-
Notifications
You must be signed in to change notification settings - Fork 5
Open
Description
Description
Inserting a duplicate node whose pointer matches the root node causes a crash due to invalid stack indexing in fix_extra_red().
This happens when the inserted node is:
-
The same pointer as the root node, i.e., a repeated insertion of an identical
rb_node_t*, and -
The node is recolored to red again as part of
rb_insert(), and -
fix_extra_red()is triggered with a stack like [root, root] →stacksz == 2
/* If the parent is black, the tree is already balanced. */
if (likely(is_black(parent)))
return;
rb_node_t *grandparent = stack[stacksz - 3];Because the node was forced red earlier, parent is not black, so the function proceeds — but stacksz == 2, and the next line accesses stack[stacksz - 3], which is stack[-1] — undefined behavior.
Steps to Reproduce
- Build with AddressSanitizer enabled
- In
rb-perf.c, after the initial insert loop, insert the following code:
/* Insert nodes */
for (int i = 0; i < count; i++) {
rb_insert(&tree, &test_nodes[i].node);
}
int root_id = container_of(tree.root, struct perf_node, node)->key;
// Trigger crash by re-inserting the root node
rb_insert(&tree, &test_nodes[root_id].node);Metadata
Metadata
Assignees
Labels
No labels