开源改变世界

ASAN:堆缓冲区溢出:halcompile.g(604) #854

推推 grbl 2年前 (2023-01-30) 121次浏览
关闭
dwrobel 打开了这个问题 2020 年 5 月 13 日 · 1条评论
关闭

ASAN:堆缓冲区溢出:halcompile.g(604)#854

dwrobel 打开了这个问题 2020 年 5 月 13 日 · 1条评论

注释

ASAN:堆缓冲区溢出:halcompile.g(604) #854
贡献者

主版本:402f37c编译时出现-fsanitize=address -fPIE -fno-omit-frame-pointer崩溃 af 如下:

==3052555==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000003a at pc 0x7f8a3b81bad3 bp 0x7ffef263e710 sp 0x7ffef263e700
READ of size 1 at 0x60200000003a thread T0
    #0 0x7f8a3b81bad2 in rtapi_app_main objects/hal/components/sim_parport.c:535
    #1 0x4194c2 in do_load_cmd rtapi/uspace_rtapi_app.cc:289
    #2 0x41a616 in handle_command rtapi/uspace_rtapi_app.cc:380
    #3 0x41b1c9 in callback rtapi/uspace_rtapi_app.cc:421
    #4 0x4202c1 in run_threads rtapi/uspace_rtapi_app.cc:1226
    #5 0x420341 in sim_rtapi_run_threads rtapi/uspace_rtapi_app.cc:1231
    #6 0x41b8d4 in master rtapi/uspace_rtapi_app.cc:455
    #7 0x41c5f9 in main rtapi/uspace_rtapi_app.cc:542
    #8 0x7f8a3e99d1a2 in __libc_start_main ../csu/libc-start.c:308
    #9 0x415b7d in _start (/home/sw/projects/machinekit/linuxcnc/bin/rtapi_app+0x415b7d)

0x60200000003a is located 0 bytes to the right of 10-byte region [0x602000000030,0x60200000003a)
allocated by thread T0 here:
    #0 0x7f8a3eff352d in strdup (/usr/lib64/libasan.so.5+0x9652d)
    #1 0x418421 in do_one_item rtapi/uspace_rtapi_app.cc:190
    #2 0x418f94 in do_comp_args rtapi/uspace_rtapi_app.cc:254
    #3 0x419452 in do_load_cmd rtapi/uspace_rtapi_app.cc:282
    #4 0x41a616 in handle_command rtapi/uspace_rtapi_app.cc:380
    #5 0x41b1c9 in callback rtapi/uspace_rtapi_app.cc:421
    #6 0x4202c1 in run_threads rtapi/uspace_rtapi_app.cc:1226
    #7 0x420341 in sim_rtapi_run_threads rtapi/uspace_rtapi_app.cc:1231
    #8 0x41b8d4 in master rtapi/uspace_rtapi_app.cc:455
    #9 0x41c5f9 in main rtapi/uspace_rtapi_app.cc:542
    #10 0x7f8a3e99d1a2 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow objects/hal/components/sim_parport.c:535 in rtapi_app_main
Shadow bytes around the buggy address:
  0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c047fff8000: fa fa 04 fa fa fa 00[02]fa fa fa fa fa fa fa fa
  0x0c047fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3052555==ABORTING

生成的代码转储摘录:

    524     } else {
    525         int j,idx;
    526         char *ptr;
    527         char buf[HAL_NAME_LEN+1];
    528         ptr = names;
    529         idx = 0;
    530         for (i=0,j=0; i <= strlen(names); i++) {
    531             buf[j] = *(ptr+i);
    532             if ( (*(ptr+i) == ',') || (*(ptr+i) == 0) ) {
    533                 buf[j] = 0;
    534                 r = export(buf, idx);
    535                 if (*(ptr+i+1) == 0) {break;}
    536                 idx++;
    537                 if(r != 0) {break;}
    538                 j=0;
    539             } else {
    540                 j++;
    541             }
    542         }
    543     }

基于以上生成的535行起源于halcompile.g:612

由于这是在生成的代码中,它很可能会影响所有生成的组件。

ASAN:堆缓冲区溢出:halcompile.g(604) #854
贡献者作者

应该由#869修复。