You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
$ w3m.ubsan -T text/html -dump case1
table.c:1222:18: runtime error: variable length array bound evaluates to non-positive value 0
case2
00000000: 3c74 6162 6c65 3e <table>
$ w3m.ubsan -T text/html -dump case2
table.c:1574:20: runtime error: variable length array bound evaluates to non-positive value 0
I don't know they are security related or not. But since MSan may be confused. I think they are worth to fix.
This is found by afl-fuzz.
The text was updated successfully, but these errors were encountered:
kcwu
changed the title
ASan may incorrectly report buffer overflow due to undefined behavior
MSan may incorrectly report buffer overflow due to undefined behavior
Dec 10, 2016
Compiling with GCC 10.2 with -fsanitize=address,undefined valgrind
and opening the 'opions panel' reports:
table.c:1632:8: runtime error: variable length array bound evaluates to non-positive value 0
table.c:1266:11: runtime error: variable length array bound evaluates to non-positive value 0
table.c:1267:12: runtime error: variable length array bound evaluates to non-positive value 0
'maxcell' is initialized to -1 which results in a size of 0 during the
first iteration. Though the array is only accessed if maxcell >= 0,
using a variable length array with a size < 1 is undefined behaviour
(see e.g. C99 6.7.5.2,p5).
This closes issue tats#51 .
I cannot recall the exact case confusing MSan. Something like this:
MSan may report buffer overflow when access
bar
.Build w3m with clang -fsanitize=undefined
case1
case2
I don't know they are security related or not. But since MSan may be confused. I think they are worth to fix.
This is found by afl-fuzz.
The text was updated successfully, but these errors were encountered: