-
Type: Bug
-
Resolution: Duplicate
-
Priority: Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
None
The Jenkins job http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer-old-branches/2533/console failed on a row-store configuration with a stack buffer overflow.
================================================================= ==7036==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f242acee200 at pc 0x00000064af16 bp 0x7f242acecdb0 sp 0x7f242acecda8 WRITE of size 8 at 0x7f242acee200 thread T11 #0 0x64af15 in __wt_struct_unpackv /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/include/packing.i:706:9 #1 0x643836 in __wt_cursor_get_keyv /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/cursor/cur_std.c:400:19 #2 0x641556 in __wt_cursor_get_key /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/cursor/cur_std.c:268:11 #3 0x4fa634 in copy_blocks /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/backup.c:274:9 #4 0x4f7f5c in backup /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/backup.c:612:21 #5 0x7f243470b6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) #6 0x7f243383da3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Address 0x7f242acee200 is located in stack of thread T11 at offset 128 in frame #0 0x4fa04f in copy_blocks /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/backup.c:243 This frame has 6 object(s): [32, 40) 'incr_cur' (line 244) [64, 72) 'offset' (line 247) [96, 104) 'type' (line 247) [128, 132) 'size' (line 248) <== Memory access at offset 128 partially overflows this variable [144, 656) 'buf' (line 250) [720, 1232) 'config' (line 250)
The stack from gdb looks like:
Thread 1 (Thread 0x7f242acef700 (LWP 7064)): ---Type <return> to continue, or q <return> to quit--- #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f243375c8b1 in __GI_abort () at abort.c:79 #2 0x00000000004e53d7 in __sanitizer::Abort() () #3 0x00000000004e3da1 in __sanitizer::Die() () #4 0x00000000004cbe59 in __asan::ScopedInErrorReport::~ScopedInErrorReport() () #5 0x00000000004cd643 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) () #6 0x00000000004ce26b in __asan_report_store8 () #7 0x000000000064af16 in __wt_struct_unpackv (session=0x7f2434da2cf0, buffer=0x602000013f90, size=4, fmt=0xd2e740 <.str.1> "qqq", ap=0x7f242acedf20) at ../src/include/packing.i:706 #8 0x0000000000643837 in __wt_cursor_get_keyv (cursor=0x615000030500, flags=12800, ap=0x7f242acedf20) at ../src/cursor/cur_std.c:400 #9 0x0000000000641557 in __wt_cursor_get_key (cursor=0x615000030500) at ../src/cursor/cur_std.c:268 #10 0x00000000004fa635 in copy_blocks (session=0x7f2434da2cf0, bkup_c=0x615000030280, name=0x602000012dd0 "wt.wt") at ../../../test/format/backup.c:274 #11 0x00000000004f7f5d in backup (arg=0x0) at ../../../test/format/backup.c:612 #12 0x00007f243470b6db in start_thread (arg=0x7f242acef700) at pthread_create.c:463 #13 0x00007f243383da3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
- is duplicated by
-
WT-6160 Fix format failure caused by stack overwrite
- Closed