Skip to content

segfault in lyd_parse_data #2464

@jktjkt

Description

@jktjkt

With the most recent devel of libyang, the libyang-cpp's test suite started failing when parsing this malformed JSON data:

{"example-schema5:x_b":{"x_b_leaf":"wtf"}}

Apparently, the C library dereferences a null pointer in https://github.com/CESNET/libyang/blob/devel/src/parser_common.c#L484 , the first_p is NULL during this test.

libyang[0]: Invalid non-number-encoded int32 value "wtf". (data path: /example-schema5:x/x_b/x_b_leaf, line: 1)
github/CESNET/libyang/src/parser_common.c:484:9: runtime error: load of null pointer of type 'struct lyd_node *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior github/CESNET/libyang/src/parser_common.c:484:9 

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff75e06d9 in lyd_parser_node_free (first_p=first_p@entry=0x0, node=0x7bfff475b230) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/parser_common.c:484
484         if (*first_p && !(*first_p)->parent && (*first_p == *node)) {
(gdb) bt
#0  0x00007ffff75e06d9 in lyd_parser_node_free (first_p=first_p@entry=0x0, node=0x7bfff475b230) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/parser_common.c:484
#1  0x00007ffff73f9065 in lydjson_parse_instance_inner (lydctx=0x7e0ff58b2100, snode=0x7cbff5e3b000, ext=0x0, parent=0x7c6ff5acf4e0, first_p=0x0, status=<optimized out>, node=<optimized out>) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/parser_json.c:1453
#2  lydjson_parse_instance (lydctx=0x7e0ff58b2100, parent=<optimized out>, first_p=<optimized out>, snode=0x7cbff5e3b000, ext=<optimized out>, name=<optimized out>, name_len=<optimized out>, prefix=<optimized out>, prefix_len=<optimized out>, status=<optimized out>, node=<optimized out>) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/parser_json.c:1522
#3  0x00007ffff73ee6ca in lydjson_subtree_r (lydctx=0x7e0ff58b2100, parent=<optimized out>, first_p=<optimized out>, parsed=<optimized out>) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/parser_json.c:1762
#4  0x00007ffff73e9cef in lyd_parse_json (ctx=0x7d1ff622be40, ext=<optimized out>, parent=<optimized out>, schema=0x0, first_p=<optimized out>, in=0x7c6ff5acf5c0, parse_opts=<optimized out>, val_opts=<optimized out>, int_opts=<optimized out>, parsed=<optimized out>, subtree_sibling=<optimized out>, lydctx_p=<optimized out>)
    at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/parser_json.c:1990
#5  0x00007ffff73402cd in lyd_parse (ctx=0x7d1ff622be40, ext=<optimized out>, parent=<optimized out>, first_p=<optimized out>, in=<optimized out>, format=<optimized out>, parse_opts=<optimized out>, val_opts=<optimized out>, op=0x0) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/tree_data.c:135
#6  0x00007ffff7340fa1 in lyd_parse_data (ctx=0x0, parent=<optimized out>, in=0x7c6ff5acf5c0, format=LYD_JSON, parse_options=720896, validate_options=0, tree=0x0) at /home/jkt/work/cesnet/gerrit/github/CESNET/libyang/src/tree_data.c:239
#7  0x00007ffff7f01018 in libyang::DataNode::parseSubtree (this=<optimized out>, data=..., format=<optimized out>, parseOpts=Python Exception <class 'gdb.error'>: value has been optimized out
..., validationOpts=std::optional [no contained value]) at /home/jkt/work/cesnet/gerrit/CzechLight/libyang-cpp/src/DataNode.cpp:1307
#8  0x0000555555767f8d in DOCTEST_ANON_FUNC_2 () at /home/jkt/work/cesnet/gerrit/CzechLight/libyang-cpp/tests/data_node.cpp:1858
#9  0x000055555581603c in doctest::Context::run (this=0x7bfff4300020) at /home/jkt/work/prog/_build/czechlight-clang20-asan-ubsan/target/include/doctest/doctest.h:7007
#10 0x000055555581be4d in main (argc=1, argv=<optimized out>) at /home/jkt/work/prog/_build/czechlight-clang20-asan-ubsan/target/include/doctest/doctest.h:7085

Metadata

Metadata

Assignees

No one assigned

    Labels

    is:bugBug description.status:completedFrom the developer perspective, the issue was solved (bug fixed, question answered,...)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions