lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(wolf): checkpoint buglog.json (1053 bugs)

Browse source
This commit is contained in:
Rongsong Shen 2026-08-26 09:33:35 +00:00
parent c7290344d5
commit 0a5ce1e2b7
No known key found for this signature in database
GPG key ID: 5BCDAAE0123E9FE2
1 changed files with 239 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

239
.wolf/buglog.json
View file

@ -19217,6 +19217,245 @@
],
"occurrences": 1,
"last_seen": "2026-08-26T00:00:00Z"
},
{
"id": "bug-1702",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_jobrun's `-m <host>:<ntasks>` parsing copies the host-name substring into a fixed 256-byte stack buffer with an unbounded strncpy (length = bytes before ':' in the user-supplied argument, never clamped to sizeof(buf)). A -m argument with a hostname longer than 256 bytes before the ':' overflows the stack buffer.",
"file": "src/controller/testsuite/test.c:2130-2136 (cmd_jobrun)",
"root_cause": "`strncpy(buf, optarg, (int)(p - optarg))` uses the attacker/user-controlled substring length directly with no `MIN(..., sizeof(buf)-1)` clamp, unlike sibling code elsewhere in the file that does bound similar copies.",
"fix": "NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject a host-name segment longer than the buffer with a usage error) before strncpy.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_jobrun",
"buffer-overflow",
"memory-safety",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [
"bug-1703"
],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1703",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_jobsub's `-n <min>,<max>` parsing copies the min-value substring into a fixed 64-byte stack buffer with an unbounded strncpy (length = bytes before ',' in the user-supplied argument, never clamped to sizeof(buf)). A -n argument with 64+ characters before the comma overflows the stack buffer.",
"file": "src/controller/testsuite/test.c:2246-2254 (cmd_jobsub)",
"root_cause": "Same pattern as bug-1702: `strncpy(buf, optarg, (int)(p - optarg))` with no bound check against sizeof(buf).",
"fix": "NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject) before strncpy, same fix shape as bug-1702.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_jobsub",
"buffer-overflow",
"memory-safety",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [
"bug-1702"
],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1704",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_qctrl declares `int action;` with no initializer and only assigns it inside the -a/-i/-o/-c getopt cases; there is no post-loop check that one of them was given before `queuectrl.action = action` is sent over the wire. Running `qctrl -q normal` with no action flag (syntactically valid per USAGE_QCTRL, which lists all four as optional) transmits indeterminate stack memory as the queue action.",
"file": "src/controller/testsuite/test.c:2663 (declaration), :2668-2688 (getopt loop), :2695 (queuectrl.action = action)",
"root_cause": "Missing initializer + missing post-loop validation, unlike the very next sibling command cmd_hostctrl which initializes action=HOST_DO_NONE and explicitly rejects that sentinel.",
"fix": "NOT YET FIXED. Recommended: initialize action to a sentinel (e.g. -1) and reject with a clear error if unset after the getopt loop, mirroring cmd_hostctrl's existing pattern.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_qctrl",
"uninitialized-variable",
"undefined-behavior",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1705",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_jobsub's `-x <exdata>` flag is documented (USAGE_JOBSUB) as overriding the built-in PATH-only exdata JSON, but build_job_exdata()/build_job_envs() unconditionally overwrite submit.start_info->exdata with the built-in PATH JSON regardless of whether -x already set a value -- the exact opposite of the documented behavior. The original -x value is also leaked (never freed before being replaced).",
"file": "src/controller/testsuite/test.c:2243-2245 (-x parsing), :2181-2195 (build_job_envs unconditional overwrite), :2336 (unconditional call site), USAGE_JOBSUB at :484-485",
"root_cause": "build_job_exdata()/build_job_envs() have no guard for an already-non-NULL exdata field before overwriting it.",
"fix": "NOT YET FIXED. Recommended: skip build_job_exdata() when submit.start_info->exdata is already non-NULL (from -x), and free the old pointer before any legitimate reassignment.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_jobsub",
"dead-flag",
"silent-data-loss",
"memory-leak",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1706",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_resupdate's own documented example (`resupdate -n mylabel -v foo -t string`) and any string-typed resource (e.g. `type`, `model`) corrupts the submitted resource value: set_resval() has no `case Value_u_svalue:` in its switch, so for a string-typed resource, vals[idx].name is left as uninitialized stack memory and the wire type stays the calloc'd default (ivalue32) instead of the string the user typed.",
"file": "src/controller/testsuite/test.c:3323-3364 (set_resval, missing Value_u_svalue case), :3483 (vals[] never zeroed), :363-364/375 (USAGE_RESUPDATE's own -t string example)",
"root_cause": "set_resval()'s switch only handles fvalue/ivalue32/ivalue64/bvalue; resval_resolve_type() can resolve to Value_u_svalue (type/model, or any name with -t string) but nothing handles that case. A comment at test.c:3365-3372 acknowledges the gap as intentionally deferred by a prior task.",
"fix": "NOT YET FIXED. Recommended: add a Value_u_svalue case to set_resval() that sets name/val->u.svalue correctly, and zero-init vals[] in cmd_resupdate as defense in depth.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_resupdate",
"uninitialized-variable",
"silent-data-corruption",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [
"bug-1707",
"bug-1712"
],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1707",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_resupdate: `resupdate -n slots -v 4 -n mem` silently drops the trailing `mem` resource with zero diagnostic (the final pending -n/-v pair is only flushed if a value was seen), yet the command still prints \"resource update ok!\" as if everything the user typed succeeded. A mid-list missing -v does print a warning; only the trailing one is silent.",
"file": "src/controller/testsuite/test.c:3551-3561 (trailing-pair flush, comment admits the drop), :3502-3507 (mid-list warning that trailing case lacks), :3567 (unconditional success message)",
"root_cause": "Trailing pending -n/-v pair flush logic only runs when resval_str != NULL, with no fallback warning path like the mid-list case has.",
"fix": "NOT YET FIXED. Recommended: apply the same \"no value specified, default will be used\" warning (or reject outright) to the trailing pair instead of a silent drop.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_resupdate",
"silent-data-loss",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [
"bug-1706"
],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1708",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_jobkill's `-s <signo>` is parsed via unchecked atoi(); a non-numeric value (e.g. a plausible typo of the symbolic name `SIGKILL` instead of `9`) silently becomes signo=0 (POSIX null signal, delivers nothing), yet the command still prints \"Job <id> signaled\" as if it succeeded.",
"file": "src/controller/testsuite/test.c:2572-2574 (signo = atoi(optarg)), :2601 (unconditional success message)",
"root_cause": "No validation that -s's argument is numeric/nonzero before using it and reporting success.",
"fix": "NOT YET FIXED. Recommended: reject non-numeric/unparseable -s values with a clear error instead of silently defaulting to signal 0.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_jobkill",
"silent-failure",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1709",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_jobinfo always returns 0 (success) even when its -j jobid is malformed (parse_jobid's return code is discarded), when no -j is given at all, or when xcecli_jobinfo fails for every -j given -- breaking the tool's own scripted-mode exit-code-verdict contract for this command specifically.",
"file": "src/controller/testsuite/test.c:2029-2058 (cmd_jobinfo)",
"root_cause": "No error/found flag tracked across the -j loop; the function unconditionally `return 0`s regardless of whether any valid lookup succeeded.",
"fix": "NOT YET FIXED. Recommended: track an error/found flag across the loop and return nonzero (with a usage message) when no valid -j was given or every lookup failed.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_jobinfo",
"silent-failure",
"exit-code",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1710",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_hello with -c 0, a negative count, or a non-numeric value (all yield count<=0 from unchecked atoi()) sends zero hellos (the while(count>0) loop body never runs) but still returns the still-zero-initialized rc, reporting success even though nothing was sent.",
"file": "src/controller/testsuite/test.c:1341 (rc=0 init), :1351 (count=atoi(optarg), unchecked), :1367 (while count>0 loop), :1373 (return rc)",
"root_cause": "No validation that count is >=1 before entering the loop; the initial success value is never overwritten when the loop body never executes.",
"fix": "NOT YET FIXED. Recommended: reject count<=0 with an explicit error instead of falling through to a silent vacuous success.",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_hello",
"silent-failure",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1711",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "xce_test: several command-specific typos and output-formatting inconsistencies found during a /cli-ux command-by-command audit: worker_status_str returns the misspelled \"UNKOWN\" for an unrecognized worker status bit (visible in every workerlist row hitting that path); cmd_help prints the malformed \"No commands matchs `%s'\" on an unknown help topic; cmd_runtasks's default launch_type for a single task is misspelled \"sequentail\" (display/data-only, not behavior-altering -- worker only special-cases \"openmpi\"/\"mpich\"); cmd_reslist right-justifies its Name/Description text columns (inconsistent with cmd_workerlist's left-justified equivalent columns) and prints the Flags column as unlabeled %x hex (ambiguous vs decimal, unlike this file's own \"0x%x\"-prefixed state_raw precedent); cmd_joblist prints SubmitTime/StartTime/FinishTime as raw Unix epoch seconds instead of using this file's own ctrlstatus_format_time_ms-style formatting, and labels a hidden mintasks,maxtasks pair as a single \"NTasks\" column; cmd_joblist's job_state_str has no raw-state fallback for an ambiguous RUN+EXIT state the way print_jobinfo already guards against two functions away; getconf's User Groups/Host Groups/Configs sections always print their header followed by nothing (print_grouplist/print_configlist are no-op stubs), indistinguishable from a genuinely empty cluster.",
"file": "src/controller/testsuite/test.c:1435 (UNKOWN), :1069 (matchs), :2939 (sequentail), :1401/1404 (reslist formatting), :1454/1473 (workerlist formatting for contrast), :1551-1572 (joblist raw epoch + NTasks label), :1486 (job_state_str), :1972-1992 (print_jobinfo's raw-state fallback for contrast), :3632/3634 (print_grouplist/print_configlist stubs), :3659-3666 (getconf headers)",
"root_cause": "Accumulated small inconsistencies/typos/unimplemented stubs found via a systematic per-command audit; none individually severe, several visible in routine tool usage.",
"fix": "NOT YET FIXED. Recommended: fix the three typos directly; left-justify reslist's text columns and label/prefix its Flags column as hex to match workerlist/state_raw conventions; format joblist's three time columns like ctrlstatus does and relabel/split the NTasks column; either implement print_grouplist/print_configlist from the already-fetched data or print \"(not implemented)\" instead of silent nothing.",
"tags": [
"controller",
"testsuite",
"xce_test",
"typo",
"output-formatting",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
},
{
"id": "bug-1712",
"timestamp": "2026-08-26T09:32:18Z",
"error_message": "cmd_resupdate: a duplicate -v for the same pending resource (`resupdate -n slots -v 4 -v 8`) prints the misleading message \"ignore res value `%s' as no res name found\" even though a resource name WAS found -- the real problem is a value is already pending for it, not a missing name.",
"file": "src/controller/testsuite/test.c:3525-3531 (case 'v' else-branch)",
"root_cause": "The else-branch of the -v case handles two distinct situations (no preceding -n at all, vs. a duplicate -v for an already-named pending resource) with one shared, incorrectly-worded message.",
"fix": "NOT YET FIXED. Recommended: distinguish the two cases with an accurate message for the duplicate-value case, e.g. \"ignoring duplicate value '%s' for res '%s' (already has a pending value)\".",
"tags": [
"controller",
"testsuite",
"xce_test",
"cmd_resupdate",
"misleading-error-message",
"cli-ux-audit",
"unfixed"
],
"related_bugs": [
"bug-1706",
"bug-1707"
],
"occurrences": 1,
"last_seen": "2026-08-26T09:32:18Z"
}
]
}