buggperf - Bugs: bug #43982, Invalid memory access with --pic...

 
 

bug #43982: Invalid memory access with --pic option

Submitter:  None
Submitted:  Mon 12 Jan 2015 01:08:51 AM UTC
   
 
Category:  Generated code Severity:  3 - Normal
Item Group:  None Status:  Invalid
Privacy:  Public Assigned to:  haible
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 25 Nov 2016 07:42:17 PM UTC, comment #1: 

The code snippet that you showed (with a comparison via 'memcmp') is generated only with option -l, and then it looks like this:


  if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
    {
      register int key = hash (str, len);

      if (key <= MAX_HASH_VALUE && key >= 0)
        if (len == lengthtable[key])
          {
            register const char *s = wordlist[key] + stringpool;

            if (*str == *s && !memcmp (str + 1, s + 1, len - 1))
              return s;
          }
    }


The code first makes sure that len > 0.
Then it computes the hash code.
Then it proceeds only when len == lengthtable[key], which implies that lengthtable[key] > 0 (since we already know that len > 0), which implies that the hash table entry exists (since the non-existing entries have a length 0 assigned in the lengthtable).

Similarly, when gperf option -l is used together with -D


          register int index = lookup[key];

          if (index >= 0)
            {
              if (len == lengthtable[index])
                {
                  register const char *s = wordlist[index] + stringpool;

                  if (*str == *s && !memcmp (str + 1, s + 1, len - 1))
                    return s;
                }
            }


In this case the index has been validated because it's an non-negative element of the 'lookup' table.

So there is no bug.

Bruno Haible <haible>
Group administrator
Mon 12 Jan 2015 01:08:51 AM UTC, original submission:  

With the --pic option, the keyword slot is set to -1 for non-existing hash table entries. This can result in a memory access outside of the string pool in the following piece of generated code:

  register const char *s = wordlist[key].keyword + stringpool;

  if (*str == *s && !memcmp (str + 1, s + 1, len - 1))
    return &wordlist[key];

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Updated the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-11-25 haible StatusNone Invalid
        Assigned toNone haible
        Open/ClosedOpen Closed
    2016-11-24 haible CategoryNone Generated code

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code