Project

General

Profile

Bug #26875

kv: MergeOperator name() returns string, and caller calls c_str() on the temporary

Added by Sage Weil 4 months ago. Updated 3 months ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
-
Target version:
-
Start date:
08/07/2018
Due date:
% Done:

0%

Source:
Tags:
Backport:
mimic,luminous
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Component(RADOS):
Pull request ID:

Description

On Tue, 7 Aug 2018, Réka Nikolett Kovács wrote:

Hi,

I am working on a bug finding tool that looks for a special kind of a
use-after-free problem in C++ code (a "checker" module in the Clang
Static Analyzer [1]), and I've been running it on a few projects to
see if it finds anything interesting.

I've found the following on line 131 in ceph/src/kv/RocksDBStore.cc
[2], where I suspect we are returning a pointer to a deallocated
memory region:

return mop->name().c_str();

Here, mop is a std::shared_ptr<KeyValueDB::MergeOperator>, and name()
seems to return a string by value [3], a temporary object, on which
c_str() is called to obtain a const char * pointing to its inner
buffer. But the temporary string object is destroyed at the end of the
return statement, and the caller receives a pointer that references a
deallocated buffer.

I hope you find this report useful.


Related issues

Copied to RADOS - Backport #26907: mimic: kv: MergeOperator name() returns string, and caller calls c_str() on the temporary Resolved
Copied to RADOS - Backport #26908: luminous: kv: MergeOperator name() returns string, and caller calls c_str() on the temporary Resolved

History

#1 Updated by Sage Weil 4 months ago

  • Backport set to mimic,luminous

#2 Updated by Kefu Chai 4 months ago

  • Status changed from In Progress to Need Review

#3 Updated by Kefu Chai 4 months ago

  • Status changed from Need Review to Pending Backport

#4 Updated by Patrick Donnelly 4 months ago

  • Copied to Backport #26907: mimic: kv: MergeOperator name() returns string, and caller calls c_str() on the temporary added

#5 Updated by Patrick Donnelly 4 months ago

  • Copied to Backport #26908: luminous: kv: MergeOperator name() returns string, and caller calls c_str() on the temporary added

#6 Updated by Nathan Cutler 3 months ago

  • Status changed from Pending Backport to Resolved

Also available in: Atom PDF