- 
    Type:Bug 
- 
    Resolution: Duplicate
- 
    Priority:Major - P3 
- 
    None
- 
    Affects Version/s: None
- 
    Component/s: None
- 
    None
- 
        None
- 
        None
The Jenkins job http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer-old-branches/2533/console failed on a row-store configuration with a stack buffer overflow.
=================================================================
==7036==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f242acee200 at pc 0x00000064af16 bp 0x7f242acecdb0 sp 0x7f242acecda8
WRITE of size 8 at 0x7f242acee200 thread T11
    #0 0x64af15 in __wt_struct_unpackv /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/include/packing.i:706:9
    #1 0x643836 in __wt_cursor_get_keyv /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/cursor/cur_std.c:400:19
    #2 0x641556 in __wt_cursor_get_key /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/cursor/cur_std.c:268:11
    #3 0x4fa634 in copy_blocks /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/backup.c:274:9
    #4 0x4f7f5c in backup /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/backup.c:612:21
    #5 0x7f243470b6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #6 0x7f243383da3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Address 0x7f242acee200 is located in stack of thread T11 at offset 128 in frame
    #0 0x4fa04f in copy_blocks /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/backup.c:243
  This frame has 6 object(s):
    [32, 40) 'incr_cur' (line 244)
    [64, 72) 'offset' (line 247)
    [96, 104) 'type' (line 247)
    [128, 132) 'size' (line 248) <== Memory access at offset 128 partially overflows this variable
    [144, 656) 'buf' (line 250)
    [720, 1232) 'config' (line 250)
The stack from gdb looks like:
Thread 1 (Thread 0x7f242acef700 (LWP 7064)):
---Type <return> to continue, or q <return> to quit---
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007f243375c8b1 in __GI_abort () at abort.c:79
#2  0x00000000004e53d7 in __sanitizer::Abort() ()
#3  0x00000000004e3da1 in __sanitizer::Die() ()
#4  0x00000000004cbe59 in __asan::ScopedInErrorReport::~ScopedInErrorReport()
    ()
#5  0x00000000004cd643 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) ()
#6  0x00000000004ce26b in __asan_report_store8 ()
#7  0x000000000064af16 in __wt_struct_unpackv (session=0x7f2434da2cf0, 
    buffer=0x602000013f90, size=4, fmt=0xd2e740 <.str.1> "qqq", 
    ap=0x7f242acedf20) at ../src/include/packing.i:706
#8  0x0000000000643837 in __wt_cursor_get_keyv (cursor=0x615000030500, 
    flags=12800, ap=0x7f242acedf20) at ../src/cursor/cur_std.c:400
#9  0x0000000000641557 in __wt_cursor_get_key (cursor=0x615000030500)
    at ../src/cursor/cur_std.c:268
#10 0x00000000004fa635 in copy_blocks (session=0x7f2434da2cf0, 
    bkup_c=0x615000030280, name=0x602000012dd0 "wt.wt")
    at ../../../test/format/backup.c:274
#11 0x00000000004f7f5d in backup (arg=0x0) at ../../../test/format/backup.c:612
#12 0x00007f243470b6db in start_thread (arg=0x7f242acef700)
    at pthread_create.c:463
#13 0x00007f243383da3f in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
- is duplicated by
- 
                    WT-6160 Fix format failure caused by stack overwrite -         
- Closed
 
-