search

hlorenzi / customasm

💻 An assembler for custom, user-defined instruction sets! https://hlorenzi.github.io/customasm/web/
Apache License 2.0
719 stars 56 forks source link

Heap allocation size failed #209

Open nyw0102 opened 1 week ago

nyw0102 commented 1 week ago

Version

v0.11.14-1-gcc05721

Description

There is a heap allocation-size fail due to the unsafe "alloc" function used by 'customasm::util::bigint::BigInt::shl' function.

Current Behavior

ASAN detect heap allocation size failed due to the allocation by 'customasm::util::bigint::BigInt::shl' function exceed the maximum supported size

==1934128==ERROR: AddressSanitizer: requested allocation size 0x5659c624f518e40 (0x5659c624f519e40 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x55dfea3ce847 in malloc /home/nyw0102/s2fuzz/scripts/rust/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x55dfeadc2364 in alloc::alloc::alloc::h2068b468a191ea69 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:171:73
    #2 0x55dfeadc2364 in alloc::alloc::Global::alloc_impl::h5dbe6867d8aba98f /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:171:73
    #3 0x55dfeadf2976 in _$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Allocator$GT$::allocate::h77100fcb8636a305 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:231:9
    #4 0x55dfeade06b0 in alloc::raw_vec::RawVec$LT$T$C$A$GT$::allocate_in::h6447e80696de2d61 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/raw_vec.rs:185:45
    #5 0x55dfeadb409d in alloc::raw_vec::RawVec$LT$T$C$A$GT$::with_capacity_in::hf6d7227cf2b860ef /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:483:9
    #6 0x55dfeadb409d in alloc::vec::Vec$LT$T$C$A$GT$::with_capacity_in::he9d06f458c49d1a7 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:641:20
    #7 0x55dfeadb409d in alloc::vec::Vec$LT$T$GT$::with_capacity::hd6917faaecf238e8 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:483:9
    #8 0x55dfea86539a in _$LT$$RF$num_bigint..biguint..BigUint$u20$as$u20$core..ops..bit..Shl$LT$usize$GT$$GT$::shl::h1878d3849cd609f0 /home/nyw0102/.cargo/registry/src/github.com-1ecc6299db9ec823/num-bigint-0.1.44/src/biguint.rs:370:9
    #9 0x55dfea85ff45 in _$LT$$RF$num_bigint..bigint..BigInt$u20$as$u20$core..ops..bit..Shl$LT$usize$GT$$GT$::shl::hc8c492dc0ba8fb89 /home/nyw0102/.cargo/registry/src/github.com-1ecc6299db9ec823/num-bigint-0.1.44/src/bigint.rs:227:41
    #10 0x55dfeab5f724 in customasm::util::bigint::BigInt::shl::h9b8a42b728f6f372 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:149:9
    #11 0x55dfeab61142 in customasm::util::bigint::BigInt::checked_shl::_$u7b$$u7b$closure$u7d$$u7d$::h7dde0a7ee5998491 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:169:41
    #12 0x55dfea5f9c2e in core::option::Option$LT$T$GT$::map::hc57c5c3bec8e6496 /home/nyw0102/s2fuzz/scripts/rust/library/core/src/option.rs:929:29
    #13 0x55dfeab60cc6 in customasm::util::bigint::BigInt::checked_shl::hffcd886eb0228fe8 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:169:9
    #14 0x55dfeaa541f5 in customasm::expr::eval::_$LT$impl$u20$customasm..expr..expression..Expr$GT$::eval::hd50bedede7c4f298 /home/nyw0102/Test-Sets/customasm/src/expr/eval.rs:251:38
    #15 0x55dfeaa5181f in customasm::expr::eval::_$LT$impl$u20$customasm..expr..expression..Expr$GT$::eval::hd50bedede7c4f298 /home/nyw0102/Test-Sets/customasm/src/expr/eval.rs:206:16
    #16 0x55dfeaa991d5 in customasm::asm::state::State::eval_expr::hcf41250c70ade838 /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:1002:3
    #17 0x55dfeaa81627 in customasm::asm::state::State::resolve_data_invocation::h28e4be77f9705316 /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:614:18
    #18 0x55dfeab433f4 in customasm::asm::parser::data::parse_directive_data::hd8ba556143d26794 /home/nyw0102/Test-Sets/customasm/src/asm/parser/data.rs:32:24
    #19 0x55dfeaadf0f5 in customasm::asm::parser::file::parse_directive::h558beaaf9e13a01d /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:97:13
    #20 0x55dfeaadc55f in customasm::asm::parser::file::parse_line::h3a387eb6fb947b74 /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:55:9
    #21 0x55dfeaad727c in customasm::asm::parser::file::parse_file::hdc5553a5a1c95e28 /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:42:9
    #22 0x55dfeaa64020 in customasm::asm::state::Assembler::assemble::hbd438191f26eecbe /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:122:18
    #23 0x55dfeabc8a3c in customasm::driver::drive_inner::h299b7b51dfdf0f42 /home/nyw0102/Test-Sets/customasm/src/driver.rs:192:15
    #24 0x55dfeabbf074 in customasm::driver::drive::hd5fc72f7c2e70ee6 /home/nyw0102/Test-Sets/customasm/src/driver.rs:39:15
    #25 0x55dfea40ed19 in customasm::main::h23e4f4dfa8375648 /home/nyw0102/Test-Sets/customasm/src/main.rs:10:19
    #26 0x55dfea400f4a in core::ops::function::FnOnce::call_once::ha2625528851145be /home/nyw0102/s2fuzz/scripts/rust/library/core/src/ops/function.rs:248:5
    #27 0x55dfea3fe706 in std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h5d07d37f4c07bcb6 /home/nyw0102/s2fuzz/scripts/rust/library/std/src/rt.rs:145:18
    #28 0x55dfeae9a9f4 in std::rt::lang_start_internal::h4a61547abbd425a7 (/home/nyw0102/Test-Sets/customasm/target/x86_64-unknown-linux-gnu/debug/customasm+0xbb19f4) (BuildId: d53a25b51827aa08a6935884b3184aa2cb61527c)
    #29 0x55dfea40f2ef in main (/home/nyw0102/Test-Sets/customasm/target/x86_64-unknown-linux-gnu/debug/customasm+0x1262ef) (BuildId: d53a25b51827aa08a6935884b3184aa2cb61527c)

==1934128==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big /home/nyw0102/s2fuzz/scripts/rust/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 in malloc
==1934128==ABORTING

Expected Behavior

Memory-safety code with no allocation-size failed. This might be handled by denying allocation when the size of object exceeds the maximum allocation size.