Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-12451

mcd leak when socket closes during read

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • 2.5.2, 3.1.0, 4.0.0
    • 2.5.1, 3.0
    • memcached
    • Security Level: Public
    • Not specific to any server specifics. Re-create on 1 node VM, Linux Ubuntu 14.04, 8GB RAM, 1 bucket with 4GB limit.

    Description

      If the client sets a large document (example is 10MB) and for some reason closes the connection before memcached returns status there's a risk of leaking the document size of data.

      1. Mcd reads the binary protocol header and sees a value length of 10MB.
      2. Mcd uses engine allocate and creates a 10MB item.
      3. Mcd goes around conn_nread pulling the value off the socket which requires a few goes to get all 10MB

      Meanwhile... client gives up (small lcb_set_timeout) and closes the connection.

      3. (contd.) Mcd encouters a read from socket error.
      4. Mcd returns false from conn_nread, event loop terminates

      In this failure path, there's no item release code, in this example we leak 10MB.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              ianmccloy Ian McCloy (Inactive)
              jwalker Jim Walker
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty