Skip to content

Fix rust span pointer invalidation on inferred span serialization#3934

Merged
bwoebi merged 1 commit into
masterfrom
codex/fix-use-after-free-vulnerability
May 28, 2026
Merged

Fix rust span pointer invalidation on inferred span serialization#3934
bwoebi merged 1 commit into
masterfrom
codex/fix-use-after-free-vulnerability

Conversation

@bwoebi

@bwoebi bwoebi commented May 28, 2026

Copy link
Copy Markdown
Collaborator

Motivation

  • The serializer kept a raw ddog_SpanBytes * pointing into a Rust Vec and then recursively appended an inferred span into the same Vec, which can reallocate and move elements and thus invalidate the saved pointer.
  • This produced a use-after-free / memory-corruption risk when DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED triggers inferred-span serialization into the same trace.

Description

  • Record the current span index before appending by storing rust_span_index = ddog_get_trace_size(trace) and use it to determine is_first_span instead of querying size after append.
  • After recursively serializing the inferred span (which may append and reallocate), refresh the root span pointer with rust_span = ddog_get_span(trace, rust_span_index) before any further dereferences or transfers.
  • Change is a minimal modification in ext/serializer.c that preserves existing behavior while avoiding dereferencing a potentially stale pointer.

Testing

  • Ran php -l ext/serializer.c to validate there are no syntax errors, and it succeeded.

Codex Task

@bwoebi
bwoebi requested a review from a team as a code owner May 28, 2026 13:34
@datadog-official

datadog-official Bot commented May 28, 2026

Copy link
Copy Markdown

Pipelines  Tests

Fix all issues with BitsAI

⚠️ Warnings

🚦 6 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [7.4]   View in Datadog   GitLab

🔄 Retry job. This looks flaky and may succeed on retry. Failed to connect to request-replayer service, resulting in multiple timeout errors during test execution.

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.0]   View in Datadog   GitLab

🔄 Retry job. This looks flaky and may succeed on retry. Process timed out during execution of the tests.

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.1]   View in Datadog   GitLab

🔄 Retry job. This looks flaky and may succeed on retry. Process timed out while enabling dynamic instrumentation and retrieving client-side SHM span stats.

View all 6 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 60.70% (-0.05%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 27ae4af | Docs | Datadog PR Page | Give us feedback!

@pr-commenter

pr-commenter Bot commented May 28, 2026

Copy link
Copy Markdown

Benchmarks [ tracer ]

Benchmark execution time: 2026-05-28 14:54:41

Comparing candidate commit 6b5659e in PR branch codex/fix-use-after-free-vulnerability with baseline commit 6b5659e in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 194 metrics, 0 unstable metrics.

@bwoebi
bwoebi merged commit 6ca23db into master May 28, 2026
2121 of 2128 checks passed
@bwoebi
bwoebi deleted the codex/fix-use-after-free-vulnerability branch May 28, 2026 17:37
@github-actions github-actions Bot added this to the 1.21.0 milestone May 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant