Bug#586419: tokyotyrant: daemon dies after receiving SIGABRT after random time of operating

[bugreporter]

OK - on very low level of communication.

Here is example PHP script using API mentioned above:

<?php

ini_set('display_errors',1);
error_reporting(E_ALL);

include('./Tyrant.php');

$session=Tyrant::connect('10.0.4.13', '1999');

$data1=array(
        'somedata',
        'otherstuff',
        'totallyotherstuff',
);

$session->misc('put',$data1);

$data2=array(
        '',
        'otherstuff',
        'totallyotherstuff',
);

$session->misc('put',$data2);


?>

Second request raise assertion on TokyoTyrant daemon.

***

In fact API do connect to daemon, then it executes some stuff to configure
network socket in PHP. Then it call some stat command to determine database
type deamon uses.

Then function 'misc' (we call it above) simply do pack data into binary
format and sends to daemon.

***

Packing part:

    public function misc($name, Array $args = array(), $opts = 0)
    {
        $cmd = pack('CCNNN', 0xC8, 0x90, strlen($name), $opts,
                count($args)) . $name;
        foreach ($args as $arg) {
            $cmd .= pack('N', strlen($arg)) . $arg;
        }
        $code = $this->_send($cmd);

        [...]

    }

Some not needed part is cut above. 

Method _send do only write to socket and then it request a kind of result
from daemon.

***

So in fact binary character set is send to daemon after some state-check
in connect part.

We've caught these binary characters ;-)

Two files are attached here (both binary).

We call them like this:

$ cat request_correct.bin | netcat 10.0.4.13 1999
$

$ cat request_braking.bin | netcat 10.0.4.13 1999
$

Of course daemon works at 10.0.4.13/1999 in this case.

Yes - second request make daemon crash with result:
ttserver: tctdb.c:4563: tctdbidxhash: Assertion `pkbuf && pksiz && pksiz
>= 0' failed.

***

Here goes hexdumps of these request files:

$ hexdump -C request_correct.bin
00000000  c8 90 00 00 00 03 00 00  00 00 00 00 00 03 70 75 
|..............pu|
00000010  74 00 00 00 08 73 6f 6d  65 64 61 74 61 00 00 00 
|t....somedata...|
00000020  0a 6f 74 68 65 72 73 74  75 66 66 00 00 00 11 74 
|.otherstuff....t|
00000030  6f 74 61 6c 6c 79 6f 74  68 65 72 73 74 75 66 66 
|otallyotherstuff|
00000040
$

$ hexdump -C request_braking.bin
00000000  c8 90 00 00 00 03 00 00  00 00 00 00 00 03 70 75 
|..............pu|
00000010  74 00 00 00 00 00 00 00  0a 6f 74 68 65 72 73 74 
|t........otherst|
00000020  75 66 66 00 00 00 11 74  6f 74 61 6c 6c 79 6f 74 
|uff....totallyot|
00000030  68 65 72 73 74 75 66 66                           |herstuff|
00000038
$

***

Regards,
AdamLis;



Ȑputsomedata
otherstufftotallyotherstuff
Ȑput
otherstufftotallyotherstuff