduced in a patch build, the following test test_layered34 running under ASan detects a stack-buffer-overflow:

        [2025/10/15 13:04:56.598] [pid:15896]: test_layered34.test_layered34.test_layered34 -s 0 (palite.shared): starting
       [2025/10/15 13:04:56.731] =================================================================
       [2025/10/15 13:04:56.731] ==15896==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fc6d192cc60 at pc 0x7fc6ce325503 bp 0x7ffebe2c7bd0 sp 0x7ffebe2c7bc8
       [2025/10/15 13:04:56.732] WRITE of size 8 at 0x7fc6d192cc60 thread T0
       [2025/10/15 13:04:57.626]     #0 0x7fc6ce325502 in Palite::get_last_lsn(unsigned long*) /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/ext/page_log/palite/palite.cpp:1588:14
       [2025/10/15 13:04:57.626]     #1 0x7fc6ce325841 in int std::__invoke_impl<int, int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&>(std::__invoke_memfun_deref, int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&) /opt/mongodbtoolchain/revisions/8695910c32ef0ee5eecaae4c9ca515b4b6436a40/stow/gcc-v5.bbK/lib/gcc/x86_64-mongodb-linux/14.2.0/../../../../include/c++/14.2.0/bits/invoke.h:74:14
       [2025/10/15 13:04:57.626]     #2 0x7fc6ce325744 in std::__invoke_result<int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&>::type std::__invoke<int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&>(int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&) /opt/mongodbtoolchain/revisions/8695910c32ef0ee5eecaae4c9ca515b4b6436a40/stow/gcc-v5.bbK/lib/gcc/x86_64-mongodb-linux/14.2.0/../../../../include/c++/14.2.0/bits/invoke.h:96:14
       [2025/10/15 13:04:57.627]     #3 0x7fc6ce325714 in std::invoke_result<int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&>::type std::invoke<int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&>(int (Palite::*&)(unsigned long*), Palite*&, unsigned long*&) /opt/mongodbtoolchain/revisions/8695910c32ef0ee5eecaae4c9ca515b4b6436a40/stow/gcc-v5.bbK/lib/gcc/x86_64-mongodb-linux/14.2.0/../../../../include/c++/14.2.0/functional:120:14
       [2025/10/15 13:04:57.627]     #4 0x7fc6ce2a51c1 in int safe_call<Palite, __wt_page_log, int (Palite::*)(unsigned long*), unsigned long*&>(__wt_session*, __wt_page_log*, int (Palite::*)(unsigned long*), unsigned long*&) /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/ext/page_log/palite/palite.cpp:349:16
       [2025/10/15 13:04:57.627]     #5 0x7fc6ce299108 in palite_get_last_lsn(__wt_page_log*, __wt_session*, unsigned long*) /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/ext/page_log/palite/palite.cpp:1671:12
       [2025/10/15 13:04:57.627]     #6 0x7fc6d1187aba in __wt_page_log__pl_get_last_lsn /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/cmake_build/lang/python/CMakeFiles/wiredtiger_python.dir/wiredtigerPYTHON_wrap.c:3518:17
       [2025/10/15 13:04:57.627]     #7 0x7fc6d1178521 in _wrap_PageLog_pl_get_last_lsn /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/cmake_build/lang/python/CMakeFiles/wiredtiger_python.dir/wiredtigerPYTHON_wrap.c:12136:21
       [2025/10/15 13:04:57.627]     #8 0x7fc6d4459a57 in cfunction_call /data/mci/1b391b9780c023d7257c454d049e7285/toolchain-builder/tmp/build-python-v4.sh-7l8/build-Python-3.10.4/../src/Python-3.10.4/Objects/methodobject.c:552:18
       [2025/10/15 13:04:57.628] Address 0x7fc6d192cc60 is located in stack of thread T0 at offset 96 in frame
       [2025/10/15 13:04:57.628]     #0 0x7fc6d117825f in _wrap_PageLog_pl_get_last_lsn /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/cmake_build/lang/python/CMakeFiles/wiredtiger_python.dir/wiredtigerPYTHON_wrap.c:12107
       [2025/10/15 13:04:57.628]   This frame has 4 object(s):
       [2025/10/15 13:04:57.628]     [32, 40) 'argp1' (line 12112)
       [2025/10/15 13:04:57.628]     [64, 72) 'argp2' (line 12114)
       [2025/10/15 13:04:57.628]     [96, 100) 'temp3' (line 12116) <== Memory access at offset 96 partially overflows this variable
       [2025/10/15 13:04:57.628]     [112, 128) 'swig_obj' (line 12118)
       [2025/10/15 13:04:57.628] HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
       [2025/10/15 13:04:57.628]       (longjmp and C++ exceptions *are* supported)
       [2025/10/15 13:04:57.628] SUMMARY: AddressSanitizer: stack-buffer-overflow /data/mci/69afa71c43b4ae4581ccfcd0c2886653/wiredtiger/ext/page_log/palite/palite.cpp:1588:14 in Palite::get_last_lsn(unsigned long*)
       [2025/10/15 13:04:57.628] Shadow bytes around the buggy address:
       [2025/10/15 13:04:57.629]   0x7fc6d192c980: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192ca00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192ca80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192cb00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192cb80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629] =>0x7fc6d192cc00: f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2[04]f2 00 00
       [2025/10/15 13:04:57.629]   0x7fc6d192cc80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
       [2025/10/15 13:04:57.629]   0x7fc6d192cd00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192cd80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192ce00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629]   0x7fc6d192ce80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
       [2025/10/15 13:04:57.629] Shadow byte legend (one shadow byte represents 8 application bytes):
       [2025/10/15 13:04:57.629]   Addressable:           00
       [2025/10/15 13:04:57.629]   Partially addressable: 01 02 03 04 05 06 07
       [2025/10/15 13:04:57.629]   Heap left redzone:       fa
       [2025/10/15 13:04:57.629]   Freed heap region:       fd
       [2025/10/15 13:04:57.629]   Stack left redzone:      f1
       [2025/10/15 13:04:57.629]   Stack mid redzone:       f2
       [2025/10/15 13:04:57.629]   Stack right redzone:     f3
       [2025/10/15 13:04:57.629]   Stack after return:      f5
       [2025/10/15 13:04:57.629]   Stack use after scope:   f8
       [2025/10/15 13:04:57.629]   Global redzone:          f9
       [2025/10/15 13:04:57.629]   Global init order:       f6
       [2025/10/15 13:04:57.629]   Poisoned by user:        f7
       [2025/10/15 13:04:57.629]   Container overflow:      fc
       [2025/10/15 13:04:57.629]   Array cookie:            ac
       [2025/10/15 13:04:57.629]   Intra object redzone:    bb
       [2025/10/15 13:04:57.629]   ASan internal:           fe
       [2025/10/15 13:04:57.629]   Left alloca redzone:     ca
       [2025/10/15 13:04:57.629]   Right alloca redzone:    cb
       [2025/10/15 13:04:57.629] ==15896==ABORTING

      We should fix this asap as it will block the merge of WT-15513.

            Assignee:
            Luke Pearson
            Reporter:
            Luke Pearson
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: