-
Type: Bug
-
Resolution: Duplicate
-
Priority: Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
format-stress-sanitizer-smoke-test failed with heap-buffer-overflow error for fixed-length column-store file_type.
Evergreen failed log link
[2020/03/04 12:11:21.046] snapshot-isolation: 23317 search: expected {0x06}, found {0x00} [2020/03/04 12:11:21.046] t: run FAILED [2020/03/04 12:11:21.046] snapshot-isolation error: Dumping page to /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/test/format/RUNDIR.1/pagedump [2020/03/04 12:11:21.046] ================================================================= [2020/03/04 12:11:21.046] ==23839==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000075200 at pc 0x00000053d379 bp 0x7f8b7ca55b60 sp 0x7f8b7ca55b58 [2020/03/04 12:11:21.046] READ of size 1 at 0x625000075200 thread T16 [2020/03/04 12:11:21.046] #0 0x53d378 in __bit_test /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/include/bitstring.i:90:11 [2020/03/04 12:11:21.046] #1 0x53d1a9 in __bit_getv /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/include/bitstring.i:263:7 [2020/03/04 12:11:21.046] #2 0x546c4e in __debug_page_col_fix /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_debug.c:1015:9 [2020/03/04 12:11:21.046] #3 0x5389d4 in __debug_page /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_debug.c:858:13 [2020/03/04 12:11:21.046] #4 0x5386a8 in __wt_debug_page /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_debug.c:684:5 [2020/03/04 12:11:21.046] #5 0x538eba in __wt_debug_cursor_page /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_debug.c:703:13 [2020/03/04 12:11:21.046] #6 0x519ae3 in snap_verify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/snap.c:243:5 [2020/03/04 12:11:21.046] #7 0x51ab57 in snap_repeat_single /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/snap.c:508:15 [2020/03/04 12:11:21.046] #8 0x503880 in ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:655:13 [2020/03/04 12:11:21.046] #9 0x7f8b8aa646da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) [2020/03/04 12:11:21.046] #10 0x7f8b89b9688e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95 [2020/03/04 12:11:21.046] 0x625000075200 is located 0 bytes to the right of 8192-byte region [0x625000073200,0x625000075200) [2020/03/04 12:11:21.046] allocated by thread T0 here: [2020/03/04 12:11:21.046] #0 0x4c45b9 in posix_memalign /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:219:3 [2020/03/04 12:11:21.046] #1 0x7369cb in __wt_realloc_aligned /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_common/os_alloc.c:202:20 [2020/03/04 12:11:21.046] #2 0x871344 in __wt_buf_grow_worker /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/scratch.c:45:13 [2020/03/04 12:11:21.046] #3 0x96ee7f in __wt_buf_grow /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/include/buf.i:17:54 [2020/03/04 12:11:21.046] #4 0x96eb4c in __wt_buf_init /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/include/buf.i:49:13 [2020/03/04 12:11:21.046] #5 0x96c4e3 in __wt_block_read_off /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/block/block_read.c:246:5 [2020/03/04 12:11:21.046] #6 0x96b62f in __wt_bm_read /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/block/block_read.c:99:5 [2020/03/04 12:11:21.046] #7 0x54ed83 in __wt_bt_read /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_io.c:38:9 [2020/03/04 12:11:21.046] #8 0xa3af1d in __page_read /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_read.c:146:5 [2020/03/04 12:11:21.046] #9 0xa38b89 in __wt_page_in_func /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_read.c:266:13 [2020/03/04 12:11:21.046] #10 0xb0874e in __wt_page_swap_func /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/include/btree.i:1685:11 [2020/03/04 12:11:21.046] #11 0xb061b6 in __wt_col_search /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/col_srch.c:187:20 [2020/03/04 12:11:21.046] #12 0x9cd832 in __cursor_col_search /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:367:5 [2020/03/04 12:11:21.046] #13 0x9ce41e in __wt_btcur_search /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:587:9 [2020/03/04 12:11:21.047] #14 0x612e75 in __curfile_search /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/cursor/cur_file.c:200:5 [2020/03/04 12:11:21.047] #15 0x507fc2 in read_op /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/format.i:52:23 [2020/03/04 12:11:21.047] #16 0x50747d in read_row_worker /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:1078:15 [2020/03/04 12:11:21.047] #17 0x506df0 in wts_read_scan /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:1031:23 [2020/03/04 12:11:21.047] #18 0x51d6fe in main /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/t.c:275:9 [2020/03/04 12:11:21.047] #19 0x7f8b89a96b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 [2020/03/04 12:11:21.047] Thread T16 created by T0 here: [2020/03/04 12:11:21.047] #0 0x4ac1fd in pthread_create /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3 [2020/03/04 12:11:21.047] #1 0x7557b5 in __wt_thread_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_posix/os_thread.c:28:5 [2020/03/04 12:11:21.047] #2 0x5013fb in wts_ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:188:9 [2020/03/04 12:11:21.047] #3 0x51d7b6 in main /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/t.c:280:13 [2020/03/04 12:11:21.047] #4 0x7f8b89a96b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 [2020/03/04 12:11:21.047] SUMMARY: AddressSanitizer: heap-buffer-overflow /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/include/bitstring.i:90:11 in __bit_test [2020/03/04 12:11:21.047] Shadow bytes around the buggy address: [2020/03/04 12:11:21.047] 0x0c4a800069f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:11:21.047] 0x0c4a80006a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:11:21.047] 0x0c4a80006a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:11:21.047] 0x0c4a80006a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:11:21.047] 0x0c4a80006a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [2020/03/04 12:11:21.047] =>0x0c4a80006a40:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [2020/03/04 12:11:21.047] 0x0c4a80006a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [2020/03/04 12:11:21.047] 0x0c4a80006a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [2020/03/04 12:11:21.047] 0x0c4a80006a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [2020/03/04 12:11:21.047] 0x0c4a80006a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [2020/03/04 12:11:21.047] 0x0c4a80006a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [2020/03/04 12:11:21.047] Shadow byte legend (one shadow byte represents 8 application bytes): [2020/03/04 12:11:21.047] Addressable: 00 [2020/03/04 12:11:21.047] Partially addressable: 01 02 03 04 05 06 07 [2020/03/04 12:11:21.047] Heap left redzone: fa [2020/03/04 12:11:21.047] Freed heap region: fd [2020/03/04 12:11:21.047] Stack left redzone: f1 [2020/03/04 12:11:21.047] Stack mid redzone: f2 [2020/03/04 12:11:21.047] Stack right redzone: f3 [2020/03/04 12:11:21.047] Stack after return: f5 [2020/03/04 12:11:21.047] Stack use after scope: f8 [2020/03/04 12:11:21.047] Global redzone: f9 [2020/03/04 12:11:21.047] Global init order: f6 [2020/03/04 12:11:21.047] Poisoned by user: f7 [2020/03/04 12:11:21.047] Container overflow: fc [2020/03/04 12:11:21.047] Array cookie: ac [2020/03/04 12:11:21.047] Intra object redzone: bb [2020/03/04 12:11:21.047] ASan internal: fe [2020/03/04 12:11:21.047] Left alloca redzone: ca [2020/03/04 12:11:21.047] Right alloca redzone: cb [2020/03/04 12:11:21.047] Shadow gap: cc
- has to be done after
-
WT-6053 fixed-width column-store macro can step past the end of allocated memory
- Closed