Files
scylladb/cql3/query_processor.cc
Tomasz Grabiec ec262ab3e9 cql3: Fix use-after-free on statement
Reported by Pekka:

READ of size 8 at 0x611000062ee8 thread T6
    #0 0x64d20f in std::unique_ptr<cql3::attributes, std::default_delete<cql3::attributes> >::get() const /usr/include/c++/4.9.2/bits/unique_ptr.h:305
    #1 0x641532 in std::unique_ptr<cql3::attributes, std::default_delete<cql3::attributes> >::operator->() const /usr/include/c++/4.9.2/bits/unique_ptr.h:299
    #2 0x63af5b in cql3::statements::modification_statement::get_time_to_live(cql3::query_options const&) const cql3/statements/modification_statement.hh:190
    #3 0x61e072 in _ZZN4cql310statements22modification_statement22make_update_parametersE13lw_shared_ptrISt6vectorI13basic_sstringIcjLj31EESaIS5_EEES2_IS3_INSt12experimental8optionalIS5_EESaISB_EEERKNS_13query_optionsEblENKUlT_E_clINSA_ISt13unordered_mapIS5_St3mapIjN5boost3anyESt4lessIjESaISt4pairIKjSO_EEE15serialized_hash16serialized_equalSaISR_IKS5_SV_EEEEEEEDaSI_ (/home/penberg/urchin/build/debug/seastar+0x61e072)
    #4 0x625ce1 in apply core/apply.hh:34
    #5 0x625df4 in apply<cql3::statements::modification_statement::make_update_parameters(lw_shared_ptr<std::vector<basic_sstring<char, unsigned int, 31u> > >, lw_shared_ptr<std::vector<std::experimental::optional<basic_sstring<char, unsigned int, 31u> > > >, const cql3::query_options&, bool, int64_t)::<lambda(auto:18)>, std::experimental::optional<std::unordered_map<basic_sstring<char, unsigned int, 31u>, std::map<unsigned int, boost::any, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, boost::any> > >, serialized_hash, serialized_equal, std::allocator<std::pair<const basic_sstring<char, unsigned int, 31u>, std::map<unsigned int, boost::any, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, boost::any> > > > > > > > core/apply.hh:41
    #6 0x628354 in _ZZN6futureIINSt12experimental8optionalISt13unordered_mapI13basic_sstringIcjLj31EESt3mapIjN5boost3anyESt4lessIjESaISt4pairIKjS7_EEE15serialized_hash16serialized_equalSaISA_IKS4_SE_EEEEEEE4thenIZN4cql310statements22modification_statement22make_update_parametersE13lw_shared_ptrISt6vectorIS4_SaIS4_EEESR_ISS_INS1_IS4_EESaISW_EEERKNSO_13query_optionsEblEUlT_E_EENSt9result_ofIFT_OSL_EE4typeEOS16_NSt9enable_ifIXsr9is_futureIIS1A_EE5valueEPvE4typeEENUlRS13_E_clI12future_stateIISL_EEEEDaRS16_ (/home/penberg/urchin/build/debug/seastar+0x628354)
    #7 0x628503 in _ZZN6futureIINSt12experimental8optionalISt13unordered_mapI13basic_sstringIcjLj31EESt3mapIjN5boost3anyESt4lessIjESaISt4pairIKjS7_EEE15serialized_hash16serialized_equalSaISA_IKS4_SE_EEEEEEE8scheduleIZNSM_4thenIZN4cql310statements22modification_statement22make_update_parametersE13lw_shared_ptrISt6vectorIS4_SaIS4_EEESS_IST_INS1_IS4_EESaISX_EEERKNSP_13query_optionsEblEUlT_E_EENSt9result_ofIFT_OSL_EE4typeEOS17_NSt9enable_ifIXsr9is_futureIIS1B_EE5valueEPvE4typeEEUlRS14_E_EEvS1C_EN21task_with_ready_state3runEv (/home/penberg/urchin/build/debug/seastar+0x628503)
    #8 0x7a6600 in reactor::run_tasks(circular_buffer<std::unique_ptr<task, std::default_delete<task> >, std::allocator<std::unique_ptr<task, std::default_delete<task> > > >&, unsigned long) core/reactor.cc:691
    #9 0x7a8ccc in reactor::run() core/reactor.cc:785
    #10 0x7b0bef in smp::configure(boost::program_options::variables_map)::{lambda()#1}::operator()() const (/home/penberg/urchin/build/debug/seastar+0x7b0bef)
    #11 0x84011d in _M_invoke /usr/include/c++/4.9.2/functional:2039
    #12 0x860c97 in std::function<void ()>::operator()() const /usr/include/c++/4.9.2/functional:2439
    #13 0x8e45fa in posix_thread::start_routine(void*) core/posix.cc:50
    #14 0x7f25abb05529 in start_thread (/lib64/libpthread.so.0+0x7529)
    #15 0x7f25ab84179c in __clone (/lib64/libc.so.6+0x10079c)

0x611000062ee8 is located 40 bytes inside of 216-byte region [0x611000062ec0,0x611000062f98)
freed by thread T6 here:
    #0 0x7f25af4bf64f in operator delete(void*) (/lib64/libasan.so.1+0x5864f)
    #1 0x684dbf in shared_ptr_count_for<cql3::statements::update_statement>::~shared_ptr_count_for() core/shared_ptr.hh:261
    #2 0x63de36 in shared_ptr<cql3::cql_statement>::~shared_ptr() core/shared_ptr.hh:326
    #3 0x772711 in cql3::statements::parsed_statement::prepared::~prepared() cql3/statements/parsed_statement.hh:60
    #4 0x77591d in std::default_delete<cql3::statements::parsed_statement::prepared>::operator()(cql3::statements::parsed_statement::prepared*) const /usr/include/c++/4.9.2/bits/unique_ptr.h:76
    #5 0x772cef in std::unique_ptr<cql3::statements::parsed_statement::prepared, std::default_delete<cql3::statements::parsed_statement::prepared> >::~unique_ptr() /usr/include/c++/4.9.2/bits/unique_ptr.h:236
    #6 0x76c8ea in cql3::query_processor::process(std::experimental::basic_string_view<char, std::char_traits<char> > const&, service::query_state&, cql3::query_options&) cql3/query_processor.cc:51
    #7 0x554e9c in cql_server::connection::process_query(unsigned short, temporary_buffer<char>) transport/server.cc:408
    #8 0x553a7a in cql_server::connection::process_request()::{lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)#1}::operator()(future<std::experimental::optional<cql_binary_frame_v3> >&&) const::{lambda(temporary_buffer<char>)#1}::operator()(temporary_buffer) const (/home/penberg/urchin/build/debug/seastar+0x553a7a)
    #9 0x55df9e in apply core/apply.hh:34
    #10 0x55e0b1 in apply<cql_server::connection::process_request()::<lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)>::<lambda(temporary_buffer<char>)>, temporary_buffer<char> > core/apply.hh:41
    #11 0x55e43b in then<cql_server::connection::process_request()::<lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)>::<lambda(temporary_buffer<char>)> > core/future.hh:480
    #12 0x5542c1 in cql_server::connection::process_request()::{lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)#1}::operator()(future<std::experimental::optional<cql_binary_frame_v3> >&&) const (/home/penberg/urchin/build/debug/seastar+0x5542c1)
    #13 0x564846 in _ZZNO6futureIINSt12experimental8optionalI19cql_binary_frame_v3EEEE12then_wrappedIZN10cql_server10connection15process_requestEvEUlOS4_E_EENSt9result_ofIFT_S4_EE4typeEOSB_ENUlRT_E_clI12future_stateIIS3_EEEEDaRSB_ (/home/penberg/urchin/build/debug/seastar+0x564846)
    #14 0x5649c7 in _ZZN7promiseIINSt12experimental8optionalI19cql_binary_frame_v3EEEE8scheduleIZNO6futureIIS3_EE12then_wrappedIZN10cql_server10connection15process_requestEvEUlOS7_E_EENSt9result_ofIFT_S7_EE4typeEOSE_EUlRT_E_EEvSI_EN15task_with_state3runEv (/home/penberg/urchin/build/debug/seastar+0x5649c7)
    #15 0x7a6600 in reactor::run_tasks(circular_buffer<std::unique_ptr<task, std::default_delete<task> >, std::allocator<std::unique_ptr<task, std::default_delete<task> > > >&, unsigned long) core/reactor.cc:691
    #16 0x7a8ccc in reactor::run() core/reactor.cc:785
    #17 0x7b0bef in smp::configure(boost::program_options::variables_map)::{lambda()#1}::operator()() const (/home/penberg/urchin/build/debug/seastar+0x7b0bef)
    #18 0x84011d in _M_invoke /usr/include/c++/4.9.2/functional:2039
    #19 0x860c97 in std::function<void ()>::operator()() const /usr/include/c++/4.9.2/functional:2439
    #20 0x8e45fa in posix_thread::start_routine(void*) core/posix.cc:50
    #21 0x7f25abb05529 in start_thread (/lib64/libpthread.so.0+0x7529)

Signed-off-by: Tomasz Grabiec <tgrabiec@cloudius-systems.com>
2015-02-25 12:48:54 +01:00

126 lines
4.7 KiB
C++

/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/*
* Copyright 2015 Cloudius Systems
*
* Modified by Cloudius Systems
*/
#include "cql3/query_processor.hh"
#include "cql3/CqlParser.hpp"
#include "cql3/error_collector.hh"
namespace cql3 {
using namespace statements;
using namespace transport::messages;
thread_local logging::logger log("query_processor");
future<::shared_ptr<result_message>>
query_processor::process(const sstring_view& query_string, service::query_state& query_state, query_options& options)
{
std::unique_ptr<parsed_statement::prepared> p = get_statement(query_string, query_state.get_client_state());
options.prepare(p->bound_names);
auto cql_statement = p->statement;
if (cql_statement->get_bound_terms() != options.get_values().size()) {
throw exceptions::invalid_request_exception("Invalid amount of bind variables");
}
unimplemented::metrics();
#if 0
if (!queryState.getClientState().isInternal)
metrics.regularStatementsExecuted.inc();
#endif
return process_statement(std::move(cql_statement), query_state, options);
}
future<::shared_ptr<result_message>>
query_processor::process_statement(::shared_ptr<cql_statement> statement, service::query_state& query_state,
const query_options& options)
{
#if 0
logger.trace("Process {} @CL.{}", statement, options.getConsistency());
#endif
auto& client_state = query_state.get_client_state();
statement->check_access(client_state);
statement->validate(client_state);
return statement->execute(_proxy, query_state, options)
.then([statement] (auto msg) {
if (msg) {
return make_ready_future<::shared_ptr<result_message>>(std::move(msg));
}
return make_ready_future<::shared_ptr<result_message>>(
::make_shared<result_message::void_message>());
});
}
std::unique_ptr<parsed_statement::prepared>
query_processor::get_statement(const sstring_view& query, service::client_state& client_state)
{
#if 0
Tracing.trace("Parsing {}", queryStr);
#endif
::shared_ptr<parsed_statement> statement = parse_statement(query);
// Set keyspace for statement that require login
auto cf_stmt = dynamic_pointer_cast<cf_statement>(statement);
if (cf_stmt) {
cf_stmt->prepare_keyspace(client_state);
}
#if 0
Tracing.trace("Preparing statement");
#endif
return statement->prepare(_db.local());
}
::shared_ptr<parsed_statement>
query_processor::parse_statement(const sstring_view& query)
{
try {
error_collector<cql3_parser::CqlLexer::RecognizerType> lexer_error_collector(query);
error_collector<cql3_parser::CqlParser::RecognizerType> parser_error_collector(query);
cql3_parser::CqlLexer::InputStreamType input{reinterpret_cast<const ANTLR_UINT8*>(query.begin()), ANTLR_ENC_UTF8, static_cast<ANTLR_UINT32>(query.size()), nullptr};
cql3_parser::CqlLexer lexer{&input};
lexer.set_error_listener(lexer_error_collector);
cql3_parser::CqlParser::TokenStreamType tstream(ANTLR_SIZE_HINT, lexer.get_tokSource());
cql3_parser::CqlParser parser{&tstream};
parser.set_error_listener(parser_error_collector);
auto statement = parser.query();
lexer_error_collector.throw_first_syntax_error();
parser_error_collector.throw_first_syntax_error();
if (!statement) {
// TODO: We should plug into get_rec()->displayRecognitionError and call error_collector from there
throw exceptions::syntax_exception("Parsing failed");
};
return std::move(statement);
} catch (const exceptions::recognition_exception& e) {
throw exceptions::syntax_exception(sprint("Invalid or malformed CQL query string: %s", e.what()));
} catch (const std::exception& e) {
log.error("The statement: {} could not be parsed: {}", query, e.what());
throw exceptions::syntax_exception(sprint("Failed parsing statement: [%s] reason: %s", query, e.what()));
}
}
}