search

google / sawbuck

Automatically exported from code.google.com/p/sawbuck
107 stars 40 forks source link

SyzyASAN should detect stack overlaps #76

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago 
Consider: https://cluster-fuzz.appspot.com/testcase?key=6303996297871360
What's happening there is that 
content::GpuVideoDecodeAcceleratorHost::OnChannelError is on the "free stack" 
because it called something else that deleted its |this|, and then kept right 
on going using |this|.  IWBN if SyzyASAN called out this condition, where the 
crash stack has a prefix that is identical to the prefix of the free stack.
Obvs. it might be tricky to isolate things like MessageLoop and pthread 
functions that are always on both stacks.  It might be useful to exclude frames 
that are also on the allocation stack from this analysis.

Original issue reported on code.google.com by fischman@chromium.org on 21 Aug 2013 at 9:42

GoogleCodeExporter commented 8 years ago

Original comment by sebmarch...@google.com on 21 Aug 2013 at 9:45