Skip to content
This repository has been archived by the owner on Oct 3, 2021. It is now read-only.

cut-2 and od-1 from busy-box are not memory safe #1275

Closed
mchalupa opened this issue Dec 9, 2020 · 1 comment
Closed

cut-2 and od-1 from busy-box are not memory safe #1275

mchalupa opened this issue Dec 9, 2020 · 1 comment

Comments

@mchalupa
Copy link
Contributor

mchalupa commented Dec 9, 2020

The call to strsep (resp. the call of strtok called from this function) at 2613 may access uninitialized variable sopt (declared at 2573). This variable should be initialized in getopt32, but there is a path where it is not. Check this harness that witnesses the error path:
cut-2_harness.zip

Just compile cut-2.i with the harness and sanitizer and run (or use valgrind instead of sanitizers).

@mchalupa
Copy link
Contributor Author

mchalupa commented Dec 9, 2020

The same problem is in od-1 with variable str_A, this is what you get with the harness below:

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior od-1.i:3947:62 in 
od-1.i:3947:62: runtime error: load of null pointer of type 'const char'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior od-1.i:3947:62 in 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==5418==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x56505ca10c60 bp 0x7ffdaf69a500 sp 0x7ffdaf69a020 T0)
==5418==The signal is caused by a READ memory access.
==5418==Hint: address points to the zero page.
    #0 0x56505ca10c60 in __main /home/marek/src/symbiotic/od-1.i:3947:50
    #1 0x56505ca2127f in main /home/marek/src/symbiotic/od-1.i:5103:13
    #2 0x7f64d9ff2151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
    #3 0x56505c93421d in _start (/home/marek/src/symbiotic/a.out+0x2c21d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/marek/src/symbiotic/od-1.i:3947:50 in __main
==5418==ABORTING

Harness:
od-1_harness.zip

I think this benchmark can be fixed by removing this dereference (it is used during reporting an error)
EDIT: nope, I've mistaken the lines, the dereference is not in reporting the error, so the fix is not that easy.

mchalupa added a commit to staticafi/sv-benchmarks that referenced this issue Dec 9, 2020
@mchalupa mchalupa changed the title cut-2 from busy-box is not memory safe cut-2 and od-1 from busy-box are not memory safe Dec 9, 2020
@dbeyer dbeyer closed this as completed in 469afad Dec 18, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Development

No branches or pull requests

1 participant