Reset the trace queue indexes when the queue shrinks - #1694
Draft
AbhinavMir wants to merge 1 commit into
Draft
Conversation
Log_pretrace() reallocates the trace queue when an application changes trace_settings.max_trace_entries. The valid indexes are 0 to max_trace_entries - 1. The bounds check compared the stored ring indexes with max_trace_entries + 1, so it accepted two indexes that are past the end of the new queue. A shrink to the current write index therefore left the index out of range. The caller then wrote a trace entry past the end of the allocation. The index also never wrapped again, so every later entry went further past the end. Compare the indexes with max_trace_entries instead. Add a unit test that shrinks the queue to the current write index. AddressSanitizer reports a heap buffer overflow in Log_trace() without this fix, and glibc aborts the plain build with heap corruption. Signed-off-by: Abhinav Srivastava <atg271@gmail.com>
AbhinavMir
force-pushed
the
trace-queue-bounds
branch
from
August 30, 2026 08:04
cfc0836 to
f8fa495
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Log_pretrace()reallocates the trace queue when an application changestrace_settings.max_trace_entries. The queue holdsmax_trace_entriesentries, so the valid indexes are 0 tomax_trace_entries - 1.The bounds check compares the stored ring indexes with
max_trace_entries + 1. It therefore acceptsmax_trace_entriesandmax_trace_entries + 1. Both are past the end of the new queue.A shrink to the current write index leaves
next_indexout of range.Log_trace()andLog_stackTrace()then write a wholetraceEntrypast the end of the allocation. The index also never wraps again, because the wrap test uses==. Every later entry goes further past the end.Change
Compare the indexes with
max_trace_entries.Test
test/test_unit_coverage.cgets a new case. It uses 5 slots of a 10 entry queue, shrinks the queue to 5 entries, and keeps logging. A trace callback counts the entries.Without the fix:
Log_trace(), 0 bytes to the right of the 1560 byte queue.double free or corruption (!prev).With the fix the test passes in both builds.
Build
Built with gcc 12 on Debian 12. Static and shared, with OpenSSL, plus an AddressSanitizer build. No new compiler warnings.
test1cases 1 to 5 andtest4cases 1 to 3 pass against a local broker.The commit is signed off.