Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix int overflow on x32 processors causing panic using burstObservatory #3810

Merged
merged 1 commit into from
Sep 15, 2024

Conversation

tekig
Copy link
Contributor

@tekig tekig commented Sep 14, 2024

When using burstObservatory I get a panic on the mipsle processor. During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small, causing private queries, or negative, causing a panic in rand.Intn.

Version: Xray 1.8.18 (Xray, Penetrates Everything.) 9e6d7a3c (go1.22.5 linux/mipsle)

Config burstObservatory:

{
    "burstObservatory": {
        "subjectSelector": ["proxy"],
        "pingConfig": {
            "destination": "https://connectivitycheck.gstatic.com/generate_204",
            "connectivity": "",
            "interval": "30s",
            "sampling": 3,
            "timeout": "3s"
        }
    }
}

Stdout:

panic: invalid argument to Intn

goroutine 35 [running]:
math/rand.(*Rand).Intn(0x21139e0, 0xf46b0400)
        math/rand/rand.go:180 +0xd0
math/rand.Intn(0xf46b0400)
        math/rand/rand.go:453 +0x48
github.com/xtls/xray-core/common/dice.Roll(...)
        github.com/xtls/xray-core/common/dice/dice.go:14
github.com/xtls/xray-core/app/observatory/burst.(*HealthPing).doCheck(0x241f820, {0x22853c0, 0x5, 0x8}, 0x14f46b0400, 0x3)
        github.com/xtls/xray-core/app/observatory/burst/healthping.go:159 +0x3c4
github.com/xtls/xray-core/app/observatory/burst.(*HealthPing).StartScheduler.func2.1()
        github.com/xtls/xray-core/app/observatory/burst/healthping.go:100 +0x194
created by github.com/xtls/xray-core/app/observatory/burst.(*HealthPing).StartScheduler.func2 in goroutine 8
        github.com/xtls/xray-core/app/observatory/burst/healthping.go:94 +0xe0

During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
@RPRX RPRX requested a review from yuhan6665 September 15, 2024 03:19
@yuhan6665 yuhan6665 changed the title Fix int overflow on x32 processors causing panic Fix int overflow on x32 processors causing panic using burstObservatory Sep 15, 2024
@yuhan6665 yuhan6665 merged commit d7c5a0f into XTLS:main Sep 15, 2024
36 checks passed
@yuhan6665
Copy link
Member

Looks good. Thank you!

@RPRX
Copy link
Member

RPRX commented Oct 6, 2024

#3774 (comment)

leninalive pushed a commit to amnezia-vpn/amnezia-xray-core that referenced this pull request Oct 29, 2024
During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants