Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

command_seqno should wrap #571

Closed
armersong opened this issue Oct 26, 2018 · 2 comments
Closed

command_seqno should wrap #571

armersong opened this issue Oct 26, 2018 · 2 comments
Assignees
Milestone

Comments

@armersong
Copy link

I did a long loop test with rust binding. There is a "*** buffer overflow detected ***" error and the issue can be duplicated. It seems the buffer is small. Please check

version:
paho.mqtt.c-1.3.0

debug info:
#11 MQTTAsync_persistCommand (qcmd=0x7ffff646c584) at src/MQTTAsync.c:695
695 sprintf(key, "%s%d", PERSISTENCE_COMMAND_KEY, ++aclient->command_seqno);
(gdb) p aclient->command_seqno
$6 = 1000000
(gdb) p key
$7 = "c-100000"
(gdb) p *aclient
$5 = {serverURI = 0x7ffff64222d4 "bluesilva.net:1883", ssl = 0, c = 0x7ffff64a4004, cl = 0x55555557c0a0 <paho_mqtt::async_client::AsyncClient::on_connection_lost::h98ec138cadd93f1d>,
ma = 0x55555557c770 <paho_mqtt::async_client::AsyncClient::on_message_arrived::hb901e6c91ebb32e6>, dc = 0x0, context = 0x7fffffffc5d0, connected = 0x0, connected_context = 0x0, connect = {
type = 1, onSuccess = 0x0, onFailure = 0x55555557ad30 <paho_mqtt::async_client::Token::on_failure::h734c691fd930d752>, token = 0, context = 0x7ffff64a40f0, start_time = timeval = {
tv_sec = 1540552642, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
tv_usec = 875619}, details = {sub = {count = 0, topics = 0x0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
qoss = 0x0}, unsub = {count = 0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
topics = 0x0}, pub = {
destinationName = 0x400000000 <error: Cannot access memory at address 0x400000000>, payloadlen = 0, payload = 0x0, qos = 0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
retained = 0}, dis = {internal = 0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
timeout = 4}, conn = {
currentURI = 0, MQTTVersion = 4}}}, disconnect = {type = 0, onSuccess = 0x0, onFailure = 0x0, token = 0, context = 0x0, start_time = timeval = {tv_sec = 0, tv_usec = 0}, details = {
Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
sub = {count = 0, topics = 0x0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
qoss = 0x0}, unsub = {count = 0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
topics = 0x0}, pub = {destinationName = 0x0, payloadlen = 0, payload = 0x0, qos = 0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
retained = 0}, dis = {
internal = 0, Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'startswith':
timeout = 0}, conn = {currentURI = 0, MQTTVersion = 0}}}, pending_write = 0x0, responses = 0x7ffff6453204, command_seqno = 1000000, pack = 0x0,
createOptions = 0x7ffff6499524, shouldBeConnected = 1, automaticReconnect = 0, minRetryInterval = 1, maxRetryInterval = 60, serverURIcount = 0, serverURIs = 0x0, connectTimeout = 30,
currentInterval = 0, lastConnectionFailedTime = timeval = {tv_sec = 0, tv_usec = 0}, retrying = 0, reconnectNow = 0}

backtrace:
Thread 1 "async_subscribe" received signal SIGABRT, Aborted.
0x00007ffff6f4d428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c:
(gdb) bt
#0 0x00007ffff6f4d428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007ffff6f4f02a in __GI_abort () at abort.c:89
#2 0x00007ffff6f8f7ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff70a749f "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007ffff703115c in __GI___fortify_fail (msg=, msg@entry=0x7ffff70a7430 "buffer overflow detected") at fortify_fail.c:37
#4 0x00007ffff702f160 in __GI___chk_fail () at chk_fail.c:28
#5 0x00007ffff702e6c9 in _IO_str_chk_overflow (fp=, c=) at vsprintf_chk.c:31
#6 0x00007ffff6f936b0 in __GI__IO_default_xsputn (f=0x7fffffffbe50, data=, n=7) at genops.c:455
#7 0x00007ffff6f65e00 in _IO_vfprintf_internal (s=s@entry=0x7fffffffbe50, format=, format@entry=0x7ffff7b3812d "%s%d", ap=ap@entry=0x7fffffffbf88) at vfprintf.c:1631
#8 0x00007ffff702e754 in ___vsprintf_chk (s=0x7fffffffc06f "c-100000", flags=1, slen=9, format=0x7ffff7b3812d "%s%d", args=args@entry=0x7fffffffbf88) at vsprintf_chk.c:82
#9 0x00007ffff702e6ad in _sprintf_chk (s=s@entry=0x7fffffffc06f "c-100000", flags=flags@entry=1, slen=slen@entry=9, format=format@entry=0x7ffff7b3812d "%s%d") at sprintf_chk.c:31
#10 0x00007ffff7b2b5d1 in sprintf (__fmt=0x7ffff7b3812d "%s%d", __s=0x7fffffffc06f "c-100000") at /usr/include/x86_64-linux-gnu/bits/stdio2.h:33
#11 MQTTAsync_persistCommand (qcmd=0x7ffff646c584) at src/MQTTAsync.c:695
#12 MQTTAsync_addCommand (command=command@entry=0x7ffff646c584, command_size=command_size@entry=8) at src/MQTTAsync.c:901
#13 0x00007ffff7b2ee1f in MQTTAsync_send (handle=handle@entry=0x7ffff64a1004, destinationName=destinationName@entry=0x7ffff646b270 "t/375136", payloadlen=31, payload=0x7ffff6458480, qos=1,
retained=0, response=0x7fffffffc3d8) at src/MQTTAsync.c:2852
#14 0x00007ffff7b2eefe in MQTTAsync_sendMessage (handle=0x7ffff64a1004, destinationName=0x7ffff646b270 "t/375136", message=0x7ffff6471858, response=0x7fffffffc3d8) at src/MQTTAsync.c:2878
#15 0x000055555557d642 in paho_mqtt::async_client::AsyncClient::publish::he876860930413357 (self=0x7fffffffc5d0, msg=Message = {...}) at src/async_client.rs:748
#16 0x000055555556bf40 in async_subscribe::main::h1b3319aa5505cfea () at examples/async_subscribe.rs:125
#17 0x000055555556c9b0 in std::rt::lang_start::
$u7b$$u7b$closure$u7d$$u7d$::h0e475f0414f4d345 () at /checkout/src/libstd/rt.rs:74
#18 0x00005555556b0293 in std::rt::lang_start_internal::
$u7b$$u7b$closure$u7d$$u7d$::h2d27f966df62f613 () at libstd/rt.rs:59
#19 std::panicking::try::do_call::h0208f3354fcc3e87 () at libstd/panicking.rs:310
#20 0x00005555556cb45a in __rust_maybe_catch_panic () at libpanic_unwind/lib.rs:105
#21 0x00005555556b1456 in std::panicking::try::h8cfae114cfc320aa () at libstd/panicking.rs:289
#22 std::panic::catch_unwind::h9e48b3e6dc9f9394 () at libstd/panic.rs:392
#23 std::rt::lang_start_internal::h56481fc9d09c36f4 () at libstd/rt.rs:58
#24 0x000055555556c988 in std::rt::lang_start::h0620b1b50fc85b20 (main=0x55555556b970 <async_subscribe::main::h1b3319aa5505cfea>, argc=1, argv=0x7fffffffd2f8)
at /checkout/src/libstd/rt.rs:74
#25 0x000055555556c2ea in main ()

@icraggs icraggs self-assigned this Oct 29, 2018
@icraggs icraggs added the bug label Oct 29, 2018
@icraggs icraggs added this to the 1.3.1 milestone Oct 29, 2018
@icraggs
Copy link
Contributor

icraggs commented Oct 29, 2018

So it seems like you've hit the million messages. We can increase the PERSISTENCE_MAX_KEY_LENGTH from 8 to 10 for instance, which will give a maximum of 100 million.

Or we can make the command sequence number wrap at a million. Storing one million commands in persistence simultaneously of this library would not be a good approach anyway.

@icraggs icraggs changed the title SIGABRT error command_seqno should wrap Oct 29, 2018
@armersong
Copy link
Author

ok

@icraggs icraggs modified the milestones: 1.3.1, 1.3.2 Jul 22, 2019
@icraggs icraggs modified the milestones: 1.3.2, 1.3.3 Mar 30, 2020
@icraggs icraggs mentioned this issue Jun 27, 2020
icraggs added a commit that referenced this issue Jun 29, 2020
@icraggs icraggs closed this as completed Aug 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants