bugGNU indent - Bugs: bug #64751, Buffer overread in...

 
 

bug #64751: Buffer overread in else-comment-2-br.c and else-comment-2-br-ce.c tests

Submitter:  Robert Scott <ris>
Submitted:  Thu 05 Oct 2023 06:05:00 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Crash Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 05 Oct 2023 06:05:00 PM UTC, original submission:  

Following from #64503:

When running the test suite on master (2685cc0bef0200733b634932ea7399b6cf91b6d7) with indent built with `-fsanitize=address` I get buffer over-reads in the tests `else-comment-2-br.c` and `else-comment-2-br-ce.c`. For `else-comment-2-br-ce.c`:


==3318385==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000014e at pc 0x0000004146c8 bp 0x7fffffffb550 sp 0x7fffffffb548
READ of size 1 at 0x61200000014e thread T0
    #0 0x4146c7 in current_column /build/indent-2.2.13/src/code_io.c:162
    #1 0x4091b4 in print_comment /build/indent-2.2.13/src/comments.c:298
    #2 0x41bc34 in handle_token_comment /build/indent-2.2.13/src/handletoken.c:2189
    #3 0x41bc34 in handle_the_token /build/indent-2.2.13/src/handletoken.c:2385
    #4 0x404e87 in indent_main_loop /build/indent-2.2.13/src/indent.c:672
    #5 0x404e87 in indent /build/indent-2.2.13/src/indent.c:759
    #6 0x402dd1 in indent_single_file /build/indent-2.2.13/src/indent.c:1004
    #7 0x402dd1 in indent_all /build/indent-2.2.13/src/indent.c:1042
    #8 0x402dd1 in main /build/indent-2.2.13/src/indent.c:1123
    #9 0x7ffff775bacd in __libc_start_call_main (/nix/store/aw2fw9ag10wr9pf0qk4nk5sxi0q0bn56-glibc-2.37-8/lib/libc.so.6+0x23acd)
    #10 0x7ffff775bb88 in __libc_start_main_alias_2 (/nix/store/aw2fw9ag10wr9pf0qk4nk5sxi0q0bn56-glibc-2.37-8/lib/libc.so.6+0x23b88)
    #11 0x4034b4 in _start (/tmp/nix-build-indent-2.2.13.drv-0/indent-2.2.13/src/indent+0x4034b4)

0x61200000014e is located 0 bytes to the right of 270-byte region [0x612000000040,0x61200000014e)
allocated by thread T0 here:
    #0 0x7ffff79d9de7 in __interceptor_calloc (/nix/store/xpxln7rqi3pq4m0xpnawhxb2gs0mn1s0-gcc-12.3.0-lib/lib/libasan.so.8+0xbbde7)
    #1 0x4142ec in xmalloc /build/indent-2.2.13/src/globs.c:42

SUMMARY: AddressSanitizer: heap-buffer-overflow /build/indent-2.2.13/src/code_io.c:162 in current_column
Shadow bytes around the buggy address:
  0x0c247fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8020: 00 00 00 00 00 00 00 00 00[06]fa fa fa fa fa fa
  0x0c247fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3318385==ABORTING


This is on linux, built with gcc 12.3.0. But a similar over-read happens on macos (10.15 built with clang 11).

Robert Scott <ris>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ris (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code