SIGSEGV on parsing MessagePack buffer: decimal_unpack: Assertion `len > 0' failed #10361
Description
Bug description
- OS: Linux
- OS Version: Ubuntu 22.04
- Architecture: amd64
Tarantool 3.2.0-entrypoint-205-g8afc163fe3
Target: Linux-x86_64-Debug
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr/local -DENABLE_BACKTRACE=TRUE
Compiler: GNU-11.4.0
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/sergeyb/sources/MRG/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type -Werror -g -ggdb -O0
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/sergeyb/sources/MRG/tarantool=. -std=c++11 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
Steps to reproduce
Reproducer script:
local msgpack = require("msgpack")
local digest = require("digest")
local buf = digest.base64_decode("yQAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==")
msgpack.decode(buf)How to run:
Just type tarantool test.lua.
Actual behavior
tarantool: ./src/lib/core/decimal.c:486: decimal_unpack: Assertion `len > 0' failed.
Aborted (core dumped)
Backtrace:
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140616421247680) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=140616421247680) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=140616421247680, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007fe3cea42476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007fe3cea287f3 in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007fe3cea2871b in __assert_fail_base (fmt=0x7fe3cebdd130 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x556a98789bb8 "len > 0",
file=0x556a98789a9d "./src/lib/core/decimal.c", line=486, function=<optimized out>) at ./assert/assert.c:92
#6 0x00007fe3cea39e96 in __GI___assert_fail (assertion=0x556a98789bb8 "len > 0", file=0x556a98789a9d "./src/lib/core/decimal.c", line=486,
function=0x556a98789c80 <__PRETTY_FUNCTION__.0> "decimal_unpack") at ./assert/assert.c:101
#7 0x0000556a981be92a in decimal_unpack (data=0x7fe3cbc80b28, len=0, dec=0x7fe3cbc80b30)
at /home/sergeyb/sources/MRG/tarantool/src/lib/core/decimal.c:486
#8 0x0000556a97ebeeb3 in mp_validate_decimal (data=0x40db5676 "", len=0) at /home/sergeyb/sources/MRG/tarantool/src/lib/core/mp_decimal.h:105
#9 0x0000556a97ebf5a7 in msgpack_check_ext_data (type=1 '\001', data=0x40db5676 "", len=0)
at /home/sergeyb/sources/MRG/tarantool/src/box/msgpack.c:104
#10 0x0000556a982e9d36 in mp_check (data=0x7fe3cbc80c88, end=0x40db56b3 "") at /home/sergeyb/sources/MRG/tarantool/src/lib/msgpuck/msgpuck.h:3299
#11 0x0000556a9815ece4 in lua_msgpack_decode_string (L=0x40244378, check=true) at /home/sergeyb/sources/MRG/tarantool/src/lua/msgpack.c:617
#12 0x0000556a9815edd2 in lua_msgpack_decode (L=0x40244378) at /home/sergeyb/sources/MRG/tarantool/src/lua/msgpack.c:636
#13 0x0000556a981f18a7 in lj_BC_FUNCC () at buildvm_x86.dasc:811
#14 0x0000556a981ff41f in lua_pcall (L=0x40244378, nargs=0, nresults=0, errfunc=0)
at /home/sergeyb/sources/MRG/tarantool/third_party/luajit/src/lj_api.c:1173
#15 0x0000556a98162dd1 in luaT_call (L=0x40244378, nargs=0, nreturns=0) at /home/sergeyb/sources/MRG/tarantool/src/lua/utils.c:689
#16 0x0000556a98154361 in lua_main (L=0x40244378, is_debugging=false, argc=1, argv=0x556a9a751558)
at /home/sergeyb/sources/MRG/tarantool/src/lua/init.c:920
#17 0x0000556a98154f7b in run_script_f (ap=0x7fe3cc010858) at /home/sergeyb/sources/MRG/tarantool/src/lua/init.c:1133
#18 0x0000556a97eb8177 in fiber_cxx_invoke(fiber_func, typedef __va_list_tag __va_list_tag *) (f=0x556a9815437a <run_script_f>, ap=0x7fe3cc010858)
at /home/sergeyb/sources/MRG/tarantool/src/lib/core/fiber.h:1324
#19 0x0000556a981939c0 in fiber_loop (data=0x0) at /home/sergeyb/sources/MRG/tarantool/src/lib/core/fiber.c:1162
#20 0x0000556a985886d8 in coro_init () at /home/sergeyb/sources/MRG/tarantool/third_party/coro/coro.c:108tarantool binary and coredump:
gh-10361.zip
Expected behavior
correct error handling