bugGNU GRUB - Bugs: bug #57829, Memory leaks in the script parser

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57829: Memory leaks in the script parser

Submitter:  felix <felix_s>
Submitted:  Sun 16 Feb 2020 05:38:48 PM UTC
 
Category:  None Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  * Git master
Release:  Reproducibility:  Every Time
Planned Release:  None
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       

 

Sun 16 Feb 2020 05:38:48 PM UTC, original submission:  

Discovered by LeakSanitizer:

$ ./config.status --config
'--with-platform=emu' 'CFLAGS=-fsanitize=address -fsanitize=undefined -g -O0' 'LDFLAGS=-fsanitize=address -fsanitize=undefined -g -O0' 'CC=ccache gcc'

(Some kludges were necessary so that grub-emu-lite and modules successfully compile with ASan, but that isn’t terribly relevant here.)

Sample session:

$ ./grub-script-check
if true
then true
fi

=================================================================
==5207==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0xb7a38267 in __interceptor_malloc (/lib/i386-linux-gnu/libasan.so.5+0x4944c267)
    #1 0x4a5b9e in grub_malloc grub-core/kern/emu/mm.c:32
    #2 0x49ddd7 in yy_scan_buffer grub_script.yy.c:2254
    #3 0x49e758 in yy_scan_bytes grub_script.yy.c:2312
    #4 0x49e437 in yy_scan_string grub_script.yy.c:2284
    #5 0x48a355 in grub_script_lexer_yywrap grub-core/script/lexer.c:207
    #6 0x4a1a2b in yywrap grub-core/script/yylex.l:337
    #7 0x493978 in yylex grub_script.yy.c:1627
    #8 0x48b1ec in grub_script_yylex grub-core/script/lexer.c:306
    #9 0x4804fa in grub_script_yyparse grub_script.tab.c:1390
    #10 0x47f863 in grub_script_parse grub-core/script/script.c:377
    #11 0x47ce5a in main util/grub-script-check.c:191
    #12 0xb729d810 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x4514b810)

Indirect leak of 12 byte(s) in 1 object(s) allocated from:
    #0 0xb7a38267 in __interceptor_malloc (/lib/i386-linux-gnu/libasan.so.5+0x4944c267)
    #1 0x4a5b9e in grub_malloc grub-core/kern/emu/mm.c:32
    #2 0x49e484 in yy_scan_bytes grub_script.yy.c:2303
    #3 0x49e437 in yy_scan_string grub_script.yy.c:2284
    #4 0x48a355 in grub_script_lexer_yywrap grub-core/script/lexer.c:207
    #5 0x4a1a2b in yywrap grub-core/script/yylex.l:337
    #6 0x493978 in yylex grub_script.yy.c:1627
    #7 0x48b1ec in grub_script_yylex grub-core/script/lexer.c:306
    #8 0x4804fa in grub_script_yyparse grub_script.tab.c:1390
    #9 0x47f863 in grub_script_parse grub-core/script/script.c:377
    #10 0x47ce5a in main util/grub-script-check.c:191
    #11 0xb729d810 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x4514b810)

SUMMARY: AddressSanitizer: 60 byte(s) leaked in 2 allocation(s).

Other successfully parsing samples that cause memory leaks:

for x in a
do true
done

while true
do true
done

true {
true
}

I’m not quite sure where the problem lies, but it seems crucial that the compound statement have multiple lines for leaks to occur.

Scripts that fail to parse also generate memory leaks, for example:

true { }

true "

true {

(the latter two also generate an ‘out of memory’ message for some reason)

felix <felix_s>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by felix_s (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.9