We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
When compiling with -DBUILD_BARON_ASAN=ON, a stack-buffer-overflow is detected, however, it doesn't seem to affect execution unless ASAN is enabled.
-DBUILD_BARON_ASAN=ON
stack-buffer-overflow
╰─❱ ./probe DEBUG: './libjni.so' uses dynamic JNI linkage DEBUG: './libjni.so' contains no Agent linkage DEBUG: [./libjni.so]::JNI_OnLoad -> 0x7fd666c822e0 DEBUG: [./libjni.so]::JNI_OnUnload -> 0x7fd666c827e0 DEBUG: Created library: './libjni.so' DEBUG: [./libjni.so]::JNI_OnLoad EXAMPLE AGENT: JNI_OnLoad! DEBUG: JNIInvokeInterface_::GetEnv DEBUG: JNINativeInterface_::FindClass BARON INFO: Fabricated class 'yo_this is not a valid class name_' -> 0x613000000040 DEBUG: JNINativeInterface_::GetMethodID ================================================================= ==1603154==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd3dc13dc8 at pc 0x7fd669f29533 bp 0x7ffd3dc13b30 sp 0x7ffd3dc13b28 READ of size 1 at 0x7ffd3dc13dc8 thread T0 #0 0x7fd669f29532 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int) baron/build/../fake-jni/src/jvm/method.cpp:269:45 #1 0x7fd66a0c356e in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:56:14 #2 0x7fd669e7ca7e in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::operator()(JNIEnv_*, _jclass*, char const*, char const*) const baron/build/../fake-jni/src/jni/native/native.cpp:159:15 #3 0x7fd669e7c80c in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::__invoke(JNIEnv_*, _jclass*, char const*, char const*) baron/build/../fake-jni/src/jni/native/native.cpp:156:17 #4 0x7fd666c829fb in JNIEnv_::GetMethodID(_jclass*, char const*, char const*) baron/build/../example/jni/include/jni.h:903:16 #5 0x7fd666c824c8 in JNI_OnLoad baron/build/../example/jni/src/jni.cpp:23:26 #6 0x7fd669e46464 in FakeJni::Library::jniLoad() const baron/build/../fake-jni/src/internal/library.cpp:189:11 #7 0x7fd669ef343c in FakeJni::Jvm::attachLibrary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, FakeJni::LibraryOptions) baron/build/../fake-jni/src/jvm/jvm.cpp:371:19 #8 0x5639bf227bfa in main baron/build/../example/probe/src/main.cpp:11:5 #9 0x7fd669857022 in __libc_start_main (/usr/lib/libc.so.6+0x27022) #10 0x5639bf14e28d in _start (baron/build/example/probe+0x2428d) Address 0x7ffd3dc13dc8 is located in stack of thread T0 at offset 72 in frame #0 0x7fd66a0c2edf in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:50 This frame has 3 object(s): [32, 48) 'callback' (line 53) [64, 72) 'agg.tmp' <== Memory access at offset 72 overflows this variable [96, 112) 'agg.tmp18' HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow baron/build/../fake-jni/src/jvm/method.cpp:269:45 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int) Shadow bytes around the buggy address: 0x100027b7a760: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 0x100027b7a770: 00 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 00 f3 f3 f3 0x100027b7a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100027b7a790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100027b7a7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x100027b7a7b0: f1 f1 f1 f1 00 00 f2 f2 00[f2]f2 f2 00 00 f3 f3 0x100027b7a7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100027b7a7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100027b7a7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100027b7a7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100027b7a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1603154==ABORTING
The text was updated successfully, but these errors were encountered:
Matthewacon
No branches or pull requests
When compiling with
-DBUILD_BARON_ASAN=ON
, astack-buffer-overflow
is detected, however, it doesn't seem to affect execution unless ASAN is enabled.The text was updated successfully, but these errors were encountered: