Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AIS: array access out of bounds #2101

Open
dforsi opened this issue May 5, 2024 · 1 comment
Open

AIS: array access out of bounds #2101

dforsi opened this issue May 5, 2024 · 1 comment
Assignees
@srcejon

Comments

@dforsi
Copy link
Contributor

dforsi commented May 5, 2024

When running sdrangel under ASAN detects a read access error at this line:

AISDemodSink::processOneSample(std::complex<float>&) sdrangel/plugins/channelrx/demodais/aisdemodsink.cpp:20

Printing the variable before line 204 shows that the error is triggered when x is zero, so the code reads from item -1 of the array

qDebug("x %d sampleOffset %d i %d m_rxBufLength %d", x, sampleOffset, i, m_rxBufLength);

I noticed that each time the starting value of x in incremented by 1:

2024-05-05 23:36:22.514 (D) x 113 sampleOffset -1 i 0 m_rxBufLength 6432
2024-05-05 23:36:22.516 (D) x 114 sampleOffset -1 i 0 m_rxBufLength 6432
2024-05-05 23:36:22.517 (D) x 115 sampleOffset -1 i 0 m_rxBufLength 6432
...

Here is the full output of the error:

READ of size 4 at 0x52b00028b1fc thread T27 (QThread)
    #0 0x7fcefc35e7ec in AISDemodSink::processOneSample(std::complex<float>&) sdrangel/plugins/channelrx/demodais/aisdemodsink.cpp:204
    #1 0x7fcefc35d9fa in AISDemodSink::feed(__gnu_cxx::__normal_iterator<Sample const*, std::vector<Sample, std::allocator<Sample> > > const&, __gnu_cxx::__normal_iterator<Sample const*, std::vector<Sample, std::allocator<Sample> > > const&) sdrangel/plugins/channelrx/demodais/aisdemodsink.cpp:112
    #2 0x7fcf28e88cec in DownChannelizer::feed(__gnu_cxx::__normal_iterator<Sample const*, std::vector<Sample, std::allocator<Sample> > > const&, __gnu_cxx::__normal_iterator<Sample const*, std::vector<Sample, std::allocator<Sample> > > const&) sdrangel/sdrbase/dsp/downchannelizer.cpp:57
    #3 0x7fcefc358766 in AISDemodBaseband::handleData() sdrangel/plugins/channelrx/demodais/aisdemodbaseband.cpp:107
    #4 0x7fcefc359c42 in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (AISDemodBaseband::*)()>::call(void (AISDemodBaseband::*)(), AISDemodBaseband*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:152
    #5 0x7fcefc359a7c in void QtPrivate::FunctionPointer<void (AISDemodBaseband::*)()>::call<QtPrivate::List<>, void>(void (AISDemodBaseband::*)(), AISDemodBaseband*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:185
    #6 0x7fcefc359917 in QtPrivate::QSlotObject<void (AISDemodBaseband::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:418
    #7 0x7fcf262f993f in QObject::event(QEvent*) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2f993f) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #8 0x7fcf26f62f31 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x162f31) (BuildId: dfefd27f084c0dd066215fc79825fceae604f481)
    #9 0x7fcf262cc747 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2cc747) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #10 0x7fcf262cfe50 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2cfe50) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #11 0x7fcf26328696  (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x328696) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #12 0x7fcf253111f3  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x571f3) (BuildId: 15cc0c863407714c5f1c645396cc190177fa08c1)
    #13 0x7fcf25314316  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a316) (BuildId: 15cc0c863407714c5f1c645396cc190177fa08c1)
    #14 0x7fcf2531492f in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a92f) (BuildId: 15cc0c863407714c5f1c645396cc190177fa08c1)
    #15 0x7fcf26327d49 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x327d49) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #16 0x7fcf262cb0fa in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2cb0fa) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #17 0x7fcf260d9c51 in QThread::exec() (/lib/x86_64-linux-gnu/libQt5Core.so.5+0xd9c51) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #18 0x7fcf260daeb0  (/lib/x86_64-linux-gnu/libQt5Core.so.5+0xdaeb0) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #19 0x7fcf2bc5ae55 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
    #20 0x7fcf25aa645b in start_thread nptl/pthread_create.c:444
    #21 0x7fcf25b26bbb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x52b00028b1fc is located 4 bytes before 25728-byte region [0x52b00028b200,0x52b000291680)
allocated by thread T27 (QThread) here:
    #0 0x7fcf2bcf4818 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:98
    #1 0x7fcefc360e7c in AISDemodSink::applySettings(AISDemodSettings const&, bool) sdrangel/plugins/channelrx/demodais/aisdemodsink.cpp:428
    #2 0x7fcefc359240 in AISDemodBaseband::applySettings(AISDemodSettings const&, bool) sdrangel/plugins/channelrx/demodais/aisdemodbaseband.cpp:167
    #3 0x7fcefc358d71 in AISDemodBaseband::handleMessage(Message const&) sdrangel/plugins/channelrx/demodais/aisdemodbaseband.cpp:139
    #4 0x7fcefc358aee in AISDemodBaseband::handleInputMessages() sdrangel/plugins/channelrx/demodais/aisdemodbaseband.cpp:125
    #5 0x7fcefc33d4cb in AISDemodBaseband::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) build-sdrangel-Desktop_qt5-Debug/plugins/channelrx/demodais/demodais_autogen/EWIEGA46WW/moc_aisdemodbaseband.cpp:76
    #6 0x7fcf262f993f in QObject::event(QEvent*) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2f993f) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)
    #7 0x7fcf26f62f31 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x162f31) (BuildId: dfefd27f084c0dd066215fc79825fceae604f481)

Thread T27 (QThread) created by T23 (DSPDeviceSource) here:
    #0 0x7fcf2bcebae1 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245
    #1 0x7fcf260da974 in QThread::start(QThread::Priority) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0xda974) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)

Thread T23 (DSPDeviceSource) created by T0 here:
    #0 0x7fcf2bcebae1 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245
    #1 0x7fcf260da974 in QThread::start(QThread::Priority) (/lib/x86_64-linux-gnu/libQt5Core.so.5+0xda974) (BuildId: ed2abb344a128279a866aa6c4a79f3fa5c87c59e)

SUMMARY: AddressSanitizer: heap-buffer-overflow sdrangel/plugins/channelrx/demodais/aisdemodsink.cpp:204 in AISDemodSink::processOneSample(std::complex<float>&)
Shadow bytes around the buggy address:
  0x52b00028af00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x52b00028af80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x52b00028b000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x52b00028b080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x52b00028b100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x52b00028b180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x52b00028b200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x52b00028b280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x52b00028b300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x52b00028b380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x52b00028b400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==59311==ABORTING
@srcejon srcejon self-assigned this May 7, 2024
@srcejon srcejon mentioned this issue May 8, 2024
Merged
@dforsi
Copy link
Contributor Author

dforsi commented May 25, 2024

The attached zip contains a WAV file that triggers that error in a build with ASAN, while in a build without ASAN a packet gets decoded and saved like this in CSV format:

Date,Time,Data,MMSI,Type,Message,NMEA,Slot,Slots
lun mag 6 2024,20:31:53,,000000000,Unknown message ID (0),"","
",2010,1

I'm going to open a separate issue because trying to load that CSV in sdrangel causes a segfault.

I cut the attached WAV with Audacity and you must add an AIS demodulator at offset +24000 (yes 24) to decode that packet.

IMSI 000000000 +24k - replay_buffer.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@srcejon srcejon

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dforsi @srcejon