AddressSanitizer: global-buffer-overflow

[chris3k]

AddressSanitizer complaining about global-buffer-overflow at https://github.com/bvdberg/ctest/blob/master/ctest.h#L414

[bvdberg]

How did you test this exactly?
I can image that static analysers don't understand what's happening.... since we're searching in the ELF segment...

[chris3k]

Compile sample test with address sanitizer.
$ clang-3.5 -g mytests.c main.c -fsanitize=address && ./a.out 2> broken.asan
$ asan_symbolize-3.5 < broken.asan

=================================================================
==12543==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000006e91f8 at pc 0x0000004bfb30 bp 0x7fff3dc68d10 sp 0x7fff3dc68d08
READ of size 4 at 0x0000006e91f8 thread T0
    #0 0x4bfb2f in ctest_main /home/user/proj/ctest/./ctest.h:409
    #1 0x4c122a in main /home/user/proj/ctest/main.c:10
    #2 0x7f0ff4a34ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #3 0x4b9a4c in _start ??:?

0x0000006e91f8 is located 8 bytes to the left of global variable '__ctest_suite_test' defined in './ctest.h:180:8' (0x6e9200) of size 64
0x0000006e91f8 is located 24 bytes to the right of global variable '__ctest_ctest_test_dbl_far' defined in 'mytests.c:182:1' (0x6e91a0) of size 64
SUMMARY: AddressSanitizer: global-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
  0x0000800d51e0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  0x0000800d51f0: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0000800d5200: f9 f9 f9 f9 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x0000800d5210: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  0x0000800d5220: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00
=>0x0000800d5230: f9 f9 f9 f9 00 00 00 00 00 00 00 00 f9 f9 f9[f9]
  0x0000800d5240: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  0x0000800d5250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  ASan internal:           fe
==12543==ABORTING

You can disable address sanitizer instrumentation for int ctest_main(int argc, const char *argv[]) adding __attribute__((no_address_safety_analysis)). Then, probably you disable asan instrumentation for code you test. I think it should be doable in other, proper way, by changing algorithm for search test begin end range.

[bvdberg]

No, that's just the whole point. You don't know the start/end of that segment. Not unless you use a linker script. But the whole point was not using a linker script ;)
I'll look into using the attribute. I can test on mac OS X and Linux.

[BohuTANG]

Hi,

Master branch is still having this issue from my tests(clang-3.5), man.