If this is expected, please close this issue. Thank you!
Minimal example
This seems to be verified using the following minimal example. The issue appears to be in the cycle; in the example read is substituted for write to illustrate memory accesses.
Canary1 addr 0x2000000 val 0x0000000a
Canary2 addr 0x20001f8 val 0x00000014
smc_rsn accessess:
addr 0x2000008 val 0xffffffff OK ~> written val 0x00000002
... legitimate memory accessess ...
addr 0x20001f0 val 0xffffffff OK ~> written val 0x00000002
addr 0x20001f8 val 0x00000014 OOB ~> written val 0x00000002 CANARY
... overrun follows ...
addr 0x2000420 val 0x0000000b OOB ~> written val 0x00000002
addr 0x2000428 val 0x00000100 OOB ~>
a: ./a.c:54: main: Assertion `canary2 == 20' failed.
Hi,
I'd like to report a possible memory read overrun detected by static analysis in function
is_data_consistent
, function added in https://github.com/ibm-s390-linux/smc-tools/commit/094115776fbec0f0675e229c80f5ddf156afa53a and changed to the current form by commit https://github.com/ibm-s390-linux/smc-tools/commit/472713cba41126adcc8b54855e3b76c699c8752a: https://github.com/ibm-s390-linux/smc-tools/blob/393dd23a767ab111608a534b4b0d200e45fe04f0/stats.c#L887-L922 namely the line: https://github.com/ibm-s390-linux/smc-tools/blob/393dd23a767ab111608a534b4b0d200e45fe04f0/stats.c#L906 as overrunning array of 496 bytes at byte offset 1496 by dereferencing pointerkern_fbck
.If this is expected, please close this issue. Thank you!
Minimal example
This seems to be verified using the following minimal example. The issue appears to be in the cycle; in the example read is substituted for write to illustrate memory accesses.
Compiled with
gcc -fsanitize=address -fstack-protector-all -fno-pie -no-pie -Wall -Wextra -Werror -pedantic -std=gnu99 ./link.ld ./a.c -o ./a
Sample output (snipped):