b38ef6de63
The external-license-resources E2 fixture builder crr_build_config
registers five resources and four distributions, writing resources[4],
dists[3] and vals[4]. All four caller test functions declared only
resources[4]/dists[3]/vals[4], so every build_config call wrote past
the caller's stack arrays -- deterministic ASAN stack-buffer-overflow,
the whole controller suite (137 fixtures) red since 2fcacac2.
Resize the four caller arrays to match the builder's sizing
(resources[5]/dists[4]/vals[5]) with a bug-1977 comment on the sizing
contract. No production code touched.
Verified: src/tools/xce-build.sh controller (asan) 6/6 OK, controller
suite 91s green; buglog record .wolf/bugs/bug-1977.md.
Co-Authored-By: Claude Code <noreply@anthropic.com>
85 lines
3.5 KiB
Markdown
85 lines
3.5 KiB
Markdown
---
|
|
id: "bug-1977"
|
|
status: "fixed"
|
|
status_updated: "2026-10-28"
|
|
status_note: ""
|
|
component: "controller"
|
|
severity: "crash"
|
|
timestamp: "2026-10-28T11:56:58Z"
|
|
last_seen: "2026-10-28T11:56:58Z"
|
|
occurrences: 1
|
|
files: ["src/controller/testsuite/test_config_resource_reconcile.c"]
|
|
tags: ["testsuite", "asan"]
|
|
related: []
|
|
fix_commits: ["8c1995c2"]
|
|
---
|
|
|
|
# bug-1977: crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow
|
|
|
|
## Description
|
|
**Observed:**
|
|
```
|
|
ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc...
|
|
WRITE of size 8 at 0x7ffc... thread T0
|
|
#0 crr_build_config testsuite/test_config_resource_reconcile.c:126 (dists[3] = &d4)
|
|
#1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161
|
|
```
|
|
Every test in the file that calls `crr_build_config` crashes the same way;
|
|
the full controller suite reports 137/137 FAIL (meson reports each fixture
|
|
crash as its own failure).
|
|
|
|
**Expected:** all four callers pass arrays large enough for the builder's
|
|
fixtures; the suite stays green.
|
|
|
|
**Impact:** the whole controller testsuite was unrunnable under ASAN since the
|
|
external-license-resources test fixtures landed (commit 2fcacac2) -- any
|
|
regression in the suite was invisible behind the deterministic crash.
|
|
|
|
**Found by:** ASAN -- full regression build for the license-resource feature
|
|
(`src/tools/xce-build.sh controller`, profile=asan).
|
|
|
|
## Environment
|
|
- OS: Ubuntu 24.04.2 LTS; kernel Linux 6.8.0-147-generic x86_64
|
|
- libc: host ldd reports glibc 2.39
|
|
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
|
- Build: asan (xce.build)
|
|
- Code: feature/license-resources @ 30c51ea1-dirty (introduced by 2fcacac2)
|
|
- Deployment: n/a (unit testsuite only)
|
|
|
|
## Reproduction
|
|
1. `src/tools/xce-build.sh controller` (asan profile) -- meson test crashes:
|
|
`controller - xce:controller test` FAIL with the stack-buffer-overflow above.
|
|
- Frequency: deterministic
|
|
- Evidence: src/testlogs.archive/xce.build/this-20261028-114408-rc1/meson-logs/testlog.txt (bug-1971 failure-preservation mechanism)
|
|
|
|
## Root cause
|
|
`crr_build_config` (test_config_resource_reconcile.c:70) registers FIVE
|
|
resources (lic1/hostres/dyn1/extlic/slots -> writes `resources[4]`) and FOUR
|
|
distributions (writes `dists[3]`) and FIVE vals (writes `vals[4]`). The four
|
|
caller test functions declared only
|
|
`resources[4] / dists[3] / vals[4]`, so the builder's writes to index 4 / 3 /
|
|
4 overflowed the callers' stack arrays. When the extlic E2 tests were added to
|
|
the builder's fixture set (2fcacac2), none of the caller declarations were
|
|
resized. (Earlier builds of this branch compiled only a worker-focused subset
|
|
-- `test_config_resource_reconcile` was not linked -- so the overflow went
|
|
unnoticed until the full controller suite was built.)
|
|
|
|
## Fix
|
|
Resize all four caller arrays to match the builder: `resources[5]`,
|
|
`dists[4]`, `vals[5]`, each with a bug-1977 comment pointing at the sizing
|
|
contract. Files: src/controller/testsuite/test_config_resource_reconcile.c
|
|
(test_reconcile_resources_registers_and_seeds_shared_pools,
|
|
test_reconcile_resources_registers_new_defs_past_eexist,
|
|
test_reconcile_resources_hot_applies_changed_definition,
|
|
test_reconcile_resources_is_idempotent_and_hot_applies).
|
|
|
|
## Verification
|
|
- Test: whole-file suite `controller - xce:controller test` (meson): RED
|
|
137/137 before the fix, GREEN after.
|
|
- Suites: `src/tools/xce-build.sh controller` profile=asan: 6/6 OK
|
|
(sched push, sched worker change, apiserver push, host runusage, no-fork
|
|
rule, controller 91s).
|
|
- Live: n/a (testsuite-only defect; no production code touched).
|
|
|
|
## References
|
|
- Related: none
|