myxce/.wolf/bugs/bug-1900.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits
bug-1900	fixed	2026-10-01		controller	crash	2026-10-01T09:44:27Z	2026-10-01T09:44:27Z	1	src/controller/job.c	controller jobsubmit job-array asan	bug-1896	e6c484a0

bug-1900: controller crashes on a jobsub with array_size 0: payload build overflows calloc

Description

Observed: found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix handle_jobsubmit, a submission with array_size == 0 passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed:

==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8)
    in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c)

Expected: a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index). Impact: crash: any client (or a corrupt/malicious request) sending OPCode_jobsub with array_size = 0 brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md). Found by: test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification)

Environment

• OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
• libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
• Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
• Build: asan (src/build.jai)
• Code: scheduler-framework @ ef728435 (pre-fix handler)
• Deployment: none (controller_unit_test; reachable from any client sending a jobsub)

Reproduction

1. On ef728435, in src/controller/testsuite, call handle_jobsubmit with an xce_job_submit_t whose array_size is 0 (as test_jobsubmit_validate.c does).
2. Run controller_unit_test from an ASAN build: AddressSanitizer reports calloc parameters overflow.

• Frequency: deterministic (1/1, 2026-10-01)
• Evidence: not kept (reproduced by the RED phase of task 2.1; the test now guards it)

Root cause

handle_jobsubmit had no check on the element count: an empty range passes jobid_range_exists and inflight_range_try_add (an empty range never overlaps), and payload building computes an allocation from array_size - 1-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record).

Fix

jobsubmit_classify() now runs first in handle_jobsubmit and classifies a size-0 submission as invalid (7.4), so it is answered -EINVAL before any registry, table or payload work.

Verification

• Test: test_jobsubmit_index0_size0_start0 and the size-0 rows of test_jobsubmit_classify_table / test_jobsubmit_invalid_classes_einval in src/controller/testsuite/test_jobsubmit_validate.c: RED (ASAN calloc overflow) before, GREEN after
• Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01
• Live: n/a (input validation; unit-level reproduction is exact)

References

• Related: bug-1896 (found by its spec's task 2.1)