Squashed 'src/leveldb/' changes from cad64b151d..ab6c84e6f3
What the developer wrote
Authored by MarcoFalke
Squashed 'src/leveldb/' changes from cad64b151d..ab6c84e6f3
ab6c84e6f3 Merge bitcoin-core/leveldb-subtree#58: Initialize file_size to 0 to avoid UB
ad9b1c9893 Initialize file_size to 0 to avoid UB
git-subtree-dir: src/leveldb
git-subtree-split: ab6c84e6f38fae0279e30305a182f9b4674e2ecd
What changed, and why it matters
This commit pulls in a small LevelDB fix that initializes a file-size variable to zero before use. Without the fix, the variable could contain leftover/unpredictable data, which in C++ is called 'undefined behavior.' In practical terms this is most likely a stability/reliability fix rather than an exploitable Bitcoin security bug, because the value is later overwritten during normal database operations.
Treat as a routine code-quality/reliability fix. Include in normal backport/upgrade cycles. No urgent security response is warranted absent additional evidence that the uninitialized value is reachable and exploitable.
Security signals we found
Uninitialized struct member (file_size) in compaction output creation
Undefined behavior in C++ due to use of indeterminate value
Fix originates from upstream bitcoin-core/leveldb-subtree pull request titled 'Initialize file_size to 0 to avoid UB'
Single-line initialization change in database compaction path
No evidence of remote triggerability or attacker-controlled data flow
Evidence from the diff
The change sets out.file_size = 0 in DBImpl::OpenCompactionOutputFile() when a new compaction output is created. The CompactionState::Output struct is stack-allocated and its file_size member was previously uninitialized. C++ reads of an indeterminate value are undefined behavior. In LevelDB’s compaction path the output’s file_size is normally filled in after the file is written (FinishCompactionOutputFile), so the practical effect is limited, but an early error/return path or later logic could observe the stale value. The fix removes that UB by explicitly zero-initializing the field.
Changed components
src/leveldb/db/db_impl.ccLevelDB compaction output file handlingBitcoin Core embedded LevelDB subtreeInspect captured patch +1 / −0
diff --git a/db/db_impl.cc b/db/db_impl.cc
index 65e31724..10f52325 100644
--- a/db/db_impl.cc
+++ b/db/db_impl.cc
@@ -803,6 +803,7 @@ Status DBImpl::OpenCompactionOutputFile(CompactionState* compact) {
pending_outputs_.insert(file_number);
CompactionState::Output out;
out.number = file_number;
+ out.file_size = 0;
out.smallest.Clear();
out.largest.Clear();
compact->outputs.push_back(out);
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.