-
Notifications
You must be signed in to change notification settings - Fork 28
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
crashes in test-{smith-form-valence,regression}
compiling with -D_FORTIFY_SOURCE=3
#304
Comments
Thank you for the report. |
I looked into this a bit, since we’re seeing this in Fedora Linux too. I was able to reproduce it with optimization flags Detailed At the time of the segfault in linbox/linbox/blackbox/apply.h Line 596 in 2fb9564
where linbox/linbox/blackbox/apply.h Line 589 in 2fb9564
linbox/linbox/blackbox/apply.h Line 594 in 2fb9564
At the segfault, linbox/linbox/blackbox/apply.h Line 632 in 2fb9564
and then another linbox/linbox/blackbox/apply.h Line 634 in 2fb9564
Since 8 bytes are accessed, this overruns the buffer by one byte. Now the question is, where is the error? |
I can confirm that adjusting the formula for the size of |
To find the size needed, we need the maximum value of |
An alternative solution would be to add 1 to the value of |
I see this was used as justification for the actual fix. Just checking, does this take care of possible overlaps inside the array? The argument might be correct in this case, but the same argument would also "prove" you only need 7*n+1 bits of space to store n 8-bit values, since in this case checkers would also only see a 1-bit-past-the-bounds access (in this contrived example, the factor multiplying The comment indicates It might be that the upper bound indicated by the code is not tight, or ir could be that the upper bound is tight and just very unlikely to be witnessed by random tests. In the latter case there would be "inner overlap" in the array in extreme cases. That being said, this "inner overlap" probably would mix low-order bits with high-order bits of the previous number, and low-order bits are easy to test randomly, so it's likely the bound in the code comment is not tight, so I wouldn't worry about it. cc @jgdumas (tagged jamesjer by accident in a previous version, sorry) |
Ok, I think I see. Now that I think I'm convinced the current bound on |
NixOS now builds all packages with
-D_FORTIFY_SOURCE=3
. This causes two tests,test-smith-form-valence
andtest-regression
, to fail with buffer overflows. To avoid duplication, I will only post the relevant details fortest-smith-form-valence
. The test printsand the stack trace is
This happens on the latest release (tag
v1.7.0
to be precise).The text was updated successfully, but these errors were encountered: