changed 6 years ago
Linked with GitHub

In gdb
watch the value of address of content_type
by watch *(const char **) 0x7fffffffda40
where 0x7fffffffda40 is address of content_type
and it changed in s_recv (zmq recv)

s_recv

static char *s_recv(void *socket) {
  char buffer[256];
  int size = zmq_recv(socket, buffer, 255, 0);
  if (size == -1) return NULL;
  buffer[size] = '\0';

 #if (defined(WIN32))
  return strdup(buffer);
#else
  return strndup(buffer, sizeof(buffer) - 1);
#endif

}

gdb log

(gdb) p iri_serv.http
$3 = {host = 0x5555555f4087 "node10.puyuma.org", path = 0x5555555f406a "/", content_type = 0x5555555f406c "application/json", accept = 0x5555555f406c "application/json", ca_pem = 0x0, port = 14265,
  api_version = 1}
(gdb) p *(const char **) 0x7fffffffda40
$4 = 0x5555555f406c "application/json"
(gdb) c
Continuing.
[New Thread 0x7ffff4fd8700 (LWP 18143)]
[New Thread 0x7fffeffff700 (LWP 18144)]
[New Thread 0x7fffef7fe700 (LWP 18145)]
[New Thread 0x7fffeeffd700 (LWP 18146)]

Thread 1 "storage_zmq" hit Hardware watchpoint 2: *(const char **) 0x7fffffffda40

Old value = 0x5555555f406c "application/json"
New value = 0x5500555f406c <error: Cannot access memory at address 0x5500555f406c>
s_recv (socket=0x555555675c70) at storage/zhelpers.h:58

(gdb) p &buffer
$7 = (char (*)[256]) 0x7fffffffd8a0
(gdb) p buffer
$8 = "sn 1146252 VSSCKIYLDKGHKTMRCXRT9KVLK9DJYMM9DIWANUAENAMUJGUSJRR9DOQRP9XPGGBBZAKD9BITYGMFZ9999 CU9NODE9A9T", '9' <repeats 70 times>, " BKYQKZLFCRZIBVIJ9VQBVPOWI"...

I extend strndup and issue happend in strnlen

char *result;
size_t len = strnlen (buffer, sizeof(buffer)-1);

result = (char *) malloc (len + 1);
if (!result)
  return 0;

result[len] = '\0';
return (char *) memcpy (result, buffer, len);

and extend strnlen
watch point triggered at line 48

47        char *result;                                                                                                                                                                                x
  >x48        char *s = buffer;                                                                                                                                                                            x
   x49        //size_t len = strnlen2 (buffer, sizeof(buffer)-1);                                                                                                                                          x
   x50        size_t len;                                                                                                                                                                                  x
   x51        int n = sizeof(buffer)-1;                                                                                                                                                                    x
   x52        for (len = 0; len < n; len++, s++) {                                                                                                                                                         x
   x53                      if (!*s)                                                                                                                                                                       x
   x54                              break;                                                                                                                                                                 x
   x55              }                                                                                                                                                                                      x
   x56        result = (char *) malloc (len + 1);                                                                                                                                                          x
   x57        if (!result)                                                                                                                                                                                 x
   x58          return 0;                                                                                                                                                                                  x
   x59                                                                                                                                                                                                     x
   x60        result[len] = '\0';                                                                                                                                                                          x
   x61        return (char *) memcpy (result, buffer, len);   
Old value = 0x5555555f3963 "application/json"
New value = 0x5500555f3963 <error: Cannot access memory at address 0x5500555f3963>
s_recv (socket=0x555555674c70) at storage/storage_zmq_client.c:48

bt log in GDB with segmentation fault

<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".  f7fcef In: __strlen_avx2                                                                                                                                   L62   PC: 0x7ffff68d65a1
Thread 1 "storage_zmq" received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
#1  0x00007ffff67a54d3 in _IO_vfprintf_internal (s=s@entry=0x7fffffffbc90,
    format=format@entry=0x5555555f4fe0 "POST %s HTTP/1.1\r\nHost: %s\r\nX-IOTA-API-Version: %d\r\nContent-Type: %s\r\nAccept: %s\r\nContent-Length: %lu\r\n\r\n", ap=ap@entry=0x7fffffffbdc0)
    at vfprintf.c:1643
#2  0x00007ffff67c96d1 in __IO_vsprintf (string=0x7fffffffbed0 "POST / HTTP/1.1\r\nHost: node10.puyuma.org\r\nX-IOTA-API-Version: 1\r\nContent-Type: ",
    format=0x5555555f4fe0 "POST %s HTTP/1.1\r\nHost: %s\r\nX-IOTA-API-Version: %d\r\nContent-Type: %s\r\nAccept: %s\r\nContent-Length: %lu\r\n\r\n", args=args@entry=0x7fffffffbdc0) at iovsprintf.c:42
#3  0x00007ffff67ad094 in __sprintf (s=<optimized out>, format=<optimized out>) at sprintf.c:32
#4  0x0000555555560bf8 in http_request_header (sockfd=25, http_settings=0x7fffffffd9d0, data_length=118) at external/entangled/cclient/http/http.c:131
#5  0x00005555555610b7 in cclient_socket_send (service_opaque=0x7fffffffd9d0, obj=0x555555680060, response=0x555555680040) at external/entangled/cclient/http/http.c:203
#6  0x00005555555612a0 in iota_service_query (service_opaque=0x7fffffffd9d0, obj=0x555555680060, response=0x555555680040) at external/entangled/cclient/http/http.c:239
#7  0x0000555555560506 in iota_client_get_trytes (service=0x7fffffffd9d0, req=0x55555567ff20, res=0x555555680020) at external/entangled/cclient/api/core/get_trytes.c:33
#8  0x0000555555560086 in iota_client_get_transaction_objects (serv=0x7fffffffd9d0, tx_hashes=0x55555567ff20, out_tx_objs=0x55555567ff40)
    at external/entangled/cclient/api/extended/get_transaction_objects.c:28
#9  0x000055555555e271 in main (argc=2, argv=0x7fffffffdd68) at storage/storage_zmq_client.c:96

init serv

static void zmq_init_iri_client_service(iota_client_service_t *const serv, char const *const host,
                                             uint16_t const port) {
  serv->http.path = "/";
  serv->http.content_type = "application/json";
  serv->http.accept = "application/json";
  serv->http.host = "node10.puyuma.org";
  serv->http.port = port;
  serv->http.api_version = 1;
  serv->http.ca_pem = NULL;
  serv->serializer_type = SR_JSON;
  printf("core init ret = %d\n",iota_client_core_init(serv));
}

after zmq_init_iri_client_service

$1 = {http = {host = 0x5555555f4087 "node10.puyuma.org", path = 0x5555555f406a "/", content_type = 0x5555555f406c "application/json", accept = 0x5555555f406c "application/json", ca_pem = 0x0,
    port = 14265, api_version = 1}

after char *string = s_recv(subscriber);
address of content_type changed.

$2 = {http = {host = 0x5555555f4087 "node10.puyuma.org", path = 0x5555555f406a "/", content_type = 0x5500555f406c <error: Cannot access memory at address 0x5500555f406c>,
    accept = 0x5555555f406c "application/json", ca_pem = 0x0, port = 14265, api_version = 1}
char *string = s_recv(subscriber);

所有參數的的地址都變了 OAO

int main(int argc, char* argv[]) {
  status_t ret = RC_OK;
  Transaction* transaction = new_Transaction();
  CassCluster* cluster = NULL;
  CassSession* session = cass_session_new();
  char* host = "127.0.0.1";
  iota_client_service_t iri_serv;
  retcode_t ret_code;
  //zmq_init_iri_client_service(&iri_serv, (const char* const) "node10.puyuma.org", IRI_PORT);
    
  /* setting Scylla */
  if (argc > 1) {
    host = argv[1];
  }
  init_scylla(cluster, session, host, false);

  /* setting ZeroMQ */
  void* context = zmq_ctx_new();
  void* subscriber = zmq_socket(context, ZMQ_SUB);
  int rc = zmq_connect(subscriber, "tcp://node10.puyuma.org:5556");
  assert(rc == 0);
  char* filter = (argc > 2) ? argv[2] : "sn";
  rc = zmq_setsockopt(subscriber, ZMQ_SUBSCRIBE, filter, strlen(filter));
  assert(rc == 0);
  /* receiving iri publication */
  while (1) {
    char trans[NUM_FLEX_TRITS_HASH + 1];
    get_trytes_req_t* tx_hashes = get_trytes_req_new();
    transaction_array_t* out_tx_objs = transaction_array_new();
    int milestone_idx;
    char* string = s_recv(subscriber);
    sscanf(string, "sn %d %s", &milestone_idx, trans);
    if ((ret = hash243_queue_push(&tx_hashes->hashes, (flex_trit_t const* const)trans)) != SC_OK) {
      goto loop_end;
    }
    zmq_init_iri_client_service(&iri_serv, (const char* const) "node10.puyuma.org", IRI_PORT);
    if ((ret_code = iota_client_get_transaction_objects(&iri_serv, tx_hashes, out_tx_objs)) != RC_OK) {
      ret = SC_STORAGE_ZMQ_ERROR;
      goto loop_end;
    }

    if ((ret = insert_tx_objs_into_ScyllaDB(session, out_tx_objs, transaction)) != SC_OK) {
      goto loop_end;
    }

  loop_end:
    free(string);
    get_trytes_req_free(&tx_hashes);
    transaction_array_free(out_tx_objs);
    if (ret != SC_OK) {
      goto exit;
    }
  }

exit:
  free_Transaction(&transaction);
  zmq_close(subscriber);
  zmq_ctx_destroy(context);
  cass_cluster_free(cluster);
  cass_session_free(session);

  return 0;
}

no error if run following code
Transaction trans = {(cass_byte_t*)"1"};

Select a repo