bugGNU GRUB - Bugs: bug #57829, Memory leaks in the script parser

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #57829: Memory leaks in the script parser

Submitted by:  felix <felix_s>
Submitted on:  Sun 16 Feb 2020 05:38:48 PM UTC  
 
Category:  None Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release: 
Release:  Git master Reproducibility:  Every Time
Planned Release:  None

Sun 16 Feb 2020 05:38:48 PM UTC, original submission:  

Discovered by LeakSanitizer:

$ ./config.status --config
'--with-platform=emu' 'CFLAGS=-fsanitize=address -fsanitize=undefined -g -O0' 'LDFLAGS=-fsanitize=address -fsanitize=undefined -g -O0' 'CC=ccache gcc'

(Some kludges were necessary so that grub-emu-lite and modules successfully compile with ASan, but that isn’t terribly relevant here.)

Sample session:

$ ./grub-script-check
if true
then true
fi

=================================================================
==5207==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0xb7a38267 in __interceptor_malloc (/lib/i386-linux-gnu/libasan.so.5+0x4944c267)
    #1 0x4a5b9e in grub_malloc grub-core/kern/emu/mm.c:32
    #2 0x49ddd7 in yy_scan_buffer grub_script.yy.c:2254
    #3 0x49e758 in yy_scan_bytes grub_script.yy.c:2312
    #4 0x49e437 in yy_scan_string grub_script.yy.c:2284
    #5 0x48a355 in grub_script_lexer_yywrap grub-core/script/lexer.c:207
    #6 0x4a1a2b in yywrap grub-core/script/yylex.l:337
    #7 0x493978 in yylex grub_script.yy.c:1627
    #8 0x48b1ec in grub_script_yylex grub-core/script/lexer.c:306
    #9 0x4804fa in grub_script_yyparse grub_script.tab.c:1390
    #10 0x47f863 in grub_script_parse grub-core/script/script.c:377
    #11 0x47ce5a in main util/grub-script-check.c:191
    #12 0xb729d810 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x4514b810)

Indirect leak of 12 byte(s) in 1 object(s) allocated from:
    #0 0xb7a38267 in __interceptor_malloc (/lib/i386-linux-gnu/libasan.so.5+0x4944c267)
    #1 0x4a5b9e in grub_malloc grub-core/kern/emu/mm.c:32
    #2 0x49e484 in yy_scan_bytes grub_script.yy.c:2303
    #3 0x49e437 in yy_scan_string grub_script.yy.c:2284
    #4 0x48a355 in grub_script_lexer_yywrap grub-core/script/lexer.c:207
    #5 0x4a1a2b in yywrap grub-core/script/yylex.l:337
    #6 0x493978 in yylex grub_script.yy.c:1627
    #7 0x48b1ec in grub_script_yylex grub-core/script/lexer.c:306
    #8 0x4804fa in grub_script_yyparse grub_script.tab.c:1390
    #9 0x47f863 in grub_script_parse grub-core/script/script.c:377
    #10 0x47ce5a in main util/grub-script-check.c:191
    #11 0xb729d810 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x4514b810)

SUMMARY: AddressSanitizer: 60 byte(s) leaked in 2 allocation(s).

Other successfully parsing samples that cause memory leaks:

for x in a
do true
done

while true
do true
done

true {
true
}

I’m not quite sure where the problem lies, but it seems crucial that the compound statement have multiple lines for leaks to occur.

Scripts that fail to parse also generate memory leaks, for example:

true { }

true "

true {

(the latter two also generate an ‘out of memory’ message for some reason)

felix <felix_s>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by felix_s (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.5