Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sstables/compressed_file_data_source_impl may segfault if the file is corrupt and EOF is reached prematurely #13599

Closed
bhalevy opened this issue Apr 20, 2023 · 1 comment
Closed

sstables/compressed_file_data_source_impl may segfault if the file is corrupt and EOF is reached prematurely #13599

bhalevy opened this issue Apr 20, 2023 · 1 comment
Assignees
@denesb @bhalevy
Labels
P2 High Priority
Milestone
5.3

Comments

@bhalevy
Copy link
Member

bhalevy commented Apr 20, 2023

In compressed_file_data_source_impl::get, read_exactly might return an empty temporary_buffer if we reach EOF on the uncompressed file prematurely.
See

scylladb/sstables/compress.cc

Line 391 in 6ca1b14

return _input_stream->read_exactly(addr.chunk_len).then([this, addr](temporary_buffer<char> buf) {

If that happens, we may try to dereference a null pointer returned by buf.get() in

scylladb/sstables/compress.cc

Line 399 in 6ca1b14

auto expected_checksum = read_be<uint32_t>(buf.get() + compressed_len);

Instead, we should throw an exception about the corrupt file.
bhalevy added a commit to bhalevy/scylla that referenced this issue Apr 20, 2023
@bhalevy
sstables: compressed_file_data_source_impl: get: throw malformed_ssta…
cbf4c9c 
…ble_exception on premature eof

Currently, the reader might dereference a null pointer
if the input stream reaches eof prematurely,
and read_exactly returns an empty temporary_buffer.

Detect this condition before dereferencing the buffer
and sstables::malformed_sstable_exception.

Fixes scylladb#13599

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>
@bhalevy bhalevy mentioned this issue Apr 20, 2023
Closed
@DoronArazii DoronArazii added the P2 High Priority label Apr 20, 2023
@DoronArazii DoronArazii added this to the 5.3 milestone Apr 20, 2023
bhalevy added a commit to bhalevy/scylla that referenced this issue Apr 20, 2023
@bhalevy
sstables: compressed_file_data_source_impl: get: throw malformed_ssta…
f118e7b 
…ble_exception on premature eof

Currently, the reader might dereference a null pointer
if the input stream reaches eof prematurely,
and read_exactly returns an empty temporary_buffer.

Detect this condition before dereferencing the buffer
and sstables::malformed_sstable_exception.

Fixes scylladb#13599

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>
bhalevy added a commit to bhalevy/scylla that referenced this issue May 16, 2023
@bhalevy
test: sstable_3_x_test: add test_compression_premature_eof
98d1ccf 
Reproduces scylladb#13599 and verifies the fix.

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>
@bhalevy bhalevy mentioned this issue May 16, 2023
Closed
denesb pushed a commit that referenced this issue May 17, 2023
@bhalevy @denesb
test: sstable_3_x_test: add test_compression_premature_eof
302a894 
Reproduces #13599 and verifies the fix.

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>

Closes #13903
denesb pushed a commit that referenced this issue Dec 15, 2023
@bhalevy @denesb
sstables: compressed_file_data_source_impl: get: throw malformed_ssta…
e1f3a38 
…ble_exception on premature eof

Currently, the reader might dereference a null pointer
if the input stream reaches eof prematurely,
and read_exactly returns an empty temporary_buffer.

Detect this condition before dereferencing the buffer
and sstables::malformed_sstable_exception.

Fixes #13599

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>

Closes #13600

(cherry picked from commit 77b70db)
@denesb
Copy link
Contributor

denesb commented Dec 15, 2023

Backported to 5.2.

denesb pushed a commit that referenced this issue Dec 15, 2023
@bhalevy @denesb
sstables: compressed_file_data_source_impl: get: throw malformed_ssta…
6d7b2bc 
…ble_exception on premature eof

Currently, the reader might dereference a null pointer
if the input stream reaches eof prematurely,
and read_exactly returns an empty temporary_buffer.

Detect this condition before dereferencing the buffer
and sstables::malformed_sstable_exception.

Fixes #13599

Signed-off-by: Benny Halevy <bhalevy@scylladb.com>

Closes #13600

(cherry picked from commit 77b70db)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@denesb denesb

@bhalevy bhalevy

Labels
P2 High Priority
Projects
None yet
Milestone
5.3
4 participants
@denesb @bhalevy @scylladb-promoter @DoronArazii