-
Notifications
You must be signed in to change notification settings - Fork 10.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[hwasan] Fix a possible null dereference problem #77737
Conversation
@llvm/pr-subscribers-compiler-rt-sanitizer Author: Wu Yingcong (yingcong-wu) ChangesThis is clearly a copy-paste mistake, fix it with this patch. Full diff: https://github.com/llvm/llvm-project/pull/77737.diff 1 Files Affected:
diff --git a/compiler-rt/lib/hwasan/hwasan_report.cpp b/compiler-rt/lib/hwasan/hwasan_report.cpp
index 784cfb904aa275..12a4fa47f21519 100644
--- a/compiler-rt/lib/hwasan/hwasan_report.cpp
+++ b/compiler-rt/lib/hwasan/hwasan_report.cpp
@@ -222,7 +222,7 @@ static void PrintStackAllocations(const StackAllocationsRingBuffer *sa,
if (!local.has_frame_offset || !local.has_size || !local.has_tag_offset)
continue;
if (!(local.name && internal_strlen(local.name)) &&
- !(local.function_name && internal_strlen(local.name)) &&
+ !(local.function_name && internal_strlen(local.function_name)) &&
!(local.decl_file && internal_strlen(local.decl_file)))
continue;
tag_t obj_tag = base_tag ^ local.tag_offset;
|
Is a test case possible? |
Let me see what I can do to add a test case. |
Sorry, I cannot think of a way to add test for this. Do you have any suggestions? |
Hi, I don't have any ideas on how to build a test case for this, could you please give some direction? |
Hi @fmayer , could we land this patch without a test? |
I don't know if easy, or even possible, to trigger this case in test. |
Thanks for the fix! |
No problems. |
This is clearly a copy-paste mistake, fix it with this patch.
After checking the
local.function_name
is not null, it should check the len forlocal.function_name
, notlocal.name
. And this could lead to possible null dereference since the secondinternal_strlen(local.name)
does not guaranteelocal.name
is not null.