Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-12451

mcd leak when socket closes during read

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • 2.5.2, 3.1.0, 4.0.0
    • 2.5.1, 3.0
    • memcached
    • Security Level: Public
    • Not specific to any server specifics. Re-create on 1 node VM, Linux Ubuntu 14.04, 8GB RAM, 1 bucket with 4GB limit.

    Description

      If the client sets a large document (example is 10MB) and for some reason closes the connection before memcached returns status there's a risk of leaking the document size of data.

      1. Mcd reads the binary protocol header and sees a value length of 10MB.
      2. Mcd uses engine allocate and creates a 10MB item.
      3. Mcd goes around conn_nread pulling the value off the socket which requires a few goes to get all 10MB

      Meanwhile... client gives up (small lcb_set_timeout) and closes the connection.

      3. (contd.) Mcd encouters a read from socket error.
      4. Mcd returns false from conn_nread, event loop terminates

      In this failure path, there's no item release code, in this example we leak 10MB.

      Attachments

        Issue Links

          For Gerrit Dashboard: MB-12451
          # Subject Branch Project Status CR V

          Activity

            People

              ianmccloy Ian McCloy (Inactive)
              jwalker Jim Walker
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty