Fix: coredump, dereference null variable #327

alfred2g · 2023-09-18T16:07:08Z

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

bretambrose

Can we add a test that triggers an error-code based completion?

Also check the other packet paths (unsubscribe, publish received) to see if they overlooked this too (probably).

Probably the simplest way of doing that is to set a low operation timeout and arrange the mqtt5 server mock to not response to subscribes at all. The operation will time out and there won't be a suback.

xiazhvera · 2023-09-20T19:55:08Z

source/v5/mqtt5_to_mqtt3_adapter.c

+
+    if (suback != NULL) {
+        reason_code_count = suback->reason_code_count;
+    }


Probably move this down to the granted_qos part, so we only need to do the check once.

if (suback == NULL) { granted_qos = AWS_MQTT_QOS_FAILURE; }

Added it twice so i don't change the scope of the variable granted_qos

tests/v5/mqtt5_to_mqtt3_adapter_tests.c

codecov-commenter · 2023-09-20T20:02:28Z

Codecov Report

Patch coverage: 100.00% and project coverage change: -0.15% ⚠️

Comparison is base (ee06ce3) 82.40% compared to head (039fcaa) 82.26%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #327      +/-   ##
==========================================
- Coverage   82.40%   82.26%   -0.15%     
==========================================
  Files          20       20              
  Lines        8728     8732       +4     
==========================================
- Hits         7192     7183       -9     
- Misses       1536     1549      +13

Files Changed	Coverage Δ
source/v5/mqtt5_to_mqtt3_adapter.c	`75.90% <100.00%> (-0.19%)`	⬇️

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

sfod · 2023-09-20T20:55:39Z

tests/v5/mqtt5_to_mqtt3_adapter_tests.c

@@ -2686,6 +2686,88 @@ static int s_mqtt5to3_adapter_subscribe_single_success_fn(struct aws_allocator *

 AWS_TEST_CASE(mqtt5to3_adapter_subscribe_single_success, s_mqtt5to3_adapter_subscribe_single_success_fn)

+/*
+ * This function tests receiving a subscribe acknowlege after disconnecting from


nit: typo acknowlege -> acknowledge

sfod · 2023-09-20T21:22:43Z

source/v5/mqtt5_to_mqtt3_adapter.c

        struct aws_mqtt_topic_subscription *subscription_ptr =
            (struct aws_mqtt_topic_subscription *)multi_sub_subscription_buf;

        struct aws_array_list multi_sub_list;
        aws_array_list_init_static(
            &multi_sub_list,
            multi_sub_subscription_ptr_buf,
-            suback->reason_code_count,
+            reason_code_count,


aws_array_list_init_static has a check for the third parameter:

AWS_FATAL_PRECONDITION(item_count > 0);

It seems we should handle reason_code_count == 0 separately.

It sounds like a null suback may be normal and expected behavior. I don't think we want to fail the AWS_FATAL_PRECONDITION on something we're doing intentionally (e.g. op timeout, close connection). We may want to set the subscription_count earlier and use it since it's grabbing that from the stored &subscribe_op->subscriptions) array length on L2250.

it is an expected behavior, this function is called with an explicit null as the suback

Looking at this case, we would need a test for suback on multiple subscription as well.

Ah right, maybe we need a test that sets the multi suback but not the singular one so it hits the multi processing.

sbSteveK · 2023-09-20T21:27:16Z

source/v5/mqtt5_to_mqtt3_adapter.c

@@ -2207,7 +2215,7 @@ static void s_aws_mqtt5_to_mqtt3_adapter_subscribe_completion_fn(
            topic_filter = record->subscription_view.topic_filter;
        }

-        if (suback->reason_code_count > 0) {
+        if (reason_code_count > 0) {
            granted_qos = s_convert_mqtt5_suback_reason_code_to_mqtt3_granted_qos(suback->reason_codes[0]);
        }


Trivial: Instead of checking on L2206, could we add an else block and assign AWS_MQTT_QOS_FAILURE to granted_qos here to simplify where that is getting assigned to one place? It'd also remove the second suback == NULL check that Vera mentioned.

sfod · 2023-09-20T21:36:17Z

source/v5/mqtt5_to_mqtt3_adapter.c

@@ -2226,23 +2234,22 @@ static void s_aws_mqtt5_to_mqtt3_adapter_subscribe_completion_fn(
            "id=%p: mqtt3-to-5-adapter, completing multi-topic subscribe",
            (void *)adapter);

+        AWS_VARIABLE_LENGTH_ARRAY(struct aws_mqtt_topic_subscription, multi_sub_subscription_buf, reason_code_count);


With reason_code_count equal to 0, the expression here will be

struct aws_mqtt_topic_subscription multi_sub_subscription_buf[0];

, which is invalid.

It's just another reason to handle reason_code_count == 0 separately.

can't we have a reason code of zero without suback being null?

According to the docs, the number of reason codes must match the number of topics. Though, I'd say a simple check probably won't hurt.

sbSteveK · 2023-09-20T21:40:20Z

source/v5/mqtt5_to_mqtt3_adapter.c

            sizeof(struct aws_mqtt_topic_subscription *));

        size_t subscription_count = aws_array_list_length(&subscribe_op->subscriptions);

-        for (size_t i = 0; i < suback->reason_code_count; ++i) {
+        for (size_t i = 0; i < reason_code_count; ++i) {


same here as above. Use subscription_count to process and report back the failed sub for all subscriptions. We will also need to assign the subscription->qos to the correct response.

sbSteveK · 2023-09-20T21:42:04Z

source/v5/mqtt5_to_mqtt3_adapter.c

            sizeof(struct aws_mqtt_topic_subscription *));

        size_t subscription_count = aws_array_list_length(&subscribe_op->subscriptions);

-        for (size_t i = 0; i < suback->reason_code_count; ++i) {
+        for (size_t i = 0; i < reason_code_count; ++i) {
            struct aws_mqtt_topic_subscription *subscription = subscription_ptr + i;
            AWS_ZERO_STRUCT(*subscription);



Check reason_code_count or suback == NULL so we don't try to access suback->reason_codes if it's NULL and set the subscription->qos toAWS_MQTT_QOS_FAILURE

sfod · 2023-09-21T00:25:57Z

source/v5/mqtt5_to_mqtt3_adapter.c

+                "id=%p: mqtt3-to-5-adapter, completing multi-topic subscribe",
+                (void *)adapter);
+            (*subscribe_op->on_multi_suback)(
+                &adapter->base, subscribe_op->base.id, NULL, error_code, subscribe_op->on_multi_suback_user_data);


aws-crt-cpp expects the list to be non-empty. It won't crash, but it'll set the qos to AWS_MQTT_QOS_AT_MOST_ONCE and then pass empty list of topics to the user callback. Which may be confusing.
Here's the corresponding code: https://github.com/awslabs/aws-crt-cpp/blob/main/source/mqtt/MqttConnectionCore.cpp#L414

Probably the empty list should be handled in aws-crt-cpp. But I feel like it should be done here, so all the layers above don't have to worry about these things.

I thought about it. I think it might be better to handle it on CRT side, as it might be better to check NULL value for a pointer regardless.
I will update the changes in CRTs.

source/v5/mqtt5_to_mqtt3_adapter.c

alfred2g and others added 3 commits September 18, 2023 08:58

Fix: coredump, dereference null variable

84c714a

Format: clang-format

17832d6

Merge branch 'main' into fix_dereference

d1a8040

bretambrose reviewed Sep 18, 2023

View reviewed changes

alfred2g added 2 commits September 20, 2023 12:49

Test: add testcase to test recption of subscribe ack after a disconnect

fc11e14

Format: Run clang-format

d47bfd4

xiazhvera reviewed Sep 20, 2023

View reviewed changes

Resolve PR comments

db83c43

sfod reviewed Sep 20, 2023

View reviewed changes

sbSteveK reviewed Sep 20, 2023

View reviewed changes

sfod reviewed Sep 20, 2023

View reviewed changes

sbSteveK reviewed Sep 20, 2023

View reviewed changes

alfred2g added 2 commits September 20, 2023 15:23

Redesign

63bc364

Add logs

312366e

sfod reviewed Sep 21, 2023

View reviewed changes

Refactor

b2baa5b

sfod reviewed Sep 21, 2023

View reviewed changes

source/v5/mqtt5_to_mqtt3_adapter.c Outdated Show resolved Hide resolved

Fix duplicate statement

7003a9f

sfod approved these changes Sep 21, 2023

View reviewed changes

Fix test, the mock server should not send suback for the test

039fcaa

xiazhvera merged commit 7c467e4 into main Sep 21, 2023
31 checks passed

xiazhvera deleted the fix_dereference branch September 21, 2023 01:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: coredump, dereference null variable #327

Fix: coredump, dereference null variable #327

alfred2g commented Sep 18, 2023

bretambrose left a comment •

edited

Loading

xiazhvera Sep 20, 2023

alfred2g Sep 20, 2023

codecov-commenter commented Sep 20, 2023 •

edited

Loading

sfod Sep 20, 2023

sfod Sep 20, 2023

sbSteveK Sep 20, 2023

alfred2g Sep 20, 2023

xiazhvera Sep 20, 2023

sbSteveK Sep 20, 2023

sbSteveK Sep 20, 2023

sfod Sep 20, 2023

alfred2g Sep 20, 2023

sfod Sep 20, 2023

sbSteveK Sep 20, 2023

sbSteveK Sep 20, 2023

sfod Sep 21, 2023

xiazhvera Sep 21, 2023

Fix: coredump, dereference null variable #327

Fix: coredump, dereference null variable #327

Conversation

alfred2g commented Sep 18, 2023

bretambrose left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-commenter commented Sep 20, 2023 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bretambrose left a comment •

edited

Loading

codecov-commenter commented Sep 20, 2023 •

edited

Loading