call l4z crash
- Dominant language
- C
- Stars
- 100
- Forks
- 36
- PR merge metrics
- No merged PRs in 30d
Description
some special data let lz4 crash
```
package main
import (
"io/ioutil"
"net/http"
lz4 "github.com/cloudflare/golz4"
)
func main() {
for {
resp, err := http.Get("http://pub.mengsky.net/boom")
body, err := ioutil.ReadAll(resp.Body)
out := make([]byte, lz4.CompressBound(body))
_, err = lz4.Compress(body, out)
if err != nil {
}
}
}
```
traceback
```
SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x659969]
runtime stack:
runtime.throw(0x711f04, 0x2a)
/usr/local/go/src/runtime/panic.go:605 +0x95
runtime.sigpanic()
/usr/local/go/src/runtime/signal_unix.go:351 +0x2b8
goroutine 15 [syscall, locked to thread]:
runtime.cgocall(0x667890, 0xc420583bc8, 0xc420432700)
/usr/local/go/src/runtime/cgocall.go:132 +0xe4 fp=0xc420583b88 sp=0xc420583b48 pc=0x4040c4
github.com/cloudflare/golz4._Cfunc_LZ4_compress_limitedOutput(0xc42351c000, 0xc4242b6000, 0xfbfdf000fb010, 0x0)
github.com/cloudflare/golz4/_obj/_cgo_gotypes.go:62 +0x4d fp=0xc420583bc8 sp=0xc420583b88 pc=0x63b5ad
github.com/cloudflare/golz4.Compress(0xc42351c000, 0xfb010, 0xfb010, 0xc4242b6000, 0xfbfdf, 0xfbfdf, 0x0, 0x412666, 0xc)
/go/src/github.com/cloudflare/golz4/lz4.go:50 +0x57 fp=0xc420583c18 sp=0xc420583bc8 pc=0x63b6d7
github.com/aliyun/aliyun-log-go-sdk.(*LogStore).PutLogs(0xc420290030, 0xc421f18000, 0xc42388b0c0, 0x0)
/go/src/github.com/aliyun/aliyun-log-go-sdk/log_store.go:73 +0x1fe fp=0xc420583d68 sp=0xc420583c18 pc=0x64aa8e
main.(*Relay).writeLogToSls(0xc4202901b0, 0xc420583fc8, 0x1000, 0x1000)
/go/main.go:171 +0x2f6 fp=0xc420583e30 sp=0xc420583d68 pc=0x6563c6
main.(*Relay).run(0xc4202901b0)
/go/main.go:214 +0x333 fp=0xc42058bfd8 sp=0xc420583e30 pc=0x656893
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:2337 +0x1 fp=0xc42058bfe0 sp=0xc42058bfd8 pc=0x45a071
created by main.NewRelay
/go/main.go:138 +0x17f
```
Contributor guide
Research direction
Start with lz4.go at line 50 and the C call to LZ4_compress_limitedOutput shown in the traceback. Reproduce with the Go example and data from http://pub.mengsky.net/boom, then inspect how the input and output sizes reach the cgo boundary. Done means the reproduction no longer reaches SIGSEGV and the compression path returns a defined result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, go
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100