SIGSEGV on parsing MessagePack buffer: mp_check_uint: Assertion `cur < end' failed. #10360
Description
Bug description
- OS: Linux
- OS Version: Ubuntu 22.04
- Architecture: amd64
Tarantool 3.2.0-entrypoint-205-g8afc163fe3
Target: Linux-x86_64-Debug
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr/local -DENABLE_BACKTRACE=TRUE
Compiler: GNU-11.4.0
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/sergeyb/sources/MRG/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type -Werror -g -ggdb -O0
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/sergeyb/sources/MRG/tarantool=. -std=c++11 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
Steps to reproduce
local msgpack = require("msgpack")
local digest = require("digest")
local buf = digest.base64_decode("1wYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgY=")
msgpack.decode(buf)How to run:
Just type tarantool test.lua.
Actual behavior
tarantool: ./src/lib/msgpuck/msgpuck.h:2199: mp_check_uint: Assertion `cur < end' failed.
Aborted (core dumped)
Backtrace:
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140100700048064) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=140100700048064) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=140100700048064, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007f6bbb442476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007f6bbb4287f3 in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007f6bbb42871b in __assert_fail_base (fmt=0x7f6bbb5dd130 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=0x55dc8935843c "cur < end", file=0x55dc89358420 "./src/lib/msgpuck/msgpuck.h", line=2199, function=<optimized out>)
at ./assert/assert.c:92
#6 0x00007f6bbb439e96 in __GI___assert_fail (assertion=0x55dc8935843c "cur < end", file=0x55dc89358420 "./src/lib/msgpuck/msgpuck.h", line=2199,
function=0x55dc89358920 <__PRETTY_FUNCTION__.29> "mp_check_uint") at ./assert/assert.c:101
#7 0x000055dc88e98b9a in mp_check_uint (cur=0x412e1932 '\006' <repeats 25 times>, end=0x412e1932 '\006' <repeats 25 times>)
at /home/sergeyb/sources/MRG/tarantool/src/lib/msgpuck/msgpuck.h:2199
#8 0x000055dc88d78a47 in interval_unpack (data=0x7f6bb8880b08, len=7, itv=0x7f6bb8880b20)
at /home/sergeyb/sources/MRG/tarantool/src/lib/core/mp_interval.c:122
#9 0x000055dc88d78e3e in mp_validate_interval (data=0x412e1932 '\006' <repeats 25 times>, len=8)
at /home/sergeyb/sources/MRG/tarantool/src/lib/core/mp_interval.c:217
#10 0x000055dc88a7190b in msgpack_check_ext_data (type=6 '\006', data=0x412e192a '\006' <repeats 33 times>, len=8)
at /home/sergeyb/sources/MRG/tarantool/src/box/msgpack.c:133
#11 0x000055dc88e9b3bf in mp_check (data=0x7f6bb8880c88, end=0x412e194b "") at /home/sergeyb/sources/MRG/tarantool/src/lib/msgpuck/msgpuck.h:3222
#12 0x000055dc88d10ce4 in lua_msgpack_decode_string (L=0x41f63378, check=true) at /home/sergeyb/sources/MRG/tarantool/src/lua/msgpack.c:617
#13 0x000055dc88d10dd2 in lua_msgpack_decode (L=0x41f63378) at /home/sergeyb/sources/MRG/tarantool/src/lua/msgpack.c:636
#14 0x000055dc88da38a7 in lj_BC_FUNCC () at buildvm_x86.dasc:811
#15 0x000055dc88db141f in lua_pcall (L=0x41f63378, nargs=0, nresults=0, errfunc=0)
at /home/sergeyb/sources/MRG/tarantool/third_party/luajit/src/lj_api.c:1173
#16 0x000055dc88d14dd1 in luaT_call (L=0x41f63378, nargs=0, nreturns=0) at /home/sergeyb/sources/MRG/tarantool/src/lua/utils.c:689
#17 0x000055dc88d06361 in lua_main (L=0x41f63378, is_debugging=false, argc=1, argv=0x55dc8a8bd558)
at /home/sergeyb/sources/MRG/tarantool/src/lua/init.c:920
#18 0x000055dc88d06f7b in run_script_f (ap=0x7f6bb8c10858) at /home/sergeyb/sources/MRG/tarantool/src/lua/init.c:1133
#19 0x000055dc88a6a177 in fiber_cxx_invoke(fiber_func, typedef __va_list_tag __va_list_tag *) (f=0x55dc88d0637a <run_script_f>, ap=0x7f6bb8c10858)
at /home/sergeyb/sources/MRG/tarantool/src/lib/core/fiber.h:1324
#20 0x000055dc88d459c0 in fiber_loop (data=0x0) at /home/sergeyb/sources/MRG/tarantool/src/lib/core/fiber.c:1162
#21 0x000055dc8913a6d8 in coro_init () at /home/sergeyb/sources/MRG/tarantool/third_party/coro/coro.c:108tarantool binary and coredump:
gh-10360.zip
Expected behavior
correct error handling