C++11に対応する #14
Comments
ma8ma
pushed a commit
that referenced
this issue
Jan 27, 2019
Fix hash length for git revision information
ma8ma
added a commit
that referenced
this issue
Mar 19, 2023
開発者向けテスト版の更新(スナップショット) NOTE: 互換性をしっかりとチェックしていないためテスト用の キャッシュディレクトリを用意することを推奨。 master(82a564b)からの主な変更点 - DAT/HTMLパーサーの機能を強化 - リファクタリング - テストケースを追加 --- FIXME: ChunkedDecoder: heap-buffer-overflow `ChunkedDecoder`のデコード処理で特定の条件のときバッファーオーバーフロー が発生しました。以下の2条件を満たすときバッファの末尾にヌル文字を 書き込もうとしたときバッファの境界を越えるアクセスが起きます。 * 入力の長さと用意したバッファの長さが等しい * デコード結果の長さと入力の長さが等しい ASan report ``` ==182784==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d0014e0480 at pc 0x564e775c611b bp 0x7f763bcc0f00 sp 0x7f763bcc0ef0 WRITE of size 1 at 0x61d0014e0480 thread T48 #0 0x564e775c611a in JDLIB::ChunkedDecoder::decode(char*, unsigned long&) ../src/jdlib/loader.cpp:351 #1 0x564e775d6748 in JDLIB::Loader::run_main() ../src/jdlib/loader.cpp:949 #2 0x564e775f5e9c in void std::__invoke_impl<void, void (JDLIB::Loader::*)(), JDLIB::Loader*>(std::__invoke_memfun_deref, void (JDLIB::Loader::*&&)(), JDLIB::Loader*&&) /usr/include/c++/12/bits/invoke.h:74 #3 0x564e775f5a4c in std::__invoke_result<void (JDLIB::Loader::*)(), JDLIB::Loader*>::type std::__invoke<void (JDLIB::Loader::*)(), JDLIB::Loader*>(void (JDLIB::Loader::*&&)(), JDLIB::Loader*&&) /usr/include/c++/12/bits/invoke.h:96 #4 0x564e775f57b9 in void std::thread::_Invoker<std::tuple<void (JDLIB::Loader::*)(), JDLIB::Loader*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/12/bits/std_thread.h:252 #5 0x564e775f5607 in std::thread::_Invoker<std::tuple<void (JDLIB::Loader::*)(), JDLIB::Loader*> >::operator()() /usr/include/c++/12/bits/std_thread.h:259 #6 0x564e775f53f9 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (JDLIB::Loader::*)(), JDLIB::Loader*> > >::_M_run() /usr/include/c++/12/bits/std_thread.h:210 #7 0x7f76586dc3a2 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc3a2) #8 0x7f7657a90401 in start_thread nptl/pthread_create.c:442 #9 0x7f7657b1f58f in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 0x61d0014e0480 is located 0 bytes to the right of 2048-byte region [0x61d0014dfc80,0x61d0014e0480) allocated by thread T48 here: #0 0x7f765a4c0488 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95 #1 0x564e76c068ca in std::__new_allocator<char>::allocate(unsigned long, void const*) /usr/include/c++/12/bits/new_allocator.h:137 #2 0x564e76c04f6e in std::allocator_traits<std::allocator<char> >::allocate(std::allocator<char>&, unsigned long) /usr/include/c++/12/bits/alloc_traits.h:464 #3 0x564e76c02ab9 in std::_Vector_base<char, std::allocator<char> >::_M_allocate(unsigned long) /usr/include/c++/12/bits/stl_vector.h:378 #4 0x564e76c00813 in std::vector<char, std::allocator<char> >::_M_default_append(unsigned long) /usr/include/c++/12/bits/vector.tcc:650 #5 0x564e76bfee6b in std::vector<char, std::allocator<char> >::resize(unsigned long) /usr/include/c++/12/bits/stl_vector.h:1011 #6 0x564e775d3583 in JDLIB::Loader::run_main() ../src/jdlib/loader.cpp:798 #7 0x564e775f5e9c in void std::__invoke_impl<void, void (JDLIB::Loader::*)(), JDLIB::Loader*>(std::__invoke_memfun_deref, void (JDLIB::Loader::*&&)(), JDLIB::Loader*&&) /usr/include/c++/12/bits/invoke.h:74 #8 0x564e775f5a4c in std::__invoke_result<void (JDLIB::Loader::*)(), JDLIB::Loader*>::type std::__invoke<void (JDLIB::Loader::*)(), JDLIB::Loader*>(void (JDLIB::Loader::*&&)(), JDLIB::Loader*&&) /usr/include/c++/12/bits/invoke.h:96 #9 0x564e775f57b9 in void std::thread::_Invoker<std::tuple<void (JDLIB::Loader::*)(), JDLIB::Loader*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/12/bits/std_thread.h:252 #10 0x564e775f5607 in std::thread::_Invoker<std::tuple<void (JDLIB::Loader::*)(), JDLIB::Loader*> >::operator()() /usr/include/c++/12/bits/std_thread.h:259 #11 0x564e775f53f9 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (JDLIB::Loader::*)(), JDLIB::Loader*> > >::_M_run() /usr/include/c++/12/bits/std_thread.h:210 #12 0x7f76586dc3a2 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc3a2) Thread T48 created by T0 here: #0 0x7f765a44af75 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207 #1 0x7f76586dc478 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc478) #2 0x564e775d1f1d in JDLIB::Loader::create_thread() ../src/jdlib/loader.cpp:745 #3 0x564e775d18cf in JDLIB::Loader::run(SKELETON::Loadable*, JDLIB::LOADERDATA const&) ../src/jdlib/loader.cpp:724 #4 0x564e778f53e1 in SKELETON::Loadable::start_load(JDLIB::LOADERDATA const&) ../src/skeleton/loadable.cpp:123 #5 0x564e7724c305 in DBTREE::BoardBase::download_subject(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) ../src/dbtree/boardbase.cpp:1030 #6 0x564e772bf21b in DBTREE::board_download_subject(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ../src/dbtree/interface.cpp:422 #7 0x564e76ddd485 in BOARD::BoardViewBase::show_view() ../src/board/boardviewbase.cpp:1294 #8 0x564e76d9469a in BOARD::BoardView::show_view() ../src/board/boardview.cpp:115 #9 0x564e76d94040 in BOARD::BoardView::reload() ../src/board/boardview.cpp:102 #10 0x564e76de86f9 in BOARD::BoardViewBase::operate_view(int) ../src/board/boardviewbase.cpp:1552 #11 0x564e76dfef89 in BOARD::BoardViewBase::slot_key_press(_GdkEventKey*) ../src/board/boardviewbase.cpp:2227 #12 0x564e76e3f089 in sigc::bound_mem_functor1<bool, BOARD::BoardViewBase, _GdkEventKey*>::operator()(_GdkEventKey* const&) const /usr/include/sigc++-2.0/sigc++/functors/mem_fun.h:2066 #13 0x564e76e39650 in sigc::adaptor_functor<sigc::bound_mem_functor1<bool, BOARD::BoardViewBase, _GdkEventKey*> >::deduce_result_type<_GdkEventKey* const&, void, void, void, void, void, void>::type sigc::adaptor_functor<sigc::bound_mem_functor1<bool, BOARD::BoardViewBase, _GdkEventKey*> >::operator()<_GdkEventKey* const&>(_GdkEventKey* const&) const /usr/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:89 #14 0x564e76e3464f in sigc::internal::slot_call<sigc::bound_mem_functor1<bool, BOARD::BoardViewBase, _GdkEventKey*>, bool, _GdkEventKey*>::call_it(sigc::internal::slot_rep*, _GdkEventKey* const&) /usr/include/sigc++-2.0/sigc++/functors/slot.h:451 #15 0x564e76b74962 in sigc::internal::signal_emit1<bool, _GdkEventKey*, sigc::nil>::emit(sigc::internal::signal_impl*, _GdkEventKey* const&) /usr/include/sigc++-2.0/sigc++/signal.h:952 #16 0x564e76b65d3d in sigc::signal1<bool, _GdkEventKey*, sigc::nil>::emit(_GdkEventKey* const&) const /usr/include/sigc++-2.0/sigc++/signal.h:2955 #17 0x564e77a1eba4 in SKELETON::JDTreeViewBase::on_key_press_event(_GdkEventKey*) ../src/skeleton/treeviewbase.cpp:387 #18 0x564e77849a46 in SKELETON::DragTreeView::on_key_press_event(_GdkEventKey*) ../src/skeleton/dragtreeview.cpp:431 #19 0x7f765a10a317 in Gtk::Widget_Class::key_press_event_callback(_GtkWidget*, _GdkEventKey*) (/lib/x86_64-linux-gnu/libgtkmm-3.0.so.1+0x30a317) SUMMARY: AddressSanitizer: heap-buffer-overflow ../src/jdlib/loader.cpp:351 in JDLIB::ChunkedDecoder::decode(char*, unsigned long&) Shadow bytes around the buggy address: 0x0c3a80294040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a80294050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a80294060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a80294070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a80294080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c3a80294090:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a802940a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a802940b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a802940c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a802940d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a802940e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==182784==ABORTING ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
edit(2019-11-30): リストを更新
C++ Core Guidelinesを参考にC++11の機能を使ってコードを修正する。
gtk3-preview)deleteでリソースを開放しているコードを修正するmalloc(),free()でリソースを確保開放しているコードを修正するenum class)を使うNULLをnullptrに置き換える (fixed by Replace NULL and 0 for being assigned to pointer with nullptr JDimproved/JDim#150)MISC::itostrをstd::to_stringに置き換える (fixed by Use std::to_string instead of MISC::itostr JDimproved/JDim#148)The text was updated successfully, but these errors were encountered: