|
| 1 | +// Copyright 2026 The Swarm Authors. All rights reserved. |
| 2 | +// Use of this source code is governed by a BSD-style |
| 3 | +// license that can be found in the LICENSE file. |
| 4 | + |
| 5 | +package joiner_test |
| 6 | + |
| 7 | +import ( |
| 8 | + "context" |
| 9 | + "encoding/base64" |
| 10 | + "encoding/hex" |
| 11 | + "errors" |
| 12 | + "io" |
| 13 | + "os" |
| 14 | + "path/filepath" |
| 15 | + "testing" |
| 16 | + "time" |
| 17 | + |
| 18 | + "github.com/ethersphere/bee/v2/pkg/file/joiner" |
| 19 | + "github.com/ethersphere/bee/v2/pkg/file/redundancy" |
| 20 | + "github.com/ethersphere/bee/v2/pkg/storage/inmemchunkstore" |
| 21 | + "github.com/ethersphere/bee/v2/pkg/swarm" |
| 22 | + "github.com/ethersphere/langos" |
| 23 | +) |
| 24 | + |
| 25 | +// TestJoinerBounds reproduces the joiner panic and timeout against the |
| 26 | +// actual malformed sub-reference of the tree, read the way the /bzz |
| 27 | +// file-serving path reads it (through langos look-ahead) rather than by |
| 28 | +// sequentially reading the root. |
| 29 | +// |
| 30 | +// Chunk1 is the tree root. TestJoinerCrashTest joins Chunk1 directly, but the |
| 31 | +// root advertises a span (352) smaller than its own chunk data, so the joiner |
| 32 | +// treats it as a single leaf, copies 352 bytes and stops without ever |
| 33 | +// descending into the tree - hence no panic there. |
| 34 | +// |
| 35 | +// The /bzz endpoint instead resolves Chunk1 as a manifest and ends up serving |
| 36 | +// the child reference Chunk2, whose header advertises a span (524288 bytes) far |
| 37 | +// larger than the data actually present in the tree. Serving it wraps the |
| 38 | +// joiner in langos, which reads from offset 0 while peeking the next buffer at |
| 39 | +// offset smallFileBufferSize. |
| 40 | +// |
| 41 | +// Root Cause Details: |
| 42 | +// 1. In TestJoinerBounds/langos crash (with langos), the peek's ReadAt at offset 262144 |
| 43 | +// descended into the first child chunk Chunk1. The parent's layout expected Chunk1's |
| 44 | +// subtree to cover a section size of 438272 bytes, but Chunk1 is actually a leaf |
| 45 | +// chunk of only 4096 bytes. Because the joiner did not validate that the child's |
| 46 | +// actual span matches the parent's layout expectation, it descended into Chunk1 |
| 47 | +// with off=262144, cur=0. Since Chunk1's span (4096) <= len(data) (4096), it was |
| 48 | +// treated as a leaf, calculating dataOffsetStart = off - cur = 262144, and |
| 49 | +// sliced the data out of bounds, crashing the node. |
| 50 | +// 2. In TestJoinerBounds/timeout (without langos), reading sequentially from offset 0 |
| 51 | +// successfully read the first 4096 bytes from Chunk1. The next read at offset 4096 |
| 52 | +// descended into Chunk1 again (expecting it to cover up to 438272 bytes). This |
| 53 | +// calculated dataOffsetStart = 4096, which resulted in copying 0 bytes and |
| 54 | +// returning 0, nil. io.Copy kept retrying indefinitely, causing the hang. |
| 55 | +// 3. Note that langos itself functions correctly. Since the root chunk Chunk2 |
| 56 | +// advertises a span of 524288 bytes, langos is entirely justified in issuing a |
| 57 | +// read/peek at offset 262144 (which is less than the advertised size). The joiner, |
| 58 | +// as an io.Reader/io.ReaderAt implementation, must return an error when queried |
| 59 | +// past the actual tree boundaries rather than panicking or hanging. |
| 60 | +// |
| 61 | +// The joiner enforces bounds check limits on leaf chunk reads, returning |
| 62 | +// ErrMalformedTrie immediately if the offset is invalid. |
| 63 | +func TestJoinerBounds(t *testing.T) { |
| 64 | + t.Run("langos crash", func(t *testing.T) { |
| 65 | + t.Parallel() |
| 66 | + testJoinerBug(t, true) |
| 67 | + }) |
| 68 | + |
| 69 | + t.Run("timeout", func(t *testing.T) { |
| 70 | + t.Parallel() |
| 71 | + testJoinerBug(t, false) |
| 72 | + }) |
| 73 | +} |
| 74 | + |
| 75 | +func testJoinerBug(t *testing.T, useLangos bool) { |
| 76 | + t.Helper() |
| 77 | + |
| 78 | + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) |
| 79 | + defer cancel() |
| 80 | + |
| 81 | + store := inmemchunkstore.New() |
| 82 | + addrs := []string{ |
| 83 | + "324881a5e0980e21eec6ab4348767a322260b4d477198aeb2500d9d492a99518", // Chunk1 |
| 84 | + "7c512937c1aac8d772cff0d071cbdcda15748c9d422904007342a30dd58ef05d", // Chunk2 |
| 85 | + "147a4a13002cfe9033b04bbf64b4de8091645930fa58f170fa146b0a7e0d7695", // Chunk3 |
| 86 | + "6650507776a544842c632ed1dde92f8a456a88495308349f147472de3c1620f8", // Chunk4 |
| 87 | + "8504f2a107ca940beafc4ce2f6c9a9f0968c62a5b5893ff0e4e1e2983048d276", // Chunk5 |
| 88 | + "95378adf59567d5db28e970fc60d2dcf0568f11804fd8aa27d2ee7c9eac24100", // Chunk6 |
| 89 | + } |
| 90 | + |
| 91 | + for _, addrStr := range addrs { |
| 92 | + b64Data, err := os.ReadFile(filepath.Join("testdata/bounds", addrStr+".b64")) |
| 93 | + if err != nil { |
| 94 | + t.Fatal(err) |
| 95 | + } |
| 96 | + data, err := base64.StdEncoding.DecodeString(string(b64Data)) |
| 97 | + if err != nil { |
| 98 | + t.Fatal(err) |
| 99 | + } |
| 100 | + addr, err := hex.DecodeString(addrStr) |
| 101 | + if err != nil { |
| 102 | + t.Fatal(err) |
| 103 | + } |
| 104 | + if err := store.Put(ctx, swarm.NewChunk(swarm.NewAddress(addr), data)); err != nil { |
| 105 | + t.Fatal(err) |
| 106 | + } |
| 107 | + } |
| 108 | + |
| 109 | + // Join the malformed child reference directly, as /bzz does after resolving |
| 110 | + // the manifest at Chunk1. |
| 111 | + ref := swarm.MustParseHexAddress("7c512937c1aac8d772cff0d071cbdcda15748c9d422904007342a30dd58ef05d") |
| 112 | + reader, _, err := joiner.New(ctx, store, store, ref, redundancy.DefaultDownloadLevel) |
| 113 | + if err != nil { |
| 114 | + t.Fatal(err) |
| 115 | + } |
| 116 | + |
| 117 | + if useLangos { |
| 118 | + // smallFileBufferSize mirrors the lookahead buffer size that pkg/api uses when |
| 119 | + // serving sub-10MB files through langos (see lookaheadBufferSize in bzz.go). |
| 120 | + // langos peeks one buffer ahead, i.e. while serving from offset 0 it also issues |
| 121 | + // a ReadAt at this offset. |
| 122 | + const smallFileBufferSize = 8 * 32 * 1024 // 262144 |
| 123 | + |
| 124 | + // Serve it exactly like the API does: wrap the joiner in langos and read it |
| 125 | + // from the start. langos' look-ahead peek issues the panicking ReadAt at |
| 126 | + // offset smallFileBufferSize. Once the joiner rejects such malformed trees |
| 127 | + // this should instead return an error here. |
| 128 | + lr := langos.NewBufferedLangos(reader, smallFileBufferSize) |
| 129 | + if _, err := io.Copy(io.Discard, lr); err == nil { |
| 130 | + t.Fatal("expected error, got nil") |
| 131 | + } else if !errors.Is(err, joiner.ErrMalformedTrie) { |
| 132 | + t.Fatalf("expected ErrMalformedTrie, got: %v", err) |
| 133 | + } |
| 134 | + } else { |
| 135 | + // Sequentially read the entire file. Without the leaf bounds check, |
| 136 | + // this path would hang indefinitely (reproducing the timeout) because |
| 137 | + // it kept retrying to read 0 bytes from the leaf chunk. |
| 138 | + if _, err := io.Copy(io.Discard, reader); err == nil { |
| 139 | + t.Fatal("expected error, got nil") |
| 140 | + } else if !errors.Is(err, joiner.ErrMalformedTrie) { |
| 141 | + t.Fatalf("expected ErrMalformedTrie, got: %v", err) |
| 142 | + } |
| 143 | + } |
| 144 | +} |
0 commit comments