Rongsong Shen
d26ff8870d
The buglog was one 27K-line JSON file whose fields covered only symptom,
root cause and fix, as free text: 2% of entries named the code version a
bug was found on, 12% the build profile, 36% a way to reproduce, and 58% of
the file was OpenWolf hook auto-detections ("Missing guard clause",
"Function not marked async" on .md files).
- .claude/skills/buglog/bug-record.md: the record standard. Eight
sections (Summary as the title, Description, Environment, Reproduction;
Root cause, Fix, Verification, References once fixed), each with the
content it must contain -- e.g. Environment needs the OS, the libc the
failing binary loads (from its ELF interpreter: glibc 2.42 in the nix
shell vs 2.40 on the host), toolchain, build profile and commit.
- .wolf/bugs/<id>.md: 500 records migrated from buglog.json; every field
verified to round-trip. They carry legacy: true and an explicit "not
recorded" where the old log had no such field; component derived from
file paths, severity from keywords (else unknown), fix_commits from
hashes in status_note/fix that git resolves (91 of 463 fixed).
- .wolf/buglog-archive.json: the 710 hook auto-detections, verbatim.
- .wolf/buglog.json is now an index generated from the records, keeping
the fields OpenWolf's hooks and `openwolf bug search` read.
- scripts/buglog.py rewritten: new (template + Environment collected from
the machine and --binary), check, status (refuses a status the record
doesn't support; fixed needs Root cause, Fix, Verification and
--commit hashes git resolves), note, recur, set, show, list, triage,
env, index. 29 unittest cases in scripts/tests/test_buglog.py.
- scripts/git-hooks/pre-commit runs `check --staged`: incomplete staged
records, a legacy record hand-changed to fixed without the fix-time
sections, a new record claiming legacy: true, or a stale index refuse
the commit.
- scripts/gitea-sync.py reads the records: issue body = the record's
sections plus linked fix commits (origin remote, GITEA_COMMIT_REPO to
override), and a body hash so an issue's text is refreshed when the
record changes.
- bug-1866 rewritten to the full standard as the worked example.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2.7 KiB
| id | status | status_updated | status_note | component | severity | timestamp | last_seen | occurrences | files | tags | related | legacy | |||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bug-1532 | fixed | 2026-09-24 | apiserver | crash | 2026-08-12T00:20:00.000Z | 2026-09-19T09:00:00Z | 1 |
|
|
true |
bug-1532: apiserver clib.go tryConnect(): use-after-free on ctx->conf->masters[i] (host address string) on…
Description
apiserver clib.go tryConnect(): use-after-free on ctx->conf->masters[i] (host address string) on every post-initial-connect failover rotation attempt
Environment
Not recorded (migrated from buglog.json).
Reproduction
Not recorded (migrated from buglog.json).
Root cause
tryConnect() allocated cAddr/cFrom/cKey via C.CString(), built a Go-function-local xce_client_config_t pointing at them, called xce_backend_init() once, then deferred C.free() on all three strings immediately after that single call returned. xcecli_ctx_init() (src/lib/client.c) stores ctx->conf = cfg as a RAW pointer (never copies the struct), and client_failover.c dereferences ctx->conf->masters[cur_master] on EVERY subsequent failover rotation attempt (client_failover.c:120,386), not just the initial connect -- so any reconnect/rotation after the first tryConnect() call returned read freed memory. A second, independent hazard: cConfig itself was a Go-local var; ctx->conf retained a raw pointer to it invisible to Go GC once tryConnect() returned. (Note: from/key were NOT actually part of this UAF -- xce_ctx_init() strdup()s them immediately at ctx-init time, so freeing cFrom/cKey was safe in isolation; only the masters[] host string and the client_config_t struct address itself were genuinely unsafe.)
Fix
component-failover-adoption task 4.2: replaced tryConnect() and the dual Go-level connect loops entirely with buildClusterConfig()+RegisterToBackend(), backed by two new package-level (process-lifetime, GC-rooted) vars gClusterCfg (C.xce_cluster_config_t) and gClientCfg (C.xce_client_config_t). Host strings now live in gClusterCfg.candidates[i].hostname (fixed char[256] arrays, no CString/free at all -- xce_cluster_config_to_client_config() aliases pointers directly into this storage). from/key point at gClusterCfg.identity[0]/key[0] (also fixed arrays) rather than separate CStrings. No C.CString/C.free is used anywhere in the connect path except the transient peers-string argument to xce_parse_peers(), which is safely freed right after that one call since xce_parse_peers() copies into gClusterCfg internally.
Verification
Not recorded (migrated from buglog.json).
References
Not recorded (migrated from buglog.json).