4paradigm / 4paradigm/OpenMLDB

Sanitizer: Container-Overflow on `TypeNode`'s `generics_nullable_({false}) `

Đang mở
#581 1 bình luận 0 reaction 1 người được giao Được giao cho @aceforeverd Xem trên GitHub
bug
Ngôn ngữ chính
C++
Star
1.7k
Fork
331
Merge trung bình
12 ngày 12 giờ
Pull request đã merge (30 ngày)
1

Mô tả

Issue tracker is **ONLY** used for reporting bugs. New features should be discussed on our discussion

## Expected Behavior

## Current Behavior

Env: MacOS 11.
***Note: Sanitizer on Linux runs fine***

Commands:
```bash
cmake -H. -Bbuild -DCMAKE_BUILD_TYPE=Debug -DSANITIZER_ENABLE=ON
cmake --build build --target ast_node_converter_test
./build/src/planv2/ast_node_converter_test
```

Output:
```bash
=================================================================
==99239==ERROR: AddressSanitizer: container-overflow on address 0x602000000610 at pc 0x000122efe533 bp 0x7ffee1d40a60 sp 0x7ffee1d40228
WRITE of size 4 at 0x602000000610 thread T0
#0 0x122efe532 in __asan_memcpy+0x262 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x42532)
#1 0x111b0445a in std::__1::enable_if<((is_trivially_copy_constructible::value) && (is_same::value)) && ((std::__1::integral_constant::value) || (!(__has_construct, int*, bool&>::value))), void>::type std::__1::allocator_traits >::__construct_range_forward(std::__1::allocator&, bool*, bool*, int*&) memory:1498
#2 0x111b03cc8 in std::__1::enable_if<__is_cpp17_forward_iterator::value, void>::type std::__1::vector >::__construct_at_end(int const*, int const*, unsigned long) vector:1080
#3 0x111b0364f in std::__1::vector >::vector(std::initializer_list) vector:1338
#4 0x111b0341e in std::__1::vector >::vector(std::initializer_list) vector:1331
#5 0x111b030ac in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#6 0x111adacc2 in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#7 0x111adac51 in hybridse::node::NodeManager::MakeTypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) node_manager.cc:832
#8 0x1119d4e81 in hybridse::udf::RegisterNativeUdfToModule(hybridse::node::NodeManager*) udf.cc:896
#9 0x1110da6a0 in hybridse::udf::DefaultUdfLibrary::Init() default_udf_library.cc:1725
#10 0x1110e6c31 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#11 0x1110b4594 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#12 0x1119c640f in __cxx_global_var_init.4 default_udf_library.cc:44
#13 0x1119c64ae in _GLOBAL__sub_I_default_udf_library.cc default_udf_library.cc
#14 0x12deb9b46 in ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&)+0x216 (dyld:x86_64+0x1db46)
#15 0x12deb9f51 in ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)+0x27 (dyld:x86_64+0x1df51)
#16 0x12deb4ae5 in ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0x1eb (dyld:x86_64+0x18ae5)
#17 0x12deb289e in ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0xbe (dyld:x86_64+0x1689e)
#18 0x12deb293f in ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&)+0x51 (dyld:x86_64+0x1693f)
#19 0x12de9e8b0 in dyld::initializeMainExecutable()+0xc6 (dyld:x86_64+0x28b0)
#20 0x12dea5040 in dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*)+0x2389 (dyld:x86_64+0x9040)
#21 0x12de9d223 in dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*)+0x1c1 (dyld:x86_64+0x1223)
#22 0x12de9d024 in _dyld_start+0x24 (dyld:x86_64+0x1024)

0x602000000610 is located 0 bytes inside of 4-byte region [0x602000000610,0x602000000614)
allocated by thread T0 here:
#0 0x122f0c95d in wrap__Znwm+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5095d)
#1 0x111ae327c in std::__1::__libcpp_allocate(unsigned long, unsigned long) new:253
#2 0x111b04216 in std::__1::allocator::allocate(unsigned long) memory:1664
#3 0x111b0400c in std::__1::allocator_traits >::allocate(std::__1::allocator&, unsigned long) memory:1400
#4 0x111b03a57 in std::__1::vector >::__vallocate(unsigned long) vector:996
#5 0x111b03613 in std::__1::vector >::vector(std::initializer_list) vector:1337
#6 0x111b0341e in std::__1::vector >::vector(std::initializer_list) vector:1331
#7 0x111b030ac in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#8 0x111adacc2 in hybridse::node::TypeNode::TypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) type_node.h:40
#9 0x111adac51 in hybridse::node::NodeManager::MakeTypeNode(hybridse::node::DataType, hybridse::node::TypeNode const*) node_manager.cc:832
#10 0x1119d4e81 in hybridse::udf::RegisterNativeUdfToModule(hybridse::node::NodeManager*) udf.cc:896
#11 0x1110da6a0 in hybridse::udf::DefaultUdfLibrary::Init() default_udf_library.cc:1725
#12 0x1110e6c31 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#13 0x1110b4594 in hybridse::udf::DefaultUdfLibrary::DefaultUdfLibrary() default_udf_library.h:48
#14 0x1119c640f in __cxx_global_var_init.4 default_udf_library.cc:44
#15 0x1119c64ae in _GLOBAL__sub_I_default_udf_library.cc default_udf_library.cc
#16 0x12deb9b46 in ImageLoaderMachO::doModInitFunctions(ImageLoader::LinkContext const&)+0x216 (dyld:x86_64+0x1db46)
#17 0x12deb9f51 in ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)+0x27 (dyld:x86_64+0x1df51)
#18 0x12deb4ae5 in ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0x1eb (dyld:x86_64+0x18ae5)
#19 0x12deb289e in ImageLoader::processInitializers(ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&)+0xbe (dyld:x86_64+0x1689e)
#20 0x12deb293f in ImageLoader::runInitializers(ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&)+0x51 (dyld:x86_64+0x1693f)
#21 0x12de9e8b0 in dyld::initializeMainExecutable()+0xc6 (dyld:x86_64+0x28b0)
#22 0x12dea5040 in dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*)+0x2389 (dyld:x86_64+0x9040)
#23 0x12de9d223 in dyldbootstrap::start(dyld3::MachOLoaded const*, int, char const**, dyld3::MachOLoaded const*, unsigned long*)+0x1c1 (dyld:x86_64+0x1223)
#24 0x12de9d024 in _dyld_start+0x24 (dyld:x86_64+0x1024)

HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_container_overflow=0.
If you suspect a false positive see also: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow.
SUMMARY: AddressSanitizer: container-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x42532) in __asan_memcpy+0x262
Shadow bytes around the buggy address:
0x1c0400000070: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x1c0400000080: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x1c0400000090: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x1c04000000a0: fa fa 00 fa fa fa fd fa fa fa 00 fa fa fa 00 00
0x1c04000000b0: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa 00 fa
=>0x1c04000000c0: fa fa[fc]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c04000000d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c04000000e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c04000000f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400000100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c0400000110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==99239==ABORTING
fish: Job 1, './src/planv2/ast_node_converter…' terminated by signal SIGABRT (Abort)
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

The stack trace points to a container-overflow in TypeNode's constructor at type_node.h:40, involving a vector of ints. Start by examining the TypeNode class in type_node.h and the NodeManager::MakeTypeNode method in node_manager.cc:832. The issue is specific to macOS with sanitizers enabled; compare the Linux build to understand the difference. Run the failing test ast_node_converter_test with ASAN to reproduce, then debug the vector initialization in the TypeNode constructor.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
cmake, cpp
Lĩnh vực
compilers
Loại issue
Lỗi
Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Khá rõ ràng
Mức phù hợp với người mới
30/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.