New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AddressSanitizer: heap-buffer-overflow src/utf8/unchecked.h:84 in unsigned int utf8::unchecked::next<char const*>(char const*&) #239

Open
fgeek opened this Issue Nov 17, 2018 · 0 comments

Comments

Projects
None yet
1 participant
@fgeek

fgeek commented Nov 17, 2018

Tested commit: 43c4000
Credit: Henri Salo
sassc-heap-buffer-overflow-unchecked-001.txt

=================================================================
==29891==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000e9f4 at pc 0x55c31af0d602 bp 0x7ffd071309d0 sp 0x7ffd071309c8
READ of size 1 at 0x60600000e9f4 thread T0
    #0 0x55c31af0d601 in unsigned int utf8::unchecked::next<char const*>(char const*&) src/utf8/unchecked.h:84
    #1 0x55c31aec1a34 in handle_error src/sass_context.cpp:84
    #2 0x55c31aec465c in handle_errors src/sass_context.cpp:207
    #3 0x55c31af0795b in sass_parse_block src/sass_context.cpp:253
    #4 0x55c31af0795b in sass_compiler_parse src/sass_context.cpp:483
    #5 0x55c31af08a20 in sass_compile_context src/sass_context.cpp:371
    #6 0x55c31af08a20 in sass_compile_file_context src/sass_context.cpp:470
    #7 0x55c31aeec6b0 in compile_file /home/hsalo/src/sassc/sassc/sassc.c:158
    #8 0x55c31aec782a in main /home/hsalo/src/sassc/sassc/sassc.c:370
    #9 0x7f1ecebb82e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #10 0x55c31aeebd49 in _start (/home/hsalo/src/sassc/sassc/bin/sassc+0x84d49)

0x60600000e9f4 is located 0 bytes to the right of 52-byte region [0x60600000e9c0,0x60600000e9f4)
allocated by thread T0 here:
    #0 0x7f1ecfa99d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x55c31b100df3 in Sass::File::read_file(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) src/file.cpp:463
    #2 0x55c31af4622d in Sass::File_Context::parse() src/context.cpp:574
    #3 0x55c31af06e11 in sass_parse_block src/sass_context.cpp:234
    #4 0x55c31af06e11 in sass_compiler_parse src/sass_context.cpp:483
    #5 0x55c31af08a20 in sass_compile_context src/sass_context.cpp:371
    #6 0x55c31af08a20 in sass_compile_file_context src/sass_context.cpp:470
    #7 0x55c31aeec6b0 in compile_file /home/hsalo/src/sassc/sassc/sassc.c:158

SUMMARY: AddressSanitizer: heap-buffer-overflow src/utf8/unchecked.h:84 in unsigned int utf8::unchecked::next<char const*>(char const*&)
Shadow bytes around the buggy address:
  0x0c0c7fff9ce0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c0c7fff9cf0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0c7fff9d00: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fff9d10: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c0c7fff9d20: fd fd fd fd fd fd fd fd fa fa fa fa 00 00 00 00
=>0x0c0c7fff9d30: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00[04]fa
  0x0c0c7fff9d40: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c0c7fff9d50: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0c7fff9d60: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fff9d70: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c0c7fff9d80: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==29891==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment