Parchive / par2cmdline

Official repo for par2cmdline and libpar2
http://parchive.sourceforge.net
GNU General Public License v2.0
723 stars 75 forks source link

global-buffer-overflow by default in unit test (diskfile_test) #187

Open asarubbo opened 1 year ago

asarubbo commented 1 year ago

This is a forward of https://github.com/animetosho/par2cmdline-turbo/issues/20

On 0.8.1 if compiled with AddressSanitizer the unit_tests.log hangs because of:

create input2.txt, write and read it.
=================================================================
==3470==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000536a89 at pc 0x00000043de11 bp 0x7fff93ce3f80 sp 0x7fff93ce3750
READ of size 16 at 0x000000536a89 thread T0
    #0 0x43de10 in __interceptor_fwrite /var/tmp/portage/sys-libs/compiler-rt-sanitizers-16.0.5/work/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1205:16
    #1 0x518c6b in DiskFile::Write(unsigned long, void const*, unsigned long, unsigned long) /var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/src/diskfile.cpp:597:24
    #2 0x507312 in test2() /var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/src/diskfile_test.cpp:457:18
    #3 0x50eb87 in main /var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/src/diskfile_test.cpp:738:7
    #4 0x7f1cddc58676 in __libc_start_call_main /var/tmp/portage/sys-libs/glibc-2.37-r3/work/glibc-2.37/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7f1cddc58734 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.37-r3/work/glibc-2.37/csu/../csu/libc-start.c:360:3
    #6 0x41f9d0 in _start (/var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/tests/diskfile_test+0x41f9d0)

0x000000536a89 is located 55 bytes before global variable '.str.61' defined in '/var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/src/diskfile_test.cpp:328' (0x536ac0) of size 14
  '.str.61' is ascii string 'Create failed'
0x000000536a89 is located 0 bytes after global variable '.str.60' defined in '/var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/src/diskfile_test.cpp:316' (0x536a60) of size 41
  '.str.60' is ascii string 'diskfile_test test3 input2.txt is longer'
SUMMARY: AddressSanitizer: global-buffer-overflow /var/tmp/portage/sys-libs/compiler-rt-sanitizers-16.0.5/work/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1205:16 in __interceptor_fwrite
Shadow bytes around the buggy address:
  0x000000536800: 02 f9 f9 f9 00 03 f9 f9 00 00 00 00 01 f9 f9 f9
  0x000000536880: f9 f9 f9 f9 00 03 f9 f9 00 03 f9 f9 00 03 f9 f9
  0x000000536900: 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 00 00 f9 f9
  0x000000536980: 00 00 f9 f9 00 06 f9 f9 00 00 f9 f9 00 00 f9 f9
  0x000000536a00: 00 00 00 00 00 00 05 f9 f9 f9 f9 f9 00 00 00 00
=>0x000000536a80: 00[01]f9 f9 f9 f9 f9 f9 00 06 f9 f9 00 00 02 f9
  0x000000536b00: f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 00 07 f9 f9
  0x000000536b80: 00 03 f9 f9 00 00 f9 f9 00 00 00 00 02 f9 f9 f9
  0x000000536c00: f9 f9 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9
  0x000000536c80: 00 00 00 00 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x000000536d00: 06 f9 f9 f9 f9 f9 f9 f9 00 06 f9 f9 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3470==ABORTING
./tests/unit_tests: line 6:  3470 Aborted                 $PARBINARY
ERROR: /var/tmp/portage/app-arch/par2cmdline-0.8.1-r1/work/par2cmdline-0.8.1/tests/diskfile_test failed.