bugGNU troff - Bugs: bug #47162, [PATCH] invalid memory access in...

 
 

bug #47162: [PATCH] invalid memory access in small_temp_iterator::operator new

Submitted by:  Balint Reczey <rbalint>
Submitted on:  Mon 15 Feb 2016 10:03:14 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: CrashStatus: Fixed
Privacy: PublicAssigned to: Werner LEMBERG <wl>
Open/Closed: ClosedPlanned Release: 1.22.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 15 Feb 2016 11:34:56 PM UTC, comment #1:

Patch applied, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 15 Feb 2016 10:03:14 PM UTC, original submission:

...
No symbol table info available.
#3 0x00007fd6c6411653 in __ubsan_handle_dynamic_type_cache_miss () from /usr/lib/x86_64-linux-gnu/libubsan.so.0
No symbol table info available.
#4 0x000000000045da43 in small_temp_iterator::operator new (n=n@entry=64) at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:3632
i = <optimized out>
p = <optimized out>
#5 0x000000000045dd9a in make_temp_iterator (s=0x8cb073 <buf+19> "0") at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:3674
n = <optimized out>
#6 0x000000000046290b in interpolate_number_reg (nm=..., inc=<optimized out>) at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:4975
r = 0x25160d0
#7 0x0000000000472413 in token::next (this=0x8c76c0 <tok>) at /home/rbalint/projects/deb/gccs/groff-1.22.3/debian/build/../../src/roff/troff/input.cpp:2133
inc = 0
s = {static table = 0x2537f60, static table_used = 908, static table_size = 4001, static block = 0x2501d4a "", static block_size = 214, s = 0x25157d8 ".C"}
n = 0x0
cc = <optimized out>
x = 2063780463
...

Many invalid memoory accesses were caught by ASAN & UBSAN while bootstrapping hardened1-linux-amd64 Debian port.

In the current bug the free_list handling broke.
One problem with the free_list implementation is the inaccurate calculation of memory needed for storing the free_list array because it does not consider the padding between array elements:
...
(small_temp_iterator )new char[sizeof(small_temp_iterator)BLOCK];
...
https://en.wikipedia.org/wiki/Data_structure_alignment
https://en.wikipedia.org/wiki/Stride_of_an_array

The proposed patch removes all free_list handling, because probably they are not providing significant speed gain with current C++ compilers anyway.

Balint Reczey <rbalint>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #36349:  0001-Get-rid-of-free_list-s.patch added by rbalint (9KiB - text/x-diff - patch fixing the issue)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by rbalint (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 15 Feb 2016 11:34:56 PM UTCwlItem GroupNone=>Crash
      StatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>1.22.4
    Mon 15 Feb 2016 10:03:14 PM UTCrbalintAttached File-=>Added 0001-Get-rid-of-free_list-s.patch, #36349

    Back to the top


    Powered by Savane 3.1-cleanup1