Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

out-of-bounds read for empty CCL #197

Closed
millert opened this issue Sep 22, 2023 · 1 comment
Closed

out-of-bounds read for empty CCL #197

millert opened this issue Sep 22, 2023 · 1 comment

Comments

@millert
Copy link
Contributor

millert commented Sep 22, 2023

Running testdir/t.re2 with -fsanitize=address exposes a problem where an empty UTF-8 string is stored but later accessed as a UTF-32 string.

==3469646==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001290 at pc 0x562edf01cd76 bp 0x7ffd32ea3b90 sp 0x7ffd32ea3b80
READ of size 4 at 0x602000001290 thread T0
    #0 0x562edf01cd75 in member /home/millert/awk.millert/b.c:590
    #1 0x562edf01e61c in cgoto /home/millert/awk.millert/b.c:1423
    #2 0x562edf01fa54 in match /home/millert/awk.millert/b.c:642
    #3 0x562edf031988 in matchop /home/millert/awk.millert/run.c:815
    #4 0x562edf02edfd in execute /home/millert/awk.millert/run.c:166
    #5 0x562edf0302b0 in relop /home/millert/awk.millert/run.c:892
    #6 0x562edf02edfd in execute /home/millert/awk.millert/run.c:166
    #7 0x562edf036764 in pastat /home/millert/awk.millert/run.c:1635
    #8 0x562edf02edfd in execute /home/millert/awk.millert/run.c:166
    #9 0x562edf02f102 in program /home/millert/awk.millert/run.c:198
    #10 0x562edf02edfd in execute /home/millert/awk.millert/run.c:166
    #11 0x562edf03b5f4 in run /home/millert/awk.millert/run.c:141
    #12 0x562edf022015 in main /home/millert/awk.millert/main.c:230
    #13 0x7f7734023a8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #14 0x7f7734023b48 in __libc_start_main_impl ../csu/libc-start.c:360
    #15 0x562edf016b64 in _start (/home/millert/awk.millert/a.out+0x13b64) (BuildId: 5d9a6a6abce7e8da74c5c8232229af6ba5d6668a)

0x602000001291 is located 0 bytes after 1-byte region [0x602000001290,0x602000001291)
allocated by thread T0 here:
    #0 0x7f77344841b8 in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:454
    #1 0x562edf0244a4 in tostring /home/millert/awk.millert/tran.c:526
    #2 0x562edf01e1cd in primary /home/millert/awk.millert/b.c:948
    #3 0x562edf01deb5 in concat /home/millert/awk.millert/b.c:968
    #4 0x562edf01df35 in regexp /home/millert/awk.millert/b.c:902
    #5 0x562edf01e2f9 in reparse /home/millert/awk.millert/b.c:894
    #6 0x562edf01f566 in mkdfa /home/millert/awk.millert/b.c:228
    #7 0x562edf02134c in makedfa /home/millert/awk.millert/b.c:193
    #8 0x562edf018bc1 in yyparse /home/millert/awk.millert/awkgram.y:285
    #9 0x562edf021f4c in main /home/millert/awk.millert/main.c:219
    #10 0x7f7734023a8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

I've amended #196 to include a fix for this, since it is a related problem. If you prefer, can create a separate PR for it.

@plan9
Copy link
Collaborator

plan9 commented Sep 25, 2023

thanks todd, no need for a seperate PR.

@plan9 plan9 closed this as completed Oct 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants