Uploaded image for project: 'Couchbase C client library libcouchbase'
  1. Couchbase C client library libcouchbase
  2. CCBC-51

In store.c :67 libcouchbase_store_by_key does not check for negative value for idx, causing seg fault when nodes are down

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • None
    • 1.0
    • library
    • Security Level: Public
    • None
    • Centos 5.5, Couchbase server 1.8, libcouchbase 1

    Description

      I had 3 server nodes, 2 of which were down.

      When I ran my test program (to store a value), instead of reporting an error or using the remaining node, the program seg faulted.
      I traced this back to store.c :66, where vbucket_map(instance->vbucket_config, hashkey, nhashkey, &vb, &idx)
      returned -1 for the value idx (the index into the vbucket); this probably indicates that there was no valid index.
      The next line, 67, uses idx to reference a server struct. Using -1 causes an invalid memory access and the program crashes with a seg fault.

      server = instance->servers + (size_t)idx;

      There should be a statement to check the value idx is non negative before using it:

      Attachments

        For Gerrit Dashboard: CCBC-51
        # Subject Branch Project Status CR V

        Activity

          People

            avsej Sergey Avseyev
            jamesoc James
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - 4h
                4h
                Remaining:
                Remaining Estimate - 4h
                4h
                Logged:
                Time Spent - Not Specified
                Not Specified

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty