Skip to content

Fix heap overflow detected by a clang sanitizer - #6435

Merged
jonpryor merged 1 commit into
dotnet:mainfrom
grendello:sanitizer-heap-overflow-fix
Oct 29, 2021
Merged

Fix heap overflow detected by a clang sanitizer#6435
jonpryor merged 1 commit into
dotnet:mainfrom
grendello:sanitizer-heap-overflow-fix

Conversation

@grendello

Copy link
Copy Markdown
Contributor

Context: #6420 (comment)

Clang's AddressSanitizer detected the following:

10-26 15:55:25.393 2488 2488 I Mono.Android_Tests: ==2488==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x8a600774 at pc 0xaeee9982 bp 0xbf98dc68 sp 0xbf98dc60
10-26 15:55:25.394 2488 2488 I Mono.Android_Tests: WRITE of size 4 at 0x8a600774 thread T0
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #0 0xaeee9981 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38981)
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #1 0xaeef92d9 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x482d9)
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #2 0xaef009ae (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x4f9ae)
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #3 0xaef06d14 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x55d14)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: 0x8a600774 is located 0 bytes to the right of 4-byte region [0x8a600770,0x8a600774)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: allocated by thread T0 here:
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #0 0xaedbe925 (/data/app/Mono.Android_Tests-1/lib/x86/libclang_rt.asan-i686-android.so+0xb6925)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #1 0xaeee9ae1 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38ae1)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #2 0xaeee9751 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38751)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #3 0xaeef92d9 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x482d9)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #4 0xaef009ae (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x4f9ae)
10-26 15:55:25.400 2488 2488 I Mono.Android_Tests: #5 0xaef06d14 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x55d14)
10-26 15:55:25.400 2488 2488 I Mono.Android_Tests: #6 0xb30cb970 (/data/dalvik-cache/x86/data@app@Mono.Android_Tests-1@base.apk@classes.dex+0x5c970)
10-26 15:55:25.400 2488 2488 I Mono.Android_Tests: SUMMARY: AddressSanitizer: heap-buffer-overflow (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38981)

Address of the offending region points to
BasicUtilities::monodroid_strsplit and is likely the line modified in
this commit. Append terminating nullptr to vector instead of
overwriting the last element.

Context: dotnet#6420 (comment)
Clang's AddressSanitizer detected the following:
10-26 15:55:25.393 2488 2488 I Mono.Android_Tests: ==2488==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x8a600774 at pc 0xaeee9982 bp 0xbf98dc68 sp 0xbf98dc60
10-26 15:55:25.394 2488 2488 I Mono.Android_Tests: WRITE of size 4 at 0x8a600774 thread T0
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #0 0xaeee9981 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38981)
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #1 0xaeef92d9 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x482d9)
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #2 0xaef009ae (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x4f9ae)
10-26 15:55:25.398 2488 2488 I Mono.Android_Tests: #3 0xaef06d14 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x55d14)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: 0x8a600774 is located 0 bytes to the right of 4-byte region [0x8a600770,0x8a600774)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: allocated by thread T0 here:
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #0 0xaedbe925 (/data/app/Mono.Android_Tests-1/lib/x86/libclang_rt.asan-i686-android.so+0xb6925)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #1 0xaeee9ae1 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38ae1)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #2 0xaeee9751 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38751)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: #3 0xaeef92d9 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x482d9)
10-26 15:55:25.399 2488 2488 I Mono.Android_Tests: dotnet#4 0xaef009ae (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x4f9ae)
10-26 15:55:25.400 2488 2488 I Mono.Android_Tests: dotnet#5 0xaef06d14 (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x55d14)
10-26 15:55:25.400 2488 2488 I Mono.Android_Tests: dotnet#6 0xb30cb970 (/data/dalvik-cache/x86/data@app@Mono.Android_Tests-1@base.apk@classes.dex+0x5c970)
10-26 15:55:25.400 2488 2488 I Mono.Android_Tests: SUMMARY: AddressSanitizer: heap-buffer-overflow (/data/app/Mono.Android_Tests-1/lib/x86/libmonodroid.so+0x38981)
Address of the offending region points to
`BasicUtilities::monodroid_strsplit` and is likely the line modified in
this commit. Append terminating `nullptr` to vector instead of
overwriting the last element.
@jonpryor
jonpryor merged commit db7fe5e into dotnet:mainOct 29, 2021
@grendello
grendello deleted the sanitizer-heap-overflow-fix branch November 8, 2021 16:25
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Jan 24, 2024
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@grendello@jonpryor