Skip to content

Fix int overflow on x32 processors causing panic using burstObservatory #3810

Merged
yuhan6665 merged 1 commit intoXTLS:mainfrom
tekig:fix/burst-x32
Sep 15, 2024
Merged

Fix int overflow on x32 processors causing panic using burstObservatory #3810
yuhan6665 merged 1 commit intoXTLS:mainfrom
tekig:fix/burst-x32

Conversation

@tekig
Copy link
Contributor

@tekig tekig commented Sep 14, 2024

When using burstObservatory I get a panic on the mipsle processor. During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small, causing private queries, or negative, causing a panic in rand.Intn.

Version: Xray 1.8.18 (Xray, Penetrates Everything.) 9e6d7a3c (go1.22.5 linux/mipsle)

Config burstObservatory:

{
    "burstObservatory": {
        "subjectSelector": ["proxy"],
        "pingConfig": {
            "destination": "https://connectivitycheck.gstatic.com/generate_204",
            "connectivity": "",
            "interval": "30s",
            "sampling": 3,
            "timeout": "3s"
        }
    }
}

Stdout:

panic: invalid argument to Intn

goroutine 35 [running]:
math/rand.(*Rand).Intn(0x21139e0, 0xf46b0400)
        math/rand/rand.go:180 +0xd0
math/rand.Intn(0xf46b0400)
        math/rand/rand.go:453 +0x48
github.com/xtls/xray-core/common/dice.Roll(...)
        github.com/xtls/xray-core/common/dice/dice.go:14
github.com/xtls/xray-core/app/observatory/burst.(*HealthPing).doCheck(0x241f820, {0x22853c0, 0x5, 0x8}, 0x14f46b0400, 0x3)
        github.com/xtls/xray-core/app/observatory/burst/healthping.go:159 +0x3c4
github.com/xtls/xray-core/app/observatory/burst.(*HealthPing).StartScheduler.func2.1()
        github.com/xtls/xray-core/app/observatory/burst/healthping.go:100 +0x194
created by github.com/xtls/xray-core/app/observatory/burst.(*HealthPing).StartScheduler.func2 in goroutine 8
        github.com/xtls/xray-core/app/observatory/burst/healthping.go:94 +0xe0

During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
@RPRX RPRX requested a review from yuhan6665 September 15, 2024 03:19
@yuhan6665 yuhan6665 changed the title Fix int overflow on x32 processors causing panic Fix int overflow on x32 processors causing panic using burstObservatory Sep 15, 2024
@yuhan6665 yuhan6665 merged commit d7c5a0f into XTLS:main Sep 15, 2024
@yuhan6665
Copy link
Member

Looks good. Thank you!

@RPRX
Copy link
Member

RPRX commented Oct 6, 2024

#3774 (comment)

leninalive pushed a commit to amnezia-vpn/amnezia-xray-core that referenced this pull request Oct 29, 2024
During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
dragonbreath2000 pushed a commit to dragonbreath2000/Xray-core that referenced this pull request Dec 11, 2024
During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
dragonbreath2000 pushed a commit to dragonbreath2000/Xray-core that referenced this pull request Dec 12, 2024
During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
it2konst pushed a commit to it2konst/gametunnel-core that referenced this pull request Mar 1, 2026
During the roll, "duration" is converted to int, causing overflow on x32 processors. The value may be very small or negative, causing a panic in rand.Intn.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants