Rocksdb: Use-after-free in db/db_impl_open.cc

[rnkovacs]

I am working on a bug finding tool that looks for a special kind of a use-after-free problem in C++ code (a "checker" module in the Clang Static Analyzer), and I've been running it on a few projects to see if it finds anything interesting. I found the following issue when analyzing the Ceph project that uses RocksDB.

Expected behavior

No use-after-free.

Actual behavior

In the file db/db_impl_open.cc, on line 135, we obtain a pointer to a memory region that gets deallocated right after the statement is executed:

const char* error_msg = s.ToString().c_str();

If I understand it correctly, s is a Status object, and the ToString() method returns a string by value, a temporary object, on which c_str() is called to obtain a const char * pointing to its inner buffer. But the temporary string object is destroyed at the end of the statement, so the pointer will reference a memory region that has already been deallocated at the end of this line. This becomes a problem when the invalid pointer is used on line 373.

(Note: links point to v5.14.2 for persistence, but the same issue is present on the master branch.)

Steps to reproduce the behavior

Look at the source code.

[miasantreble]

@rnkovacs thanks for reporting, it does look like a bug that I introduced.
I will open a PR to fix this shortly.
@siying any idea why ASAN/clang analyze didn't catch this?

[rnkovacs]

@miasantreble Glad to help.

any idea why ASAN/clang analyze didn't catch this?

This is a relatively new feature in the Clang Analyzer (moved to the default set of checks a week ago).