4paradigm / 4paradigm/OpenMLDB
Sanitizer: Container-Overflow on `TypeNode`'s `generics_nullable_({false}) `
- Langage dominant
- C++
- Étoiles
- 1.7k
- Forks
- 331
- Merge moyen
- 12 j 12 h
- PR mergées (30 j)
- 1
Description
Issue tracker is **ONLY** used for reporting bugs. New features should be discussed on our discussion
## Expected Behavior
## Current Behavior
Env: MacOS 11.
***Note: Sanitizer on Linux runs fine***
Commands:
```bash
cmake -H. -Bbuild -DCMAKE_BUILD_TYPE=Debug -DSANITIZER_ENABLE=ON
cmake --build build --target ast_node_converter_test
./build/src/planv2/ast_node_converter_test
```
Output:
```bash
=================================================================
==99239==ERROR: AddressSanitizer: container-overflow on address 0x602000000610 at pc 0x000122efe533 bp 0x7ffee1d40a60 sp 0x7ffee1d40228
WRITE of size 4 at 0x602000000610 thread T0
#0 0x122efe532 in __asan_memcpy+0x262 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x42532)
#1 0x111b0445a in std::__1::enable_if<((is_trivially_copy_constructible::value) && (is_same::value)) && ((std::__1::integral_constant::value) || (!(__has_construct, int*, bool&>::value))), void>::type std::__1::allocator_traits >::__construct_range_forward(std::__1::allocator&, bool*, bool*, int*&) memory:1498
#2 0x111b03cc8 in std::__1::enable_if<__is_cpp17_forward_iterator::value, void>::type std::__1::vector >::__construct_at_end(int const*, int const*, unsigned long) vector:1080
#3 0x111b0364f in std::__1::vector >::vector(std::initializer_list) vector:1338
#4 0x111b0341e in std::__1::vector >::vector(std::initializer_list) vector:1331
#5 0x111b030ac in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#6 0x111adacc2 in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#7 0x111adac51 in hybridse::node::NodeManager::MakeTypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) node_manager.cc:832
#8 0x1119d4e81 in hybridse::udf::RegisterNativeUdfToModule(hybridse::node::NodeManager*) udf.cc:896
#9 0x1110da6a0 in hybridse::udf::DefaultUdfLibrary::Init() default_udf_library.cc:1725
#10 0x1110e6c31 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#11 0x1110b4594 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#12 0x1119c640f in __cxx_global_var_init.4 default_udf_library.cc:44
#13 0x1119c64ae in _GLOBAL__sub_I_default_udf_library.cc default_udf_library.cc
#14 0x12deb9b46 in ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&)+0x216 (dyld:x86_64+0x1db46)
#15 0x12deb9f51 in ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)+0x27 (dyld:x86_64+0x1df51)
#16 0x12deb4ae5 in ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0x1eb (dyld:x86_64+0x18ae5)
#17 0x12deb289e in ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0xbe (dyld:x86_64+0x1689e)
#18 0x12deb293f in ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&)+0x51 (dyld:x86_64+0x1693f)
#19 0x12de9e8b0 in dyld::initializeMainExecutable()+0xc6 (dyld:x86_64+0x28b0)
#20 0x12dea5040 in dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*)+0x2389 (dyld:x86_64+0x9040)
#21 0x12de9d223 in dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*)+0x1c1 (dyld:x86_64+0x1223)
#22 0x12de9d024 in _dyld_start+0x24 (dyld:x86_64+0x1024)
0x602000000610 is located 0 bytes inside of 4-byte region [0x602000000610,0x602000000614)
allocated by thread T0 here:
#0 0x122f0c95d in wrap__Znwm+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5095d)
#1 0x111ae327c in std::__1::__libcpp_allocate(unsigned long, unsigned long) new:253
#2 0x111b04216 in std::__1::allocator::allocate(unsigned long) memory:1664
#3 0x111b0400c in std::__1::allocator_traits >::allocate(std::__1::allocator&, unsigned long) memory:1400
#4 0x111b03a57 in std::__1::vector >::__vallocate(unsigned long) vector:996
#5 0x111b03613 in std::__1::vector >::vector(std::initializer_list) vector:1337
#6 0x111b0341e in std::__1::vector >::vector(std::initializer_list) vector:1331
#7 0x111b030ac in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#8 0x111adacc2 in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#9 0x111adac51 in hybridse::node::NodeManager::MakeTypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) node_manager.cc:832
#10 0x1119d4e81 in hybridse::udf::RegisterNativeUdfToModule(hybridse::node::NodeManager*) udf.cc:896
#11 0x1110da6a0 in hybridse::udf::DefaultUdfLibrary::Init() default_udf_library.cc:1725
#12 0x1110e6c31 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#13 0x1110b4594 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#14 0x1119c640f in __cxx_global_var_init.4 default_udf_library.cc:44
#15 0x1119c64ae in _GLOBAL__sub_I_default_udf_library.cc default_udf_library.cc
#16 0x12deb9b46 in ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&)+0x216 (dyld:x86_64+0x1db46)
#17 0x12deb9f51 in ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)+0x27 (dyld:x86_64+0x1df51)
#18 0x12deb4ae5 in ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0x1eb (dyld:x86_64+0x18ae5)
#19 0x12deb289e in ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0xbe (dyld:x86_64+0x1689e)
#20 0x12deb293f in ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&)+0x51 (dyld:x86_64+0x1693f)
#21 0x12de9e8b0 in dyld::initializeMainExecutable()+0xc6 (dyld:x86_64+0x28b0)
#22 0x12dea5040 in dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*)+0x2389 (dyld:x86_64+0x9040)
#23 0x12de9d223 in dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*)+0x1c1 (dyld:x86_64+0x1223)
#24 0x12de9d024 in _dyld_start+0x24 (dyld:x86_64+0x1024)
HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_container_overflow=0.
If you suspect a false positive see also: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow.
SUMMARY: AddressSanitizer: container-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x42532) in __asan_memcpy+0x262
Shadow bytes around the buggy address:
0x1c0400000070: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x1c0400000080: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x1c0400000090: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x1c04000000a0: fa fa 00 fa fa fa fd fa fa fa 00 fa fa fa 00 00
0x1c04000000b0: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa 00 fa
=>0x1c04000000c0: fa fa[fc]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c04000000d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c04000000e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c04000000f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400000100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400000110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==99239==ABORTING
fish: Job 1, './src/planv2/ast_node_converter…' terminated by signal SIGABRT (Abort)
```
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
The stack trace points to a container-overflow in TypeNode's constructor at type_node.h:40, involving a vector of ints. Start by examining the TypeNode class in type_node.h and the NodeManager::MakeTypeNode method in node_manager.cc:832. The issue is specific to macOS with sanitizers enabled; compare the Linux build to understand the difference. Run the failing test ast_node_converter_test with ASAN to reproduce, then debug the vector initialization in the TypeNode constructor.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- cmake, cpp
- Domaine
- compilers
- Type d'issue
- Bug
- Difficulté
- 4/5
- Temps estimé
- 3-5 jours
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 30/100