Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate potential stack-buffer-overflow #5

Open
Matthewacon opened this issue Apr 4, 2020 · 0 comments
Open

Investigate potential stack-buffer-overflow #5

Matthewacon opened this issue Apr 4, 2020 · 0 comments
Assignees
Labels
bug Something isn't working preventative Prevent future issues

Comments

@Matthewacon
Copy link
Member

When compiling with -DBUILD_BARON_ASAN=ON, a stack-buffer-overflow is detected, however, it doesn't seem to affect execution unless ASAN is enabled.

╰─❱ ./probe            
DEBUG: './libjni.so' uses dynamic JNI linkage
DEBUG: './libjni.so' contains no Agent linkage
DEBUG: [./libjni.so]::JNI_OnLoad -> 0x7fd666c822e0
DEBUG: [./libjni.so]::JNI_OnUnload -> 0x7fd666c827e0
DEBUG: Created library: './libjni.so'
DEBUG: [./libjni.so]::JNI_OnLoad
EXAMPLE AGENT: JNI_OnLoad!
DEBUG: JNIInvokeInterface_::GetEnv
DEBUG: JNINativeInterface_::FindClass
BARON INFO: Fabricated class 'yo_this is not a valid class name_' -> 0x613000000040
DEBUG: JNINativeInterface_::GetMethodID
=================================================================
==1603154==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd3dc13dc8 at pc 0x7fd669f29533 bp 0x7ffd3dc13b30 sp 0x7ffd3dc13b28
READ of size 1 at 0x7ffd3dc13dc8 thread T0
    #0 0x7fd669f29532 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int) baron/build/../fake-jni/src/jvm/method.cpp:269:45
    #1 0x7fd66a0c356e in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:56:14
    #2 0x7fd669e7ca7e in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::operator()(JNIEnv_*, _jclass*, char const*, char const*) const baron/build/../fake-jni/src/jni/native/native.cpp:159:15
    #3 0x7fd669e7c80c in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::__invoke(JNIEnv_*, _jclass*, char const*, char const*) baron/build/../fake-jni/src/jni/native/native.cpp:156:17
    #4 0x7fd666c829fb in JNIEnv_::GetMethodID(_jclass*, char const*, char const*) baron/build/../example/jni/include/jni.h:903:16
    #5 0x7fd666c824c8 in JNI_OnLoad baron/build/../example/jni/src/jni.cpp:23:26
    #6 0x7fd669e46464 in FakeJni::Library::jniLoad() const baron/build/../fake-jni/src/internal/library.cpp:189:11
    #7 0x7fd669ef343c in FakeJni::Jvm::attachLibrary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, FakeJni::LibraryOptions) baron/build/../fake-jni/src/jvm/jvm.cpp:371:19
    #8 0x5639bf227bfa in main baron/build/../example/probe/src/main.cpp:11:5
    #9 0x7fd669857022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)
    #10 0x5639bf14e28d in _start (baron/build/example/probe+0x2428d)

Address 0x7ffd3dc13dc8 is located in stack of thread T0 at offset 72 in frame
    #0 0x7fd66a0c2edf in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:50

  This frame has 3 object(s):
    [32, 48) 'callback' (line 53)
    [64, 72) 'agg.tmp' <== Memory access at offset 72 overflows this variable
    [96, 112) 'agg.tmp18'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow baron/build/../fake-jni/src/jvm/method.cpp:269:45 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int)
Shadow bytes around the buggy address:
  0x100027b7a760: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
  0x100027b7a770: 00 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 00 f3 f3 f3
  0x100027b7a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100027b7a7b0: f1 f1 f1 f1 00 00 f2 f2 00[f2]f2 f2 00 00 f3 f3
  0x100027b7a7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1603154==ABORTING
@Matthewacon Matthewacon added bug Something isn't working high priority preventative Prevent future issues labels Apr 4, 2020
@Matthewacon Matthewacon self-assigned this Apr 4, 2020
@Matthewacon Matthewacon added this to Needs triage in Triage via automation Apr 4, 2020
@Matthewacon Matthewacon added this to To do in Sprint Apr 4, 2020
@Matthewacon Matthewacon moved this from Needs triage to High priority in Triage Apr 4, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working preventative Prevent future issues
Projects
Sprint
  
To do
Triage
High priority
Development

No branches or pull requests

1 participant