{"action":"opened","issue":{"url":"https://api.github.com/repos/tarantool/tarantool/issues/1764","repository_url":"https://api.github.com/repos/tarantool/tarantool","labels_url":"https://api.github.com/repos/tarantool/tarantool/issues/1764/labels{/name}","comments_url":"https://api.github.com/repos/tarantool/tarantool/issues/1764/comments","events_url":"https://api.github.com/repos/tarantool/tarantool/issues/1764/events","html_url":"https://github.com/tarantool/tarantool/issues/1764","id":176331923,"number":1764,"title":"Sanitizer: Use after free in box_truncate","user":{"login":"mejedi","id":1164291,"avatar_url":"https://avatars.githubusercontent.com/u/1164291?v=3","gravatar_id":"","url":"https://api.github.com/users/mejedi","html_url":"https://github.com/mejedi","followers_url":"https://api.github.com/users/mejedi/followers","following_url":"https://api.github.com/users/mejedi/following{/other_user}","gists_url":"https://api.github.com/users/mejedi/gists{/gist_id}","starred_url":"https://api.github.com/users/mejedi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mejedi/subscriptions","organizations_url":"https://api.github.com/users/mejedi/orgs","repos_url":"https://api.github.com/users/mejedi/repos","events_url":"https://api.github.com/users/mejedi/events{/privacy}","received_events_url":"https://api.github.com/users/mejedi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-12T09:30:51Z","updated_at":"2016-09-12T09:30:51Z","closed_at":null,"body":"```\r\n==20495==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000016120 at pc 0x000103d9144c bp 0x00000641e960 sp 0x00000641e958\r\nREAD of size 4 at 0x611000016120 thread T0\r\n    #0 0x103d9144b in space_id(space*) space.h:99\r\n    #1 0x103d8ac31 in space_truncate(space*) box.cc:742\r\n    #2 0x103d8a508 in box_truncate box.cc:764\r\n    #3 0x103ddf1ac in lbox_truncate index.c:295\r\n    #4 0x103eda45a in lj_BC_FUNCC (tarantool+0x1002e445a)\r\n\r\n0x611000016120 is located 96 bytes inside of 232-byte region [0x6110000160c0,0x6110000161a8)\r\nfreed by thread T0 here:\r\n    #0 0x1047dcf39 in wrap_free sanitizer_malloc_mac.inc:107\r\n    #1 0x103d55d3f in space_delete(space*) space.cc:148\r\n    #2 0x103d68758 in alter_space_commit(trigger*, void*) alter.cc:655\r\n    #3 0x103d838db in trigger_run(rlist*, void*) trigger.h:77\r\n    #4 0x103d83bb6 in txn_commit(txn*) txn.cc:251\r\n    #5 0x103d83205 in txn_commit_stmt(txn*, request*) txn.cc:176\r\n    #6 0x103d868da in process_rw(request*, tuple**) box.cc:163\r\n    #7 0x103d88d56 in box_process1(request*, tuple**) box.cc:589\r\n    #8 0x103d89dd2 in box_delete box.cc:658\r\n    #9 0x103d8ad09 in space_truncate(space*) box.cc:745\r\n    #10 0x103d8a508 in box_truncate box.cc:764\r\n    #11 0x103ddf1ac in lbox_truncate index.c:295\r\n    #12 0x103eda45a in lj_BC_FUNCC (tarantool+0x1002e445a)\r\n\r\npreviously allocated by thread T0 here:\r\n    #0 0x1047dd2f6 in wrap_calloc sanitizer_malloc_mac.inc:118\r\n    #1 0x103d54b5b in space_new(space_def*, rlist*) space.cc:102\r\n    #2 0x103d67591 in alter_space_do(txn*, alter_space*, space*) alter.cc:758\r\n    #3 0x103d6192b in on_replace_dd_index(trigger*, void*) alter.cc:1383\r\n    #4 0x103d838db in trigger_run(rlist*, void*) trigger.h:77\r\n    #5 0x103d830e0 in txn_commit_stmt(txn*, request*) txn.cc:171\r\n    #6 0x103d868da in process_rw(request*, tuple**) box.cc:163\r\n    #7 0x103d88d56 in box_process1(request*, tuple**) box.cc:589\r\n    #8 0x103d895ea in box_insert box.cc:629\r\n    #9 0x103dddd67 in lbox_insert index.c:54\r\n    #10 0x103eda45a in lj_BC_FUNCC (tarantool+0x1002e445a)\r\n\r\nSUMMARY: AddressSanitizer: heap-use-after-free space.h:99 in space_id(space*)\r\n```"}}
{"actor":{"display_login":"mejedi"}}