---
id: "bug-1901"
status: "fixed"
status_updated: "2026-10-01"
status_note: ""
component: "scheduler"
severity: "crash"
timestamp: "2026-10-01T10:24:43Z"
last_seen: "2026-10-01T10:24:43Z"
occurrences: 1
files: ["src/scheduler/src/driver.c"]
tags: ["scheduler", "driver", "job-array", "asan"]
related: ["bug-1900", "bug-1896"]
fix_commits: ["4f44a689"]
---

# bug-1901: scheduler crashes on an array push whose size overflows: expansion calloc overflow

## Description
**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element:
```
ERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)
SUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update
```
for `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded.
**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.
**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.
**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`)

## Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (src/build.jai)
- Code: scheduler-framework @ fe5ddc98 (pre-fix driver)
- Deployment: none (sched_driver_translate_test; reachable from any array push)

## Reproduction
1. On fe5ddc98, feed `translate_one_pending_update` an `XCE_SCHED_OP_UPDATE_JOB_ARRAY` request whose descriptor has `array_size = UINT64_MAX` (as `test_driver_translate.c` now does).
2. Run `sched_driver_translate_test` from an ASAN build: `calloc-overflow` at `driver.c:469`.
- Frequency: deterministic (1/1, 2026-10-01)
- Evidence: not kept (the new test guards it)

## Root cause
The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.

## Fix
`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.

## Verification
- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after
- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01
- Live: n/a (defensive input validation; unit reproduction is exact)

## References
- Related: bug-1900 (same class in the controller), bug-1896 (found by its spec's task 3.1)