AddressSanitizer: fix heap-buffer-overflow (caused by base64_decode()) #894
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes the followg memory overflow eror:
==14924==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000114f2f at pc 0x7f9a07e6aed2 bp 0x7fff38e88bb0 sp 0x7fff38e88ba0
READ of size 1 at 0x602000114f2f thread T0
#0 0x7f9a07e6aed1 in base64_decode(unsigned char const*, unsigned long, unsigned long*) pxCore/examples/pxScene2d/src/pxScene2d.cpp:345
#1 0x627b36 in screenshotTest::test_base64_encode_decode() pxCore/tests/pxScene2d/test_screenshot.cpp:60
#2 0x627b36 in screenshotTest_screenshotTests_Test::TestBody() pxCore/tests/pxScene2d/test_screenshot.cpp:183
#3 0x80ccbe in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#4 0x80ccbe in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#5 0x7d2bad in testing::Test::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2474
#6 0x7d2d92 in testing::TestInfo::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2656
#7 0x7d3266 in testing::TestCase::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2774
#8 0x7d7c85 in testing::internal::UnitTestImpl::RunAllTests() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4649
#9 0x7d82cf in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#10 0x7d82cf in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#11 0x7d82cf in testing::UnitTest::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4257
#12 0x4b627a in RUN_ALL_TESTS() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/include/gtest/gtest.h:2233
#13 0x4b627a in main pxCore/tests/pxScene2d/pxscene2dtestsmain.cpp:101
#14 0x7f9a02ab4009 in __libc_start_main (/lib64/libc.so.6+0x21009)
#15 0x4c6df9 in _start (pxCore/tests/pxScene2d/pxscene2dtests+0x4c6df9)
0x602000114f2f is located 1 bytes to the left of 1-byte region [0x602000114f30,0x602000114f31)
allocated by thread T0 here:
#0 0x7f9a08881850 in malloc (/lib64/libasan.so.4+0xde850)
#1 0x7f9a07e6a915 in base64_encode(unsigned char const*, unsigned long, unsigned long*) pxCore/examples/pxScene2d/src/pxScene2d.cpp:311
#2 0x627809 in screenshotTest::test_base64_encode_decode() pxCore/tests/pxScene2d/test_screenshot.cpp:55
#3 0x627809 in screenshotTest_screenshotTests_Test::TestBody() pxCore/tests/pxScene2d/test_screenshot.cpp:183
#4 0x80ccbe in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#5 0x80ccbe in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#6 0x7d2bad in testing::Test::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2474
#7 0x7d2d92 in testing::TestInfo::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2656
#8 0x7d3266 in testing::TestCase::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2774
#9 0x7d7c85 in testing::internal::UnitTestImpl::RunAllTests() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4649
#10 0x7d82cf in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#11 0x7d82cf in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#12 0x7d82cf in testing::UnitTest::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4257
#13 0x4b627a in RUN_ALL_TESTS() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/include/gtest/gtest.h:2233
#14 0x4b627a in main pxCore/tests/pxScene2d/pxscene2dtestsmain.cpp:101
#15 0x7f9a02ab4009 in __libc_start_main (/lib64/libc.so.6+0x21009)
SUMMARY: AddressSanitizer: heap-buffer-overflow pxCore/examples/pxScene2d/src/pxScene2d.cpp:345 in base64_decode(unsigned char const*, unsigned long, unsigned long*)
Shadow bytes around the buggy address:
0x0c048001a990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9d0: fa fa fa fa fa fa fd fd fa fa fa fa fa fa fa fa
=>0x0c048001a9e0: fa fa fa fa fa[fa]01 fa fa fa fd fd fa fa fa fa
0x0c048001a9f0: fa fa 01 fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c048001aa00: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c048001aa10: fa fa fd fa fa fa fd fa fa fa fd fa fa fa^[[0m fd fa
0x0c048001aa20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c048001aa30: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==14924==ABORTING
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes the followg memory overflow eror:
==14924==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000114f2f at pc 0x7f9a07e6aed2 bp 0x7fff38e88bb0 sp 0x7fff38e88ba0
READ of size 1 at 0x602000114f2f thread T0
#0 0x7f9a07e6aed1 in base64_decode(unsigned char const*, unsigned long, unsigned long*) pxCore/examples/pxScene2d/src/pxScene2d.cpp:345
#1 0x627b36 in screenshotTest::test_base64_encode_decode() pxCore/tests/pxScene2d/test_screenshot.cpp:60
#2 0x627b36 in screenshotTest_screenshotTests_Test::TestBody() pxCore/tests/pxScene2d/test_screenshot.cpp:183
#3 0x80ccbe in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#4 0x80ccbe in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#5 0x7d2bad in testing::Test::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2474
#6 0x7d2d92 in testing::TestInfo::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2656
#7 0x7d3266 in testing::TestCase::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2774
#8 0x7d7c85 in testing::internal::UnitTestImpl::RunAllTests() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4649
#9 0x7d82cf in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#10 0x7d82cf in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#11 0x7d82cf in testing::UnitTest::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4257
#12 0x4b627a in RUN_ALL_TESTS() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/include/gtest/gtest.h:2233
#13 0x4b627a in main pxCore/tests/pxScene2d/pxscene2dtestsmain.cpp:101
#14 0x7f9a02ab4009 in __libc_start_main (/lib64/libc.so.6+0x21009)
#15 0x4c6df9 in _start (pxCore/tests/pxScene2d/pxscene2dtests+0x4c6df9)
0x602000114f2f is located 1 bytes to the left of 1-byte region [0x602000114f30,0x602000114f31)
allocated by thread T0 here:
#0 0x7f9a08881850 in malloc (/lib64/libasan.so.4+0xde850)
#1 0x7f9a07e6a915 in base64_encode(unsigned char const*, unsigned long, unsigned long*) pxCore/examples/pxScene2d/src/pxScene2d.cpp:311
#2 0x627809 in screenshotTest::test_base64_encode_decode() pxCore/tests/pxScene2d/test_screenshot.cpp:55
#3 0x627809 in screenshotTest_screenshotTests_Test::TestBody() pxCore/tests/pxScene2d/test_screenshot.cpp:183
#4 0x80ccbe in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#5 0x80ccbe in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#6 0x7d2bad in testing::Test::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2474
#7 0x7d2d92 in testing::TestInfo::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2656
#8 0x7d3266 in testing::TestCase::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2774
#9 0x7d7c85 in testing::internal::UnitTestImpl::RunAllTests() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4649
#10 0x7d82cf in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2402
#11 0x7d82cf in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::)(), char const) pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:2438
#12 0x7d82cf in testing::UnitTest::Run() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/src/gtest.cc:4257
#13 0x4b627a in RUN_ALL_TESTS() pxCore/tests/pxScene2d/../../examples/pxScene2d/external/gtest/googletest/include/gtest/gtest.h:2233
#14 0x4b627a in main pxCore/tests/pxScene2d/pxscene2dtestsmain.cpp:101
#15 0x7f9a02ab4009 in __libc_start_main (/lib64/libc.so.6+0x21009)
SUMMARY: AddressSanitizer: heap-buffer-overflow pxCore/examples/pxScene2d/src/pxScene2d.cpp:345 in base64_decode(unsigned char const*, unsigned long, unsigned long*)
Shadow bytes around the buggy address:
0x0c048001a990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c048001a9d0: fa fa fa fa fa fa fd fd fa fa fa fa fa fa fa fa
=>0x0c048001a9e0: fa fa fa fa fa[fa]01 fa fa fa fd fd fa fa fa fa
0x0c048001a9f0: fa fa 01 fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c048001aa00: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c048001aa10: fa fa fd fa fa fa fd fa fa fa fd fa fa fa^[[0m fd fa
0x0c048001aa20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c048001aa30: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==14924==ABORTING