---
id: "bug-1900"
status: "fixed"
status_updated: "2026-10-01"
status_note: ""
component: "controller"
severity: "crash"
timestamp: "2026-10-01T09:44:27Z"
last_seen: "2026-10-01T09:44:27Z"
occurrences: 1
files: ["src/controller/job.c"]
tags: ["controller", "jobsubmit", "job-array", "asan"]
related: ["bug-1896"]
fix_commits: ["e6c484a0"]
---

# bug-1900: controller crashes on a jobsub with array_size 0: payload build overflows calloc

## Description
**Observed:** found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix `handle_jobsubmit`, a submission with `array_size == 0` passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed:
```
==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8)
    in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c)
```
**Expected:** a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index).
**Impact:** crash: any client (or a corrupt/malicious request) sending `OPCode_jobsub` with `array_size = 0` brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md).
**Found by:** test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification)

## Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (src/build.jai)
- Code: scheduler-framework @ ef728435 (pre-fix handler)
- Deployment: none (controller_unit_test; reachable from any client sending a jobsub)

## Reproduction
1. On ef728435, in `src/controller/testsuite`, call `handle_jobsubmit` with an `xce_job_submit_t` whose `array_size` is 0 (as `test_jobsubmit_validate.c` does).
2. Run `controller_unit_test` from an ASAN build: AddressSanitizer reports `calloc parameters overflow`.
- Frequency: deterministic (1/1, 2026-10-01)
- Evidence: not kept (reproduced by the RED phase of task 2.1; the test now guards it)

## Root cause
`handle_jobsubmit` had no check on the element count: an empty range passes `jobid_range_exists` and `inflight_range_try_add` (an empty range never overlaps), and payload building computes an allocation from `array_size - 1`-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record).

## Fix
`jobsubmit_classify()` now runs first in `handle_jobsubmit` and classifies a size-0 submission as invalid (7.4), so it is answered `-EINVAL` before any registry, table or payload work.

## Verification
- Test: `test_jobsubmit_index0_size0_start0` and the size-0 rows of `test_jobsubmit_classify_table` / `test_jobsubmit_invalid_classes_einval` in `src/controller/testsuite/test_jobsubmit_validate.c`: RED (ASAN calloc overflow) before, GREEN after
- Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01
- Live: n/a (input validation; unit-level reproduction is exact)

## References
- Related: bug-1896 (found by its spec's task 2.1)