myxce/.wolf/bugs/bug-1977.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits
bug-1977	fixed	2026-10-28		controller	crash	2026-10-28T11:56:58Z	2026-10-28T11:56:58Z	1	src/controller/testsuite/test_config_resource_reconcile.c	testsuite asan		8c1995c2

bug-1977: crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow

Description

Observed:

ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc...
WRITE of size 8 at 0x7ffc... thread T0
    #0 crr_build_config testsuite/test_config_resource_reconcile.c:126   (dists[3] = &d4)
    #1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161

Every test in the file that calls crr_build_config crashes the same way; the full controller suite reports 137/137 FAIL (meson reports each fixture crash as its own failure).

Expected: all four callers pass arrays large enough for the builder's fixtures; the suite stays green.

Impact: the whole controller testsuite was unrunnable under ASAN since the external-license-resources test fixtures landed (commit 2fcacac2) -- any regression in the suite was invisible behind the deterministic crash.

Found by: ASAN -- full regression build for the license-resource feature (src/tools/xce-build.sh controller, profile=asan).

Environment

• OS: Ubuntu 24.04.2 LTS; kernel Linux 6.8.0-147-generic x86_64
• libc: host ldd reports glibc 2.39
• Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
• Build: asan (xce.build)
• Code: feature/license-resources @ 30c51ea1-dirty (introduced by 2fcacac2)
• Deployment: n/a (unit testsuite only)

Reproduction

1. src/tools/xce-build.sh controller (asan profile) -- meson test crashes: controller - xce:controller test FAIL with the stack-buffer-overflow above.

• Frequency: deterministic
• Evidence: src/testlogs.archive/xce.build/this-20261028-114408-rc1/meson-logs/testlog.txt (bug-1971 failure-preservation mechanism)

Root cause

crr_build_config (test_config_resource_reconcile.c:70) registers FIVE resources (lic1/hostres/dyn1/extlic/slots -> writes resources[4]) and FOUR distributions (writes dists[3]) and FIVE vals (writes vals[4]). The four caller test functions declared only resources[4] / dists[3] / vals[4], so the builder's writes to index 4 / 3 / 4 overflowed the callers' stack arrays. When the extlic E2 tests were added to the builder's fixture set (2fcacac2), none of the caller declarations were resized. (Earlier builds of this branch compiled only a worker-focused subset -- test_config_resource_reconcile was not linked -- so the overflow went unnoticed until the full controller suite was built.)

Fix

Resize all four caller arrays to match the builder: resources[5], dists[4], vals[5], each with a bug-1977 comment pointing at the sizing contract. Files: src/controller/testsuite/test_config_resource_reconcile.c (test_reconcile_resources_registers_and_seeds_shared_pools, test_reconcile_resources_registers_new_defs_past_eexist, test_reconcile_resources_hot_applies_changed_definition, test_reconcile_resources_is_idempotent_and_hot_applies).

Verification

• Test: whole-file suite controller - xce:controller test (meson): RED 137/137 before the fix, GREEN after.
• Suites: src/tools/xce-build.sh controller profile=asan: 6/6 OK (sched push, sched worker change, apiserver push, host runusage, no-fork rule, controller 91s).
• Live: n/a (testsuite-only defect; no production code touched).

References

• Related: none