From 0a5ce1e2b70ed58b9f8317dfd4eca5bf45067142 Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Wed, 26 Aug 2026 09:33:35 +0000 Subject: [PATCH] chore(wolf): checkpoint buglog.json (1053 bugs) --- .wolf/buglog.json | 239 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 239 insertions(+) diff --git a/.wolf/buglog.json b/.wolf/buglog.json index 54636ea8..b9440dce 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -19217,6 +19217,245 @@ ], "occurrences": 1, "last_seen": "2026-08-26T00:00:00Z" + }, + { + "id": "bug-1702", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_jobrun's `-m :` parsing copies the host-name substring into a fixed 256-byte stack buffer with an unbounded strncpy (length = bytes before ':' in the user-supplied argument, never clamped to sizeof(buf)). A -m argument with a hostname longer than 256 bytes before the ':' overflows the stack buffer.", + "file": "src/controller/testsuite/test.c:2130-2136 (cmd_jobrun)", + "root_cause": "`strncpy(buf, optarg, (int)(p - optarg))` uses the attacker/user-controlled substring length directly with no `MIN(..., sizeof(buf)-1)` clamp, unlike sibling code elsewhere in the file that does bound similar copies.", + "fix": "NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject a host-name segment longer than the buffer with a usage error) before strncpy.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_jobrun", + "buffer-overflow", + "memory-safety", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [ + "bug-1703" + ], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1703", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_jobsub's `-n ,` parsing copies the min-value substring into a fixed 64-byte stack buffer with an unbounded strncpy (length = bytes before ',' in the user-supplied argument, never clamped to sizeof(buf)). A -n argument with 64+ characters before the comma overflows the stack buffer.", + "file": "src/controller/testsuite/test.c:2246-2254 (cmd_jobsub)", + "root_cause": "Same pattern as bug-1702: `strncpy(buf, optarg, (int)(p - optarg))` with no bound check against sizeof(buf).", + "fix": "NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject) before strncpy, same fix shape as bug-1702.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_jobsub", + "buffer-overflow", + "memory-safety", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [ + "bug-1702" + ], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1704", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_qctrl declares `int action;` with no initializer and only assigns it inside the -a/-i/-o/-c getopt cases; there is no post-loop check that one of them was given before `queuectrl.action = action` is sent over the wire. Running `qctrl -q normal` with no action flag (syntactically valid per USAGE_QCTRL, which lists all four as optional) transmits indeterminate stack memory as the queue action.", + "file": "src/controller/testsuite/test.c:2663 (declaration), :2668-2688 (getopt loop), :2695 (queuectrl.action = action)", + "root_cause": "Missing initializer + missing post-loop validation, unlike the very next sibling command cmd_hostctrl which initializes action=HOST_DO_NONE and explicitly rejects that sentinel.", + "fix": "NOT YET FIXED. Recommended: initialize action to a sentinel (e.g. -1) and reject with a clear error if unset after the getopt loop, mirroring cmd_hostctrl's existing pattern.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_qctrl", + "uninitialized-variable", + "undefined-behavior", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1705", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_jobsub's `-x ` flag is documented (USAGE_JOBSUB) as overriding the built-in PATH-only exdata JSON, but build_job_exdata()/build_job_envs() unconditionally overwrite submit.start_info->exdata with the built-in PATH JSON regardless of whether -x already set a value -- the exact opposite of the documented behavior. The original -x value is also leaked (never freed before being replaced).", + "file": "src/controller/testsuite/test.c:2243-2245 (-x parsing), :2181-2195 (build_job_envs unconditional overwrite), :2336 (unconditional call site), USAGE_JOBSUB at :484-485", + "root_cause": "build_job_exdata()/build_job_envs() have no guard for an already-non-NULL exdata field before overwriting it.", + "fix": "NOT YET FIXED. Recommended: skip build_job_exdata() when submit.start_info->exdata is already non-NULL (from -x), and free the old pointer before any legitimate reassignment.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_jobsub", + "dead-flag", + "silent-data-loss", + "memory-leak", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1706", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_resupdate's own documented example (`resupdate -n mylabel -v foo -t string`) and any string-typed resource (e.g. `type`, `model`) corrupts the submitted resource value: set_resval() has no `case Value_u_svalue:` in its switch, so for a string-typed resource, vals[idx].name is left as uninitialized stack memory and the wire type stays the calloc'd default (ivalue32) instead of the string the user typed.", + "file": "src/controller/testsuite/test.c:3323-3364 (set_resval, missing Value_u_svalue case), :3483 (vals[] never zeroed), :363-364/375 (USAGE_RESUPDATE's own -t string example)", + "root_cause": "set_resval()'s switch only handles fvalue/ivalue32/ivalue64/bvalue; resval_resolve_type() can resolve to Value_u_svalue (type/model, or any name with -t string) but nothing handles that case. A comment at test.c:3365-3372 acknowledges the gap as intentionally deferred by a prior task.", + "fix": "NOT YET FIXED. Recommended: add a Value_u_svalue case to set_resval() that sets name/val->u.svalue correctly, and zero-init vals[] in cmd_resupdate as defense in depth.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_resupdate", + "uninitialized-variable", + "silent-data-corruption", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [ + "bug-1707", + "bug-1712" + ], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1707", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_resupdate: `resupdate -n slots -v 4 -n mem` silently drops the trailing `mem` resource with zero diagnostic (the final pending -n/-v pair is only flushed if a value was seen), yet the command still prints \"resource update ok!\" as if everything the user typed succeeded. A mid-list missing -v does print a warning; only the trailing one is silent.", + "file": "src/controller/testsuite/test.c:3551-3561 (trailing-pair flush, comment admits the drop), :3502-3507 (mid-list warning that trailing case lacks), :3567 (unconditional success message)", + "root_cause": "Trailing pending -n/-v pair flush logic only runs when resval_str != NULL, with no fallback warning path like the mid-list case has.", + "fix": "NOT YET FIXED. Recommended: apply the same \"no value specified, default will be used\" warning (or reject outright) to the trailing pair instead of a silent drop.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_resupdate", + "silent-data-loss", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [ + "bug-1706" + ], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1708", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_jobkill's `-s ` is parsed via unchecked atoi(); a non-numeric value (e.g. a plausible typo of the symbolic name `SIGKILL` instead of `9`) silently becomes signo=0 (POSIX null signal, delivers nothing), yet the command still prints \"Job signaled\" as if it succeeded.", + "file": "src/controller/testsuite/test.c:2572-2574 (signo = atoi(optarg)), :2601 (unconditional success message)", + "root_cause": "No validation that -s's argument is numeric/nonzero before using it and reporting success.", + "fix": "NOT YET FIXED. Recommended: reject non-numeric/unparseable -s values with a clear error instead of silently defaulting to signal 0.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_jobkill", + "silent-failure", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1709", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_jobinfo always returns 0 (success) even when its -j jobid is malformed (parse_jobid's return code is discarded), when no -j is given at all, or when xcecli_jobinfo fails for every -j given -- breaking the tool's own scripted-mode exit-code-verdict contract for this command specifically.", + "file": "src/controller/testsuite/test.c:2029-2058 (cmd_jobinfo)", + "root_cause": "No error/found flag tracked across the -j loop; the function unconditionally `return 0`s regardless of whether any valid lookup succeeded.", + "fix": "NOT YET FIXED. Recommended: track an error/found flag across the loop and return nonzero (with a usage message) when no valid -j was given or every lookup failed.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_jobinfo", + "silent-failure", + "exit-code", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1710", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_hello with -c 0, a negative count, or a non-numeric value (all yield count<=0 from unchecked atoi()) sends zero hellos (the while(count>0) loop body never runs) but still returns the still-zero-initialized rc, reporting success even though nothing was sent.", + "file": "src/controller/testsuite/test.c:1341 (rc=0 init), :1351 (count=atoi(optarg), unchecked), :1367 (while count>0 loop), :1373 (return rc)", + "root_cause": "No validation that count is >=1 before entering the loop; the initial success value is never overwritten when the loop body never executes.", + "fix": "NOT YET FIXED. Recommended: reject count<=0 with an explicit error instead of falling through to a silent vacuous success.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_hello", + "silent-failure", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1711", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "xce_test: several command-specific typos and output-formatting inconsistencies found during a /cli-ux command-by-command audit: worker_status_str returns the misspelled \"UNKOWN\" for an unrecognized worker status bit (visible in every workerlist row hitting that path); cmd_help prints the malformed \"No commands matchs `%s'\" on an unknown help topic; cmd_runtasks's default launch_type for a single task is misspelled \"sequentail\" (display/data-only, not behavior-altering -- worker only special-cases \"openmpi\"/\"mpich\"); cmd_reslist right-justifies its Name/Description text columns (inconsistent with cmd_workerlist's left-justified equivalent columns) and prints the Flags column as unlabeled %x hex (ambiguous vs decimal, unlike this file's own \"0x%x\"-prefixed state_raw precedent); cmd_joblist prints SubmitTime/StartTime/FinishTime as raw Unix epoch seconds instead of using this file's own ctrlstatus_format_time_ms-style formatting, and labels a hidden mintasks,maxtasks pair as a single \"NTasks\" column; cmd_joblist's job_state_str has no raw-state fallback for an ambiguous RUN+EXIT state the way print_jobinfo already guards against two functions away; getconf's User Groups/Host Groups/Configs sections always print their header followed by nothing (print_grouplist/print_configlist are no-op stubs), indistinguishable from a genuinely empty cluster.", + "file": "src/controller/testsuite/test.c:1435 (UNKOWN), :1069 (matchs), :2939 (sequentail), :1401/1404 (reslist formatting), :1454/1473 (workerlist formatting for contrast), :1551-1572 (joblist raw epoch + NTasks label), :1486 (job_state_str), :1972-1992 (print_jobinfo's raw-state fallback for contrast), :3632/3634 (print_grouplist/print_configlist stubs), :3659-3666 (getconf headers)", + "root_cause": "Accumulated small inconsistencies/typos/unimplemented stubs found via a systematic per-command audit; none individually severe, several visible in routine tool usage.", + "fix": "NOT YET FIXED. Recommended: fix the three typos directly; left-justify reslist's text columns and label/prefix its Flags column as hex to match workerlist/state_raw conventions; format joblist's three time columns like ctrlstatus does and relabel/split the NTasks column; either implement print_grouplist/print_configlist from the already-fetched data or print \"(not implemented)\" instead of silent nothing.", + "tags": [ + "controller", + "testsuite", + "xce_test", + "typo", + "output-formatting", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" + }, + { + "id": "bug-1712", + "timestamp": "2026-08-26T09:32:18Z", + "error_message": "cmd_resupdate: a duplicate -v for the same pending resource (`resupdate -n slots -v 4 -v 8`) prints the misleading message \"ignore res value `%s' as no res name found\" even though a resource name WAS found -- the real problem is a value is already pending for it, not a missing name.", + "file": "src/controller/testsuite/test.c:3525-3531 (case 'v' else-branch)", + "root_cause": "The else-branch of the -v case handles two distinct situations (no preceding -n at all, vs. a duplicate -v for an already-named pending resource) with one shared, incorrectly-worded message.", + "fix": "NOT YET FIXED. Recommended: distinguish the two cases with an accurate message for the duplicate-value case, e.g. \"ignoring duplicate value '%s' for res '%s' (already has a pending value)\".", + "tags": [ + "controller", + "testsuite", + "xce_test", + "cmd_resupdate", + "misleading-error-message", + "cli-ux-audit", + "unfixed" + ], + "related_bugs": [ + "bug-1706", + "bug-1707" + ], + "occurrences": 1, + "last_seen": "2026-08-26T09:32:18Z" } ] }