Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASAN stack buffer overflow in test suite #261

Open
lorenz opened this issue Aug 20, 2023 · 0 comments
Open

ASAN stack buffer overflow in test suite #261

lorenz opened this issue Aug 20, 2023 · 0 comments

Comments

@lorenz
Copy link

lorenz commented Aug 20, 2023

With asan the test suite crashes with the following ASAN error. It looks like the 22 seq entries overflow.

Version: 0.23.92

/build/source/test/test_decode -q -n 100000
=================================================================
==8400==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffff8e58 at pc 0x7ffff7f6548b bp 0x7fffffff8c70 sp 0x7fffffff8c68
WRITE of size 4 at 0x7fffffff8e58 thread T0
    #0 0x7ffff7f6548a in lookup_sequence decoder/databar.c:698
    #1 0x7ffff7f677bd in match_segment_exp decoder/databar.c:758
    #2 0x7ffff7f687fa in decode_char decoder/databar.c:1081
    #3 0x7ffff7f68d42 in decode_finder decoder/databar.c:1217
    #4 0x7ffff7f69089 in _zbar_decode_databar decoder/databar.c:1237
    #5 0x7ffff7f5ff31 in zbar_decode_width /build/source/zbar/decoder.c:274
    #6 0x404367 in encode_junk test/test_decode.c:172
    #7 0x407799 in test_numeric test/test_decode.c:1176
    #8 0x407cfe in test1 test/test_decode.c:1290
    #9 0x4080c6 in main test/test_decode.c:1346
    #10 0x7ffff7449acd in __libc_start_call_main (/nix/store/ibp4camsx1mlllwzh32yyqcq2r2xsy1a-glibc-2.37-8/lib/libc.so.6+0x23acd)
    #11 0x7ffff7449b88 in __libc_start_main_alias_2 (/nix/store/ibp4camsx1mlllwzh32yyqcq2r2xsy1a-glibc-2.37-8/lib/libc.so.6+0x23b88)
    #12 0x402334 in _start (/build/source/test/.libs/lt-test_decode+0x402334)

Address 0x7fffffff8e58 is located in stack of thread T0 at offset 376 in frame
    #0 0x7ffff7f670a8 in match_segment_exp decoder/databar.c:709

  This frame has 4 object(s):
    [32, 120) 'bestsegs' (line 711)
    [160, 248) 'segs' (line 711)
    [288, 376) 'seq' (line 711) <== Memory access at offset 376 overflows this variable
    [416, 544) 'iseg' (line 713)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow decoder/databar.c:698 in lookup_sequence
Shadow bytes around the buggy address:
  0x10007fff7170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7190: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10007fff71a0: 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2
  0x10007fff71b0: 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2
=>0x10007fff71c0: 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2 f2
  0x10007fff71d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff71e0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff71f0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3
  0x10007fff7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8400==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant