-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
panic: crypto/cipher: invalid buffer overlap #3316
Comments
save here with version 5.29.0
|
Would you mind sharing your configuration files for both client and server? It seems the issue is caused by https://github.com/v2fly/v2ray-core/blob/master/common/crypto/auth.go#L266 . |
服务器错误
服务器配置
客户端有很多, 以下只是其中一个, 不一定是这个客户端引起的
|
Yes, I read the log analysis, it is the problem in this place, but do not know how to fix it; There is no change in the configuration of my client and server, which was normal before use, and is normal now with other browsers, but this problem will definitely occur as long as I use Chrome. I checked that my Chrome browser was automatically updated to version 133 two days ago. Suspicion may have something to do with the Chrome update. |
I also encountered this issue in recent days (prior to v5.29.0 released):
My current v2ray-core branch is based on |
Please try again with https://github.com/v2fly/v2ray-core/releases/tag/v5.29.1 see to if this issue has been fixed. |
in 5.29.1 this issue still exist
|
Can you paste the full stacktrace for it? |
|
Version 5.0.7 works stably. |
@Vigilans I have a guess of what went wrong: v2ray-core/common/protocol/quic/sniff.go Lines 54 to 55 in 4144c87
The quic sniffer allocate a buffer(%1) and deferred its release(release %1). v2ray-core/common/protocol/quic/sniff.go Lines 234 to 235 in 4144c87
When its size is not sufficient, the cryptoData buffer is released early, and its value is overwrite with a new buffer(%2) When the function ends, the deferred release %1 is executed again. as a result, buffer %1 get released twice, and buffer %2 get released 0 time. The key issue here is that when a function call get deferred, its argument may or may not get a snapshot of the the value passed in: https://go.dev/play/p/F_--epRl2yG . If my assessment is correct, I would like to request you rewrite all the code in the quic pull request where the argument of the deferred value get modified: v2ray-core/common/protocol/quic/sniff.go Line 235 in 4144c87
(the argument passed in was deferred for release in its call stack) v2ray-core/app/dispatcher/default.go Line 50 in 4144c87
If you do not have the time to rewrite them all I could take over from here. |
@xiaokangwang For reference: https://stackoverflow.com/questions/41471236/data-passed-by-reference-to-defer So According to your investigation, we may be able to observe buffer's release status and find out the root cause with some logging. I don't have time to rewrite the code until this weekend. Possible solutions:
|
@Vigilans I believe #3320 might have helped, considering that the copy could be a shallow copy. So when the argument is a pointer to a struct, when it field in that struct changes, the new value would be received by the deferred call. On the other hand, when the argument is a value itself, like a I think in both case we should just use |
If that is the case, changing v2ray-core/app/dispatcher/default.go Line 253 in 4144c87
and v2ray-core/common/protocol/quic/sniff.go Line 55 in 4144c87
should be enough to prevent the crash. Why not let the affected users do some testing to investigate the root cause before making a real fix? |
I think your suggestion makes sense. I will write a temporary fix first and let everyone try it out. |
I have released a new version with a temporary fix for this issue, please have a try: https://github.com/v2fly/v2ray-core/releases/tag/v5.29.2 |
v2ray version:V2Ray 5.10.0
go version: 1.20
I refer to v2ray in a golang project written by myself, which runs on the Debian11 machine. Since February 12, the project has encountered a running exception. The exception log is "panic: runtime error: Slice bounds out of range [: 2239] with capacity of 2048 ", the problem and the same in the #3303, And then found the solution from the #3303 (comment), due to the inconvenience v2ray version upgrade to v5.29.0 directly in the project, So can only refer to [v5.29.0] (https://github.com/v2fly/v2ray-core/releases/tag/v5.29.0) commit the code change, synchronous change their projects v2ray source; The modified project solves the above problem, but as long as you use the Chrome133.x.x.x browser to access the website, an exception will occur, and the exception log is as follows:
panic: crypto/cipher: invalid buffer overlap
goroutine 12830 [running]:
crypto/aes.(*gcmAsm).Seal(0xc002e877c0, {0xc000da2802, 0x0, 0x7fe}, {0xc000965510?, 0x2?, 0xc0021ebc40?}, {0xc000da2800, 0x4e2, 0x800}, ...)
/Go/go1.20/src/crypto/aes/aes_gcm.go:118 +0x4f8
github.com/v2fly/v2ray-core/v5/common/crypto.(*AEADAuthenticator).Seal(0xc001ddf5c0, {0xc000da2802, 0x0, 0x7fe}, {0xc000da2800, 0x4e2, 0x800})
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/crypto/auth.go:83 +0x12f
github.com/v2fly/v2ray-core/v5/common/crypto.(*AuthenticationWriter).seal(0xc002c9b680, {0xc000da2800, 0x4e2, 0x800})
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/crypto/auth.go:260 +0x344
github.com/v2fly/v2ray-core/v5/common/crypto.(*AuthenticationWriter).writePacket(0xc002c9b680, {0xc003333cf8, 0x3, 0x7fd254939301?})
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/crypto/auth.go:326 +0x233
github.com/v2fly/v2ray-core/v5/common/crypto.(*AuthenticationWriter).WriteMultiBuffer(0xc0015e8ab0?, {0xc003333cf8?, 0xc0015e8ab0?, 0xe79c20?})
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/crypto/auth.go:353 +0x5f
github.com/v2fly/v2ray-core/v5/common/buf.CopyOnceTimeout({0x191e1a0?, 0xc0015e8ab0?}, {0x191f4c0, 0xc002c9b680}, 0xc0021ebe98?)
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/buf/copy.go:122 +0x8e
github.com/v2fly/v2ray-core/v5/proxy/vmess/outbound.(*Handler).Process.func2()
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/proxy/vmess/outbound/outbound.go:156 +0x5b4
github.com/v2fly/v2ray-core/v5/common/task.Run.func1(0xc000410d20?)
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/task/task.go:28 +0x2e
created by github.com/v2fly/v2ray-core/v5/common/task.Run
/go/pkg/mod/github.com/v2fly/v2ray-core/[email protected]/common/task/task.go:27 +0xde
The text was updated successfully, but these errors were encountered: