bugmake - Bugs: bug #54980, buffer overread in jhash_string

 
 

bug #54980: buffer overread in jhash_string

Submitter:  Hanno Boeck <hanno>
Submitted:  Wed 07 Nov 2018 09:55:13 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  psmith Open/Closed:  Closed
Component Version:  None Operating System:  None
Fixed Release:  4.3 Triage Status:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 19 May 2019 11:54:25 PM UTC, comment #1: 

Added an _attribute_ disabling this check for this function: it can't easily be rewritten to avoid the lookup and should be OK.

Paul D. Smith <psmith>
Group administrator
Wed 07 Nov 2018 09:55:13 AM UTC, original submission:  

Compiling make with address sanitize (-fsanitize=address in CFLAGS) immediately leads to a crash caused by a buffer overread in jhead_string. Current git code.

ASAN error:

==28371==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55b34a423950 at pc 0x55b34a3c508c bp 0x7ffe7c390690 sp 0x7ffe7c390680
READ of size 4 at 0x55b34a423950 thread T0
    #0 0x55b34a3c508b in jhash_string src/hash.c:464
    #1 0x55b34a406bef in str_hash_1 src/strcache.c:163
    #2 0x55b34a3c2e25 in hash_find_slot src/hash.c:89
    #3 0x55b34a406c8c in add_hash src/strcache.c:193
    #4 0x55b34a40707a in strcache_add_len src/strcache.c:253
    #5 0x55b34a3f596f in construct_include_path src/read.c:2938
    #6 0x55b34a3d9bc5 in main src/main.c:1747
    #7 0x7fcd3619eae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)
    #8 0x55b34a3a3a29 in _start (/tmp/make+0x22a29)

0x55b34a423950 is located 48 bytes to the left of global variable '*.LC1' defined in 'src/read.c' (0x55b34a423980) of size 17
  '*.LC1' is ascii string '/usr/gnu/include'
0x55b34a423953 is located 0 bytes to the right of global variable '*.LC0' defined in 'src/read.c' (0x55b34a423940) of size 19
  '*.LC0' is ascii string '/usr/local/include'

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by psmith (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-05-19 psmith StatusNone Fixed
        Assigned toNone psmith
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.3

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code