feat: add debug memory tracker and harden allocations

Introduce a thread-safe memory tracking system in debug builds and
harden dynamic allocations, sanitizing cache and input sizes.

Memory Tracking & Cleanup:
- Implement thread-safe allocation tracking in debug builds using
  mutex-protected wrappers for CALLOC, REALLOC, STRDUP, STRNDUP,
  REALPATH, and FREE.
- Track source file, function, and line numbers of all allocations in
  a singly-linked list.
- Register mem_cleanup via atexit in config.c to release remaining
  tracked memory and headers at exit.

Robust Allocations & Failure Hardening:
- Harden LinkTable_add, add_arg, and write_memory_callback by checking
  reallocations for success before incrementing state counters (size,
  argc, curr_size).
- Prevent integer overflows in write_memory_callback size checks.

Cache & Link Table Sanitization:
- Rename LinkTable.num to LinkTable.size for clarity.
- Sanitize the loaded disk link table size in LinkTable_disk_open,
  deleting the corrupted cache and returning NULL on invalid size.
- Simplify segment count verification in Meta_read, checking against
  dynamic limits and returning EBADMSG on invalid sizes.

Option Removal & Bug Fixes:
- Remove --max-seg-count CLI option and CONFIG.max_segbc.
- Update getopt indices in parse_arg_list to avoid mismatches.
- Fix a memory leak in sonic_gen_auth_str by freeing pwd_salt.
- Remove outdated staged files note from clang-format hook name.

Author: fangfufu

.pre-commit-config.yaml

@@ -26,7 +26,7 @@ repos:
 -   repo: local
     hooks:
     -   id: clang-format
-        name: clang-format (formatted files must be manual re-staged)
+        name: clang-format
         entry: clang-format -i
         language: system
         files: \.(c|h)$

src/cache.c

@@ -48,7 +48,7 @@ char *CacheSystem_get_cache_dir(void)
 
     const char *xdg_cache_home = getenv("XDG_CACHE_HOME");
     if (xdg_cache_home) {
-        cache_dir = strndup(xdg_cache_home, PATH_MAX);
+        cache_dir = STRNDUP(xdg_cache_home, PATH_MAX);
     } else {
         const char *user_home = getenv("HOME");
         if (user_home) {
@@ -59,9 +59,10 @@ char *CacheSystem_get_cache_dir(void)
              * XDG_CACHE_HOME and HOME already are full paths. Not relying
              * on environment PWD since it too may be undefined.
              */
-            const char *cur_dir = realpath("./", NULL);
+            char *cur_dir = REALPATH("./", NULL);
             if (cur_dir) {
                 cache_dir = path_append(cur_dir, default_cache_subdir);
+                FREE(cur_dir);
             } else {
                 lprintf(fatal, "Could not create cache directory\n");
             }
@@ -216,8 +217,6 @@ static int Meta_read(Cache *cf)
         return EIO;
     }
 
-    int nmemb = 0;
-
     if (1 != fread(&cf->time, sizeof(long), 1, fp)
         || 1 != fread(&cf->content_length, sizeof(off_t), 1, fp)
         || 1 != fread(&cf->blksz, sizeof(int), 1, fp)
@@ -238,16 +237,36 @@ static int Meta_read(Cache *cf)
         lprintf(warning, "Warning: cf->blksz != CONFIG.data_blksz\n");
     }
 
-    if (cf->segbc > CONFIG.max_segbc) {
-        lprintf(error, "Error: segbc: %ld\n", cf->segbc);
-        return EFBIG;
+    if (cf->content_length <= 0 || cf->blksz <= 0) {
+        lprintf(error, "Error: invalid metadata sizes\n");
+        return EBADMSG;
+    }
+
+    if (cf->content_length > INT64_MAX - cf->blksz) {
+        lprintf(error, "Error: segbc upper bound overflow\n");
+        return EBADMSG;
+    }
+
+    off_t max_segbc = cf->content_length / cf->blksz;
+
+    if ((cf->content_length % cf->blksz) != 0) {
+        max_segbc += 1;
+    }
+
+    if (max_segbc > INT_MAX) {
+        max_segbc = INT_MAX;
+    }
+
+    if (cf->segbc <= 0 || cf->segbc > max_segbc) {
+        lprintf(error, "Error: invalid segbc size: %ld\n", cf->segbc);
+        return EBADMSG;
     }
 
     /*
      * Allocate memory for all segments, and read them in
      */
     cf->seg = CALLOC(cf->segbc, sizeof(Seg));
-    nmemb = fread(cf->seg, sizeof(Seg), cf->segbc, fp);
+    long nmemb = fread(cf->seg, sizeof(Seg), cf->segbc, fp);
 
     /*
      * We shouldn't have gone past the end of the file
@@ -256,8 +275,7 @@ static int Meta_read(Cache *cf)
         /*
          * reached EOF
          */
-        lprintf(error, "attempted to read past the end of the \
-file!\n");
+        lprintf(error, "attempted to read past the end of the file!\n");
         return EBADMSG;
     }
 
@@ -706,7 +724,7 @@ int Cache_create(const char *path)
     lprintf(debug, "Creating cache files for %s.\n", fn);
 
     Cache *cf = Cache_alloc();
-    cf->path = strndup(fn, PATH_MAX);
+    cf->path = STRNDUP(fn, PATH_MAX);
     cf->time = this_link->time;
     cf->content_length = this_link->content_length;
     cf->blksz = CONFIG.data_blksz;
@@ -814,7 +832,7 @@ Cache *Cache_open(const char *fn)
         fn = link->sonic.id;
     }
 
-    cf->path = strndup(fn, PATH_MAX);
+    cf->path = STRNDUP(fn, PATH_MAX);
 
     /*
      * Associate the cache structure with a link

src/config.c

@@ -1,7 +1,9 @@
 #include "config.h"
 
 #include "log.h"
+#include "util.h"
 #include <stddef.h>
+#include <stdlib.h>
 
 
 ConfigStruct CONFIG;
@@ -48,8 +50,6 @@ void Config_init(void)
 
     CONFIG.data_blksz = DEFAULT_DATA_BLKSZ;
 
-    CONFIG.max_segbc = DEFAULT_MAX_SEGBC;
-
     /*-------------- Sonic related -------------*/
     CONFIG.sonic_username = NULL;
 
@@ -58,4 +58,5 @@ void Config_init(void)
     CONFIG.sonic_id3 = 0;
 
     CONFIG.sonic_insecure = 0;
+    atexit(mem_cleanup);
 }

src/config.h

@@ -33,13 +33,6 @@
  */
 #define DEFAULT_DATA_BLKSZ (DEFAULT_DATA_BLKSZ_MB * 1024 * 1024)
 
-/**
- * \brief Maximum segment block count
- * \details This is set to 128*1024 blocks, which uses 128KB. By default,
- * this allows the user to store (128*1024)*(8*1024*1024) = 1TB of data
- */
-#define DEFAULT_MAX_SEGBC (128 * 1024)
-
 #define STR(x) #x
 #define XSTR(x) STR(x)
 

src/fuse_local.c

@@ -167,7 +167,7 @@ static int fs_readdir(const char *path, void *buf, fuse_fill_dir_t dir_add,
     dir_add(buf, ".", NULL, 0, 0);
     dir_add(buf, "..", NULL, 0, 0);
     /* We skip the head link */
-    for (int i = 1; i < linktbl->num; i++) {
+    for (int i = 1; i < linktbl->size; i++) {
         Link *link = linktbl->links[i];
         if (link->type != LINK_INVALID) {
             dir_add(buf, link->linkname, NULL, 0, 0);

src/link.c

@@ -242,7 +242,7 @@ static void LinkTable_uninitialised_fill(LinkTable *linktbl)
      * Start all uninitialized requests once
      */
     int total_uninitialized = 0;
-    for (int i = 0; i < linktbl->num; i++) {
+    for (int i = 0; i < linktbl->size; i++) {
         Link *this_link = linktbl->links[i];
         if (this_link->type == LINK_UNINITIALISED_FILE
             || this_link->type == LINK_UNINITIALISED_DIR) {
@@ -260,7 +260,7 @@ static void LinkTable_uninitialised_fill(LinkTable *linktbl)
     int j = 0;
     do {
         u = 0;
-        for (int i = 0; i < linktbl->num; i++) {
+        for (int i = 0; i < linktbl->size; i++) {
             Link *this_link = linktbl->links[i];
             if (this_link->type == LINK_UNINITIALISED_FILE
                 || this_link->type == LINK_UNINITIALISED_DIR) {
@@ -284,7 +284,7 @@ static void LinkTable_uninitialised_fill(LinkTable *linktbl)
             int n_running = curl_multi_perform_once();
 
             if (n_running == 0) {
-                for (int i = 0; i < linktbl->num; i++) {
+                for (int i = 0; i < linktbl->size; i++) {
                     Link *this_link = linktbl->links[i];
                     if (this_link->type == LINK_UNINITIALISED_FILE
                         || this_link->type == LINK_UNINITIALISED_DIR) {
@@ -367,14 +367,10 @@ LinkTable *LinkSystem_init(const char *url)
 
 void LinkTable_add(LinkTable *linktbl, Link *link)
 {
-    linktbl->num++;
-    Link **tmp = (Link **)realloc((void *)linktbl->links,
-                                  linktbl->num * sizeof(Link *));
-    if (!tmp) {
-        lprintf(fatal, "realloc() failure!\n");
-    }
-    linktbl->links = tmp;
-    linktbl->links[linktbl->num - 1] = link;
+    linktbl->links = (Link **)REALLOC(
+        (void *)linktbl->links, ((size_t)linktbl->size + 1) * sizeof(Link *));
+    linktbl->links[linktbl->size] = link;
+    linktbl->size++;
 }
 
 static LinkType linkname_to_LinkType(const char *linkname)
@@ -479,7 +475,7 @@ static void HTML_to_LinkTable(const char *url, GumboNode *node,
         if ((type == LINK_UNINITIALISED_DIR)
             || (type == LINK_UNINITIALISED_FILE)) {
             int identical_link_found = 0;
-            for (int i = 0; i < linktbl->num; i++) {
+            for (int i = 0; i < linktbl->size; i++) {
                 if (linknames_equal(relative_url,
                                     linktbl->links[i]->linkname)) {
                     identical_link_found = 1;
@@ -544,7 +540,7 @@ static void LinkTable_fill(LinkTable *linktbl)
 {
     Link *head_link = linktbl->links[0];
     lprintf(debug, "Filling %s\n", head_link->f_url);
-    for (int i = 1; i < linktbl->num; i++) {
+    for (int i = 1; i < linktbl->size; i++) {
         Link *this_link = linktbl->links[i];
         /* Some web sites use characters in their href attributes that really
            shouldn't be in their href attributes, most commonly spaces. And
@@ -582,9 +578,13 @@ static void LinkTable_fill(LinkTable *linktbl)
 void LinkTable_free(LinkTable *linktbl)
 {
     if (linktbl) {
-        for (int i = 0; i < linktbl->num; i++) {
-            LinkTable_free(linktbl->links[i]->next_table);
-            FREE(linktbl->links[i]);
+        for (int i = 0; i < linktbl->size; i++) {
+            Link *entry = linktbl->links ? linktbl->links[i] : NULL;
+            if (!entry) {
+                continue;
+            }
+            LinkTable_free(entry->next_table);
+            FREE(entry);
         }
         FREE(linktbl->links);
         FREE(linktbl);
@@ -599,7 +599,7 @@ void LinkTable_print(LinkTable *linktbl)
         lprintf(info, " LinkTable %p for %s\n", (void *)linktbl,
                 linktbl->links[0]->f_url);
         lprintf(info, "--------------------------------------------\n");
-        for (int i = 0; i < linktbl->num; i++) {
+        for (int i = 0; i < linktbl->size; i++) {
             Link *this_link = linktbl->links[i];
             lprintf(info, "%d %c %lu %s %s\n", i, this_link->type,
                     this_link->content_length, this_link->linkname,
@@ -618,7 +618,7 @@ void LinkTable_print(LinkTable *linktbl)
 LinkTable *LinkTable_alloc(const char *url)
 {
     LinkTable *linktbl = CALLOC(1, sizeof(LinkTable));
-    linktbl->num = 0;
+    linktbl->size = 0;
     linktbl->index_time = 0;
     linktbl->links = NULL;
 
@@ -629,7 +629,7 @@ LinkTable *LinkTable_alloc(const char *url)
     Link *head_link = Link_new("/", LINK_HEAD);
     LinkTable_add(linktbl, head_link);
     strncpy(head_link->f_url, url, PATH_MAX);
-    assert(linktbl->num == 1);
+    assert(linktbl->size == 1);
     return linktbl;
 }
 
@@ -743,12 +743,12 @@ int LinkTable_disk_save(LinkTable *linktbl, const char *dirn)
     }
 
     lprintf(debug, "linktbl->index_time: %ld\n", (long)linktbl->index_time);
-    if (fwrite(&linktbl->num, sizeof(int), 1, fp) != 1
+    if (fwrite(&linktbl->size, sizeof(int), 1, fp) != 1
         || fwrite(&linktbl->index_time, sizeof(time_t), 1, fp) != 1) {
         lprintf(error, "Failed to save the header of %s!\n", path);
     }
     FREE(path);
-    for (int i = 0; i < linktbl->num; i++) {
+    for (int i = 0; i < linktbl->size; i++) {
         ignore_value(
             fwrite(linktbl->links[i]->linkname, sizeof(char), NAME_MAX, fp));
         ignore_value(
@@ -788,7 +788,8 @@ LinkTable *LinkTable_disk_open(const char *dirn)
     }
 
     LinkTable *linktbl = CALLOC(1, sizeof(LinkTable));
-    if (fread(&linktbl->num, sizeof(int), 1, fp) != 1
+    int sz = 0;
+    if (fread(&sz, sizeof(int), 1, fp) != 1
         || fread(&linktbl->index_time, sizeof(time_t), 1, fp) != 1) {
         lprintf(error, "Failed to read the header of %s!\n", path);
         fclose(fp);
@@ -797,10 +798,48 @@ LinkTable *LinkTable_disk_open(const char *dirn)
         FREE(path);
         return NULL;
     }
+
+    long entry_size = (long)(NAME_MAX + PATH_MAX + sizeof(LinkType)
+                             + sizeof(size_t) + sizeof(long));
+    if (fseek(fp, 0, SEEK_END) != 0) {
+        lprintf(error, "Failed to seek %s!\n", path);
+        fclose(fp);
+        LinkTable_free(linktbl);
+        LinkTable_disk_delete(dirn);
+        FREE(path);
+        return NULL;
+    }
+    long file_size = ftell(fp);
+    if (file_size < 0
+        || fseek(fp, (long)(sizeof(int) + sizeof(time_t)), SEEK_SET) != 0) {
+        lprintf(error, "Failed to inspect %s!\n", path);
+        fclose(fp);
+        LinkTable_free(linktbl);
+        LinkTable_disk_delete(dirn);
+        FREE(path);
+        return NULL;
+    }
+
+    long max_entries
+        = (file_size - (long)(sizeof(int) + sizeof(time_t))) / entry_size;
+
+    if (sz < 1 || max_entries < sz) {
+        lprintf(error, "Invalid link table size: %d in %s!\n", sz, path);
+        fclose(fp);
+        LinkTable_free(linktbl);
+        LinkTable_disk_delete(dirn);
+        FREE(path);
+        return NULL;
+    }
+
+    linktbl->size = sz;
     lprintf(debug, "linktbl->index_time: %ld\n", (long)linktbl->index_time);
 
-    linktbl->links = (Link **)CALLOC(linktbl->num, sizeof(Link *));
-    for (int i = 0; i < linktbl->num; i++) {
+    linktbl->links
+        = (Link **)CALLOC( // NOLINT(clang-analyzer-optin.taint.TaintedAlloc)
+            sz, sizeof(Link *));
+
+    for (int i = 0; i < sz; i++) {
         linktbl->links[i] = CALLOC(1, sizeof(Link));
         if (fread(linktbl->links[i]->linkname, sizeof(char), NAME_MAX, fp)
                 != NAME_MAX
@@ -905,7 +944,7 @@ static Link *path_to_Link_recursive(char *path, LinkTable *linktbl)
         /*
          * We cannot find another '/', we have reached the last level
          */
-        for (int i = 1; i < linktbl->num; i++) {
+        for (int i = 1; i < linktbl->size; i++) {
             if (!strncmp(path, linktbl->links[i]->linkname, NAME_MAX)) {
                 /*
                  * We found our link
@@ -928,7 +967,7 @@ static Link *path_to_Link_recursive(char *path, LinkTable *linktbl)
          * move the pointer past the '/'
          */
         char *next_path = slash + 1;
-        for (int i = 1; i < linktbl->num; i++) {
+        for (int i = 1; i < linktbl->size; i++) {
             if (!strncmp(path, linktbl->links[i]->linkname, NAME_MAX)) {
                 /*
                  * The next sub-directory exists
@@ -964,7 +1003,7 @@ Link *path_to_Link(const char *path)
             (unsigned long)pthread_self());
 
     PTHREAD_MUTEX_LOCK(&link_lock);
-    char *new_path = strndup(path, PATH_MAX);
+    char *new_path = STRNDUP(path, PATH_MAX);
     if (!new_path) {
         lprintf(fatal, "cannot allocate memory\n");
     }

src/link.h

@@ -33,7 +33,7 @@ typedef enum {
  * \details index 0 contains the Link for the base URL
  */
 struct LinkTable {
-    int num;
+    int size;
     time_t index_time;
     Link **links;
 };