---
id: "bug-378"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "controller"
severity: "unknown"
timestamp: "2026-06-10T10:02:00.000Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/controller/testsuite/test_p2_integration.c"]
tags: ["asan", "global-buffer-overflow", "repl_broadcast", "unit-test", "c"]
related: []
legacy: true
---

# bug-378: AddressSanitizer: global-buffer-overflow in dataq_enq via xce_wal_batch_req_raw <- repl_broadcast…

## Description
AddressSanitizer: global-buffer-overflow in dataq_enq via xce_wal_batch_req_raw <- repl_broadcast <- persist_wal_async

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
Tests 8 and 9 declared ep_a/ep_b/g_ep9_a/g_ep9_b as 'static int' (4 bytes) and passed them to repl_add_standby without (void*) cast. repl_broadcast then called xce_wal_batch_req_raw(s->ep, ...) using the stored int* as a real network endpoint, causing an 8-byte read past the 4-byte int. Neither test installed repl_broadcast_send_hook to intercept the call.

## Fix
Added #include typemap.h; added extern repl_broadcast_send_hook declaration guarded by XCE_TESTING; added p2_drop_send_hook no-op; installed hook around persist_wal_sync_append in tests 8 and 9; fixed missing (void*) casts on all four ep variables

## Verification
_Not recorded (migrated from buglog.json)._

## References
_Not recorded (migrated from buglog.json)._