Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

decode()ing non-ASCII characters is UBSAN error #19

Closed
MichaelChirico opened this issue Sep 30, 2019 · 0 comments · Fixed by #20
Closed

decode()ing non-ASCII characters is UBSAN error #19

MichaelChirico opened this issue Sep 30, 2019 · 0 comments · Fixed by #20
Labels
bug Something isn't working

Comments

@MichaelChirico
Copy link
Owner

From wch1/r-debug::RDsan

gh_decode('ß')
=================================================================
==116==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7fd1de376b5c at pc 0x7fd1de375172 bp 0x7fff825736e0 sp 0x7fff825736d0
READ of size 4 at 0x7fd1de376b5c thread T0
    #0 0x7fd1de375171 in gh_decode /geohashTools/src/geohash.c:159
    #1 0x7fd1e98209ca in R_doDotCall /tmp/r-source/src/main/dotcode.c:576
    #2 0x7fd1e99114e6 in bcEval /tmp/r-source/src/main/eval.c:7293
    #3 0x7fd1e98bcfef in Rf_eval /tmp/r-source/src/main/eval.c:620
    #4 0x7fd1e98c2e8b in R_execClosure /tmp/r-source/src/main/eval.c:1780
    #5 0x7fd1e98c25d9 in Rf_applyClosure /tmp/r-source/src/main/eval.c:1706
    #6 0x7fd1e98be2b8 in Rf_eval /tmp/r-source/src/main/eval.c:743
    #7 0x7fd1e9965017 in Rf_ReplIteration /tmp/r-source/src/main/main.c:260
    #8 0x7fd1e9965412 in R_ReplConsole /tmp/r-source/src/main/main.c:310
    #9 0x7fd1e9967882 in run_Rmainloop /tmp/r-source/src/main/main.c:1108
    #10 0x7fd1e9967898 in Rf_mainloop /tmp/r-source/src/main/main.c:1115
    #11 0x55bd82594ac0 in main /tmp/r-source/src/main/Rmain.c:29
    #12 0x7fd1e84e6b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #13 0x55bd82594999 in _start (/usr/local/RDsan/lib/R/bin/exec/R+0x999)

0x7fd1de376b5c is located 56 bytes to the right of global variable 'centeroffx' defined in 'geohash.h:51:18' (0x7fd1de376b00) of size 36
0x7fd1de376b5c is located 4 bytes to the left of global variable 'centeroffy' defined in 'geohash.h:52:18' (0x7fd1de376b60) of size 36
SUMMARY: AddressSanitizer: global-buffer-overflow /geohashTools/src/geohash.c:159 in gh_decode
Shadow bytes around the buggy address:
  0x0ffabbc66d10: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  0x0ffabbc66d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffabbc66d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffabbc66d40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffabbc66d50: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
=>0x0ffabbc66d60: 00 00 00 00 04 f9 f9 f9 f9 f9 f9[f9]00 00 00 00
  0x0ffabbc66d70: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ffabbc66d80: 00 00 00 02 f9 f9 f9 f9 00 00 00 00 00 00 00 06
  0x0ffabbc66d90: f9 f9 f9 f9 00 00 00 00 00 00 03 f9 f9 f9 f9 f9
  0x0ffabbc66da0: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 02 f9 f9
  0x0ffabbc66db0: f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9 00 00 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==116==ABORTING

It's pretty clear -- we're trying to access the map array way outside its allocated boundaries:

charToRaw('ß')
[1] c3 9f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant