jguhlin / minimap2-rs

Rust bindings to minimap2 library
Other
51 stars 11 forks source link

Test crashes with strlen out of bounds #50

Open riking opened 4 months ago

riking commented 4 months ago

https://asan.saethlin.dev/ub?crate=minimap2&version=0.1.14%2Bminimap2.2.26

==15122==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55f1867e33ba at pc 0x55f184e15219 bp 0x7feb520f2f60 sp 0x7feb520f2728
READ of size 283 at 0x55f1867e33ba thread T31
    #0 0x55f184e15218 in strlen /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:390:5
    #1 0x55f18614e561 in mm_gen_cs_or_MD /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/minimap2-sys-0.1.16+minimap2.2.26/minimap2/format.c:257:12
    #2 0x55f18614e5f8 in mm_gen_cs /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/minimap2-sys-0.1.16+minimap2.2.26/minimap2/format.c:267:9
    #3 0x55f184edf3a6 in minimap2::Aligner::map::_$u7b$$u7b$closure$u7d$$u7d$::h3879092ea6376982 /build/src/lib.rs:855:47
    #4 0x55f184fc20ae in std::thread::local::LocalKey$LT$T$GT$::try_with::h7ea5e2dc25eae48b /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:270:16
    #5 0x55f184fc1898 in std::thread::local::LocalKey$LT$T$GT$::with::h459cc2834367141f /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:246:9
    #6 0x55f184edaff8 in minimap2::Aligner::map::h940d1c1cad537840 /build/src/lib.rs:730:24
    #7 0x55f184f0ae02 in minimap2::tests::test_with_seq::h31259bedac3a1160 /build/src/lib.rs:1447:26
    #8 0x55f184f07302 in minimap2::tests::test_with_seq::_$u7b$$u7b$closure$u7d$$u7d$::h55458511ac88f5d2 /build/src/lib.rs:1390:23
0x55f1867e33ba is located 0 bytes after global variable 'alloc_7a0bf1e77a764740263fa9b06d2613ae' defined in 'minimap2.c8f59fa16f813271-cgu.03' (0x55f1867e32a0) of size 282
SUMMARY: AddressSanitizer: global-buffer-overflow /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:390:5 in strlen
Shadow bytes around the buggy address:
  0x55f1867e3100: 00 00 00 00 00 00 00 00 00 00 00 01 f9 f9 f9 f9
  0x55f1867e3180: 00 f9 f9 f9 00 00 00 01 f9 f9 f9 f9 00 00 00 00
  0x55f1867e3200: 01 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 00 00 00 05
  0x55f1867e3280: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x55f1867e3300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x55f1867e3380: 00 00 00 00 00 00 00[02]f9 f9 f9 f9 f9 f9 f9 f9
  0x55f1867e3400: 04 f9 f9 f9 00 f9 f9 f9 00 00 00 05 f9 f9 f9 f9
  0x55f1867e3480: 00 00 03 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9
  0x55f1867e3500: 00 05 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 07 f9 f9
  0x55f1867e3580: 00 04 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 01 f9 f9
  0x55f1867e3600: 00 06 f9 f9 00 00 00 01 f9 f9 f9 f9 00 00 00 07
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Thread T31 created by T0 here:
    #0 0x55f184e7139d in pthread_create /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:237:3
...
    #5 0x55f185049e23 in test::run_tests::he583ee2920920d88 /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/test/src/lib.rs:387:31
    #6 0x55f18520ec7e in test::console::run_tests_console::ha1474cb5b5e5b63c /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/test/src/console.rs:329:5
    #7 0x55f1850442df in test::test_main::he18bcb9d69a13aae /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/test/src/lib.rs:143:15
    #8 0x55f18504626c in test::test_main_static::h1f6363b0368f7808 /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/test/src/lib.rs:162:5
    #9 0x55f184ee86e2 in minimap2::main::he4d6d65aca247990 /build/src/lib.rs:1:1
jguhlin commented 4 months ago

How are you getting miri to run without complaining about FFI?

Also, hard to read these logs but looks like the error is in the C implementation, which I can't fix. :/ but going to dig in and see what I can do

riking commented 4 months ago

I believe it's -Zdisable-isolation or something like that?

You're probably passing a non null terminated string.