Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-30190

Null pointer dereference if compressed item is evicted

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • 5.5.0
    • 5.5.0
    • couchbase-bucket
    • Untriaged
    • Unknown

    Description

      As identified by UndefinedSanitizer; if we attempt to eject an item which is compressed then during the HashTable statistics update we unconditionally dereference the value pointer; which is now null:

      void HashTable::Statistics::epilogue(const StoredValue& v) {
      		 
          // After performing updates to sv; increase all statistics which sv matches.
      		 
          ...
      		 
          if (mcbp::datatype::is_snappy(v.getDatatype())) {
      		 
              size_t uncompressed_length = cb::compression::get_uncompressed_length(
      		 
                      cb::compression::Algorithm::Snappy,
      		 
                      {v.getValue()->getData(), v.valuelen()});
      		 
              uncompressedMemSize.fetch_add(v.metaDataSize() + uncompressed_length);
      		 
          } else {
      		 
              ...

      In the case of UBSan this aborts the program; but I would expect this could lead to a segfault in the full stack.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            drigby Dave Rigby (Inactive)
            drigby Dave Rigby (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty