Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

memory allocation failure in _zip_cdir_grow #6

Closed
asarubbo opened this issue Aug 24, 2017 · 3 comments
Closed

memory allocation failure in _zip_cdir_grow #6

asarubbo opened this issue Aug 24, 2017 · 3 comments

Comments

@asarubbo
Copy link

On 1.2.0:

# ziptool $FILE cat index
==16798==ERROR: AddressSanitizer failed to allocate 0xc0a96a2000 (827476025344) bytes of LargeMmapAllocator (error code: 12)                                                                                      
==16798==Process memory map follows:                                                                                                                                                                              
        0x000000400000-0x00000054b000   /usr/bin/ziptool                                                                                                                                                          
        0x00000074b000-0x00000074c000   /usr/bin/ziptool                                                                                                                                                          
        0x00000074c000-0x000000753000   /usr/bin/ziptool                                                                                                                                                          
        0x000000753000-0x0000013c8000                                                                                                                                                                             
        0x00007fff7000-0x00008fff7000                                                                                                                                                                             
        0x00008fff7000-0x02008fff7000                                                                                                                                                                             
        0x02008fff7000-0x10007fff8000                                                                                                                                                                             
        0x600000000000-0x602000000000                                                                                                                                                                             
        0x602000000000-0x602000010000                                                                                                                                                                             
        0x602000010000-0x602e00000000                                                                                                                                                                             
        0x602e00000000-0x602e00010000                                                                                                                                                                             
        0x602e00010000-0x603000000000                                                                                                                                                                             
        0x603000000000-0x603000010000                                                                                                                                                                             
        0x603000010000-0x603e00000000                                                                                                                                                                             
        0x603e00000000-0x603e00010000                                                                                                                                                                             
        0x603e00010000-0x606000000000                                                                                                                                                                             
        0x606000000000-0x606000010000                                                                                                                                                                             
        0x606000010000-0x606e00000000                                                                                                                                                                             
        0x606e00000000-0x606e00010000                                                                                                                                                                             
        0x606e00010000-0x607000000000                                                                                                                                                                             
        0x607000000000-0x607000010000                                                                                                                                                                             
        0x607000010000-0x607e00000000                                                                                                                                                                             
        0x607e00000000-0x607e00010000
        0x607e00010000-0x60c000000000
        0x60c000000000-0x60c000010000
        0x60c000010000-0x60ce00000000
        0x60ce00000000-0x60ce00010000
        0x60ce00010000-0x60e000000000
        0x60e000000000-0x60e000010000
        0x60e000010000-0x60ee00000000
        0x60ee00000000-0x60ee00010000
        0x60ee00010000-0x616000000000
        0x616000000000-0x616000010000
        0x616000010000-0x616e00000000
        0x616e00000000-0x616e00010000
        0x616e00010000-0x61d000000000
        0x61d000000000-0x61d000010000
        0x61d000010000-0x61de00000000
        0x61de00000000-0x61de00010000
        0x61de00010000-0x621000000000
        0x621000000000-0x621000010000
        0x621000010000-0x621e00000000
        0x621e00000000-0x621e00010000
        0x621e00010000-0x631000000000
        0x631000000000-0x631000020000
        0x631000020000-0x631e00000000
        0x631e00000000-0x631e00010000
        0x631e00010000-0x640000000000
        0x640000000000-0x640000003000
        0x7f4ed67f7000-0x7f4ed7400000
        0x7f4ed7500000-0x7f4ed7600000
        0x7f4ed76ba000-0x7f4ed9a0c000
        0x7f4ed9a0c000-0x7f4ed9a22000   /lib64/libz.so.1.2.11
        0x7f4ed9a22000-0x7f4ed9c21000   /lib64/libz.so.1.2.11
        0x7f4ed9c21000-0x7f4ed9c22000   /lib64/libz.so.1.2.11
        0x7f4ed9c22000-0x7f4ed9c23000   /lib64/libz.so.1.2.11
        0x7f4ed9c23000-0x7f4ed9db2000   /lib64/libc-2.23.so
        0x7f4ed9db2000-0x7f4ed9fb2000   /lib64/libc-2.23.so
        0x7f4ed9fb2000-0x7f4ed9fb6000   /lib64/libc-2.23.so
        0x7f4ed9fb6000-0x7f4ed9fb8000   /lib64/libc-2.23.so
        0x7f4ed9fb8000-0x7f4ed9fbc000
        0x7f4ed9fbc000-0x7f4ed9fd2000   /usr/lib64/gcc/x86_64-pc-linux-gnu/6.4.0/libgcc_s.so.1
        0x7f4ed9fd2000-0x7f4eda1d1000   /usr/lib64/gcc/x86_64-pc-linux-gnu/6.4.0/libgcc_s.so.1
        0x7f4eda1d1000-0x7f4eda1d2000   /usr/lib64/gcc/x86_64-pc-linux-gnu/6.4.0/libgcc_s.so.1
        0x7f4eda1d2000-0x7f4eda1d3000   /usr/lib64/gcc/x86_64-pc-linux-gnu/6.4.0/libgcc_s.so.1
        0x7f4eda1d3000-0x7f4eda1d5000   /lib64/libdl-2.23.so
        0x7f4eda1d5000-0x7f4eda3d5000   /lib64/libdl-2.23.so
        0x7f4eda3d5000-0x7f4eda3d6000   /lib64/libdl-2.23.so
        0x7f4eda3d6000-0x7f4eda3d7000   /lib64/libdl-2.23.so
        0x7f4eda3d7000-0x7f4eda4d9000   /lib64/libm-2.23.so
        0x7f4eda4d9000-0x7f4eda6d8000   /lib64/libm-2.23.so
        0x7f4eda6d8000-0x7f4eda6d9000   /lib64/libm-2.23.so
        0x7f4eda6d9000-0x7f4eda6da000   /lib64/libm-2.23.so
        0x7f4eda6da000-0x7f4eda6e0000   /lib64/librt-2.23.so
        0x7f4eda6e0000-0x7f4eda8e0000   /lib64/librt-2.23.so
        0x7f4eda8e0000-0x7f4eda8e1000   /lib64/librt-2.23.so
        0x7f4eda8e1000-0x7f4eda8e2000   /lib64/librt-2.23.so
        0x7f4eda8e2000-0x7f4eda8f9000   /lib64/libpthread-2.23.so
        0x7f4eda8f9000-0x7f4edaaf8000   /lib64/libpthread-2.23.so
        0x7f4edaaf8000-0x7f4edaaf9000   /lib64/libpthread-2.23.so
        0x7f4edaaf9000-0x7f4edaafa000   /lib64/libpthread-2.23.so
        0x7f4edaafa000-0x7f4edaafe000
        0x7f4edaafe000-0x7f4edab5c000   /usr/lib64/libzip.so.5.0.0
        0x7f4edab5c000-0x7f4edad5c000   /usr/lib64/libzip.so.5.0.0
        0x7f4edad5c000-0x7f4edad5d000   /usr/lib64/libzip.so.5.0.0
        0x7f4edad5d000-0x7f4edad5f000   /usr/lib64/libzip.so.5.0.0
        0x7f4edad5f000-0x7f4edad83000   /lib64/ld-2.23.so
        0x7f4edadfc000-0x7f4edaf74000
        0x7f4edaf74000-0x7f4edaf82000
        0x7f4edaf82000-0x7f4edaf83000   /lib64/ld-2.23.so
        0x7f4edaf83000-0x7f4edaf84000   /lib64/ld-2.23.so
        0x7f4edaf84000-0x7f4edaf85000
        0x7ffe1f2be000-0x7ffe1f2df000   [stack]
        0x7ffe1f2e7000-0x7ffe1f2e9000   [vvar]
        0x7ffe1f2e9000-0x7ffe1f2eb000   [vdso]
        0xffffffffff600000-0xffffffffff601000   [vsyscall]
==16798==End of process memory map.
==16798==AddressSanitizer CHECK failed: /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/sanitizer_common/sanitizer_common.cc:120 "((0 && "unable to mmap")) != (0)" (0x0, 0x0)
    #0 0x4da9ef in AsanCheckFailed /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_rtl.cc:69
    #1 0x4f5755 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/sanitizer_common/sanitizer_termination.cc:79
    #2 0x4e4d82 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char const*, char const*, int, bool) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/sanitizer_common/sanitizer_common.cc:120
    #3 0x4ee685 in __sanitizer::MmapOrDie(unsigned long, char const*, bool) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/sanitizer_common/sanitizer_posix.cc:132
    #4 0x42608a in __sanitizer::LargeMmapAllocator<__asan::AsanMapUnmapCallback>::Allocate(__sanitizer::AllocatorStats*, unsigned long, unsigned long) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/../sanitizer_common/sanitizer_allocator_secondary.h:41
    #5 0x42608a in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<__asan::AP64>, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<__asan::AP64> >, __sanitizer::LargeMmapAllocator<__asan::AsanMapUnmapCallback> >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<__asan::AP64> >*, unsigned long, unsigned long, bool, bool) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/../sanitizer_common/sanitizer_allocator_combined.h:70
    #6 0x42608a in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_allocator.cc:407
    #7 0x420d3f in __asan::asan_realloc(void*, unsigned long, __sanitizer::BufferedStackTrace*) /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_allocator.cc:791
    #8 0x4d0df1 in realloc /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_malloc_linux.cc:93
    #9 0x7f4edab1b7e5 in _zip_cdir_grow /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_dirent.c:108:37
    #10 0x7f4edab1b7e5 in _zip_cdir_new /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_dirent.c:82
    #11 0x7f4edab390d0 in _zip_read_eocd64 /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_open.c:854:13
    #12 0x7f4edab390d0 in _zip_read_cdir /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_open.c:285
    #13 0x7f4edab390d0 in _zip_find_central_dir /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_open.c:613
    #14 0x7f4edab390d0 in _zip_open /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_open.c:200
    #15 0x7f4edab369b7 in zip_open_from_source /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_open.c:148:11
    #16 0x7f4edab35e93 in zip_open /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/lib/zip_open.c:74:15
    #17 0x513392 in read_from_file /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/src/ziptool.c:698:13
    #18 0x513392 in main /var/tmp/portage/dev-libs/libzip-1.2.0/work/libzip-1.2.0/src/ziptool.c:1113
    #19 0x7f4ed9c43680 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289
    #20 0x41b058 in _init (/usr/bin/ziptool+0x41b058)

Testcase:
https://github.com/asarubbo/poc/blob/master/00330-libzip-memallocfailure-_zip_cdir_grow
@0-wiz-0
Copy link
Member

0-wiz-0 commented Aug 29, 2017

I think this is fixed by 9b46957, please confirm.

Also, let me know how you want to be mentioned in the THANKS file. Thank you!

@asarubbo
Copy link
Author

asarubbo commented Sep 1, 2017

I think is fine just name+surname

@0-wiz-0
Copy link
Member

0-wiz-0 commented Sep 2, 2017

Cited fixed in @asarubbo 's advisory. Thanks!

@0-wiz-0 0-wiz-0 closed this as completed Sep 2, 2017
@DEgITx DEgITx mentioned this issue Jul 30, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@0-wiz-0 @asarubbo