search

tkomatsu / minishell

my own shell like bash
MIT License
3 stars 0 forks source link

SEGV: エッジケース #91

Closed tkomatsu closed 3 years ago

tkomatsu commented 3 years ago 
minishell$ | cat
minishell$ | cat -e
minishell$  | cat -e
zsh: segmentation fault  ./minishell

|始まりではセグフォしないですが、|(スペース+パイプ)だとセグフォします。 catだけでなく、他のコマンドでも同様にセグフォします。

tkomatsu commented 3 years ago 
(lldb) target create "minishell"
Current executable set to '/Users/tkomatsu/Documents/42/minishell/minishell' (x86_64).
(lldb) r
Process 31389 launched: '/Users/tkomatsu/Documents/42/minishell/minishell' (x86_64)

WELCOME TO MINISHELL

minishell$  | ls
=================================================================
==31389==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000001ab8 at pc 0x00010000402c bp 0x7ffeefbff210 sp 0x7ffeefbff208
READ of size 4 at 0x603000001ab8 thread T0
    #0 0x10000402b in syntax_check syntax_check.c:22
    #1 0x10000284b in tokenize tokenize.c:122
    #2 0x100001978 in minish_loop minishell.c:86
    #3 0x100001ba7 in main minishell.c:100
    #4 0x7fff69fedcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

0x603000001ab8 is located 8 bytes inside of 32-byte region [0x603000001ab0,0x603000001ad0)
freed by thread T0 here:
    #0 0x1001762c6 in wrap_free+0xa6 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x492c6)
    #1 0x100010674 in ft_free+0x14 (minishell:x86_64+0x100010674)
    #2 0x10000cebe in del_token clear_tokens.c:20
    #3 0x10000f7f7 in dlstextract token_utils.c:69
    #4 0x100003236 in remove_empty tokenize.c:73
    #5 0x100002816 in tokenize tokenize.c:121
    #6 0x100001978 in minish_loop minishell.c:86
    #7 0x100001ba7 in main minishell.c:100
    #8 0x7fff69fedcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

previously allocated by thread T0 here:
    #0 0x10017617d in wrap_malloc+0x9d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4917d)
    #1 0x100010616 in ft_calloc+0x46 (minishell:x86_64+0x100010616)
    #2 0x10000f2bd in dlistnew token_utils.c:19
    #3 0x100002713 in tokenize tokenize.c:115
    #4 0x100001978 in minish_loop minishell.c:86
    #5 0x100001ba7 in main minishell.c:100
    #6 0x7fff69fedcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

SUMMARY: AddressSanitizer: heap-use-after-free syntax_check.c:22 in syntax_check
Shadow bytes around the buggy address:
  0x1c0600000300: fa fa 00 00 07 fa fa fa 00 00 06 fa fa fa 00 00
  0x1c0600000310: 00 03 fa fa 00 00 00 04 fa fa 00 00 01 fa fa fa
  0x1c0600000320: 00 00 03 fa fa fa 00 00 03 fa fa fa 00 00 00 03
  0x1c0600000330: fa fa 00 00 00 02 fa fa 00 00 00 01 fa fa 00 00
  0x1c0600000340: 00 00 fa fa 00 00 04 fa fa fa 00 00 04 fa fa fa
=>0x1c0600000350: 00 00 03 fa fa fa fd[fd]fd fd fa fa 00 00 00 00
  0x1c0600000360: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fa fa
  0x1c0600000370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0600000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0600000390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c06000003a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
2021-02-24 16:07:10.171676+0900 minishell[31389:202379] =================================================================
2021-02-24 16:07:10.172007+0900 minishell[31389:202379] ==31389==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000001ab8 at pc 0x00010000402c bp 0x7ffeefbff210 sp 0x7ffeefbff208
2021-02-24 16:07:10.172061+0900 minishell[31389:202379] READ of size 4 at 0x603000001ab8 thread T0
2021-02-24 16:07:10.172078+0900 minishell[31389:202379]     #0 0x10000402b in syntax_check syntax_check.c:22
2021-02-24 16:07:10.172083+0900 minishell[31389:202379]     #1 0x10000284b in tokenize tokenize.c:122
2021-02-24 16:07:10.172089+0900 minishell[31389:202379]     #2 0x100001978 in minish_loop minishell.c:86
2021-02-24 16:07:10.172094+0900 minishell[31389:202379]     #3 0x100001ba7 in main minishell.c:100
2021-02-24 16:07:10.172099+0900 minishell[31389:202379]     #4 0x7fff69fedcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
2021-02-24 16:07:10.172104+0900 minishell[31389:202379]
2021-02-24 16:07:10.172109+0900 minishell[31389:202379] 0x603000001ab8 is located 8 bytes inside of 32-byte region [0x603000001ab0,0x603000001ad0)
2021-02-24 16:07:10.172115+0900 minishell[31389:202379] freed by thread T0 here:
2021-02-24 16:07:10.172120+0900 minishell[31389:202379]     #0 0x1001762c6 in wrap_free+0xa6 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x492c6)
2021-02-24 16:07:10.172125+0900 minishell[31389:202379]     #1 0x100010674 in ft_free+0x14 (minishell:x86_64+0x100010674)
2021-02-24 16:07:10.172131+0900 minishell[31389:202379]     #2 0x10000cebe in del_token clear_tokens.c:20
2021-02-24 16:07:10.172136+0900 minishell[31389:202379]     #3 0x10000f7f7 in dlstextract token_utils.c:69
2021-02-24 16:07:10.172141+0900 minishell[31389:202379]     #4 0x100003236 in remove_empty tokenize.c:73
2021-02-24 16:07:10.172146+0900 minishell[31389:202379]     #5 0x100002816 in tokenize tokenize.c:121
2021-02-24 16:07:10.172151+0900 minishell[31389:202379]     #6 0x100001978 in minish_loop minishell.c:86
2021-02-24 16:07:10.172156+0900 minishell[31389:202379]     #7 0x100001ba7 in main minishell.c:100
2021-02-24 16:07:10.172161+0900 minishell[31389:202379]     #8 0x7fff69fedcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
2021-02-24 16:07:10.172166+0900 minishell[31389:202379]
2021-02-24 16:07:10.172170+0900 minishell[31389:202379] previously allocated by thread T0 here:
2021-02-24 16:07:10.172176+0900 minishell[31389:202379]     #0 0x10017617d in wrap_malloc+0x9d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4917d)
2021-02-24 16:07:10.172182+0900 minishell[31389:202379]     #1 0x100010616 in ft_calloc+0x46 (minishell:x86_64+0x100010616)
2021-02-24 16:07:10.172188+0900 minishell[31389:202379]     #2 0x10000f2bd in dlistnew token_utils.c:19
2021-02-24 16:07:10.172193+0900 minishell[31389:202379]     #3 0x100002713 in tokenize tokenize.c:115
2021-02-24 16:07:10.172199+0900 minishell[31389:202379]     #4 0x100001978 in minish_loop minishell.c:86
2021-02-24 16:07:10.172204+0900 minishell[31389:202379]     #5 0x100001ba7 in main minishell.c:100
2021-02-24 16:07:10.172209+0900 minishell[31389:202379]     #6 0x7fff69fedcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
2021-02-24 16:07:10.172214+0900 minishell[31389:202379]
2021-02-24 16:07:10.172219+0900 minishell[31389:202379] SUMMARY: AddressSanitizer: heap-use-after-free syntax_check.c:22 in syntax_check
2021-02-24 16:07:10.172224+0900 minishell[31389:202379] Shadow bytes around the buggy address:
2021-02-24 16:07:10.172231+0900 minishell[31389:202379]   0x1c0600000300: fa fa 00 00 07 fa fa fa 00 00 06 fa fa fa 00 00
2021-02-24 16:07:10.172241+0900 minishell[31389:202379]   0x1c0600000310: 00 03 fa fa 00 00 00 04 fa fa 00 00 01 fa fa fa
2021-02-24 16:07:10.172251+0900 minishell[31389:202379]   0x1c0600000320: 00 00 03 fa fa fa 00 00 03 fa fa fa 00 00 00 03
2021-02-24 16:07:10.172258+0900 minishell[31389:202379]   0x1c0600000330: fa fa 00 00 00 02 fa fa 00 00 00 01 fa fa 00 00
2021-02-24 16:07:10.172263+0900 minishell[31389:202379]   0x1c0600000340: 00 00 fa fa 00 00 04 fa fa fa 00 00 04 fa fa fa
2021-02-24 16:07:10.172274+0900 minishell[31389:202379] =>0x1c0600000350: 00 00 03 fa fa fa fd[fd]fd fd fa fa 00 00 00 00
2021-02-24 16:07:10.172281+0900 minishell[31389:202379]   0x1c0600000360: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fa fa
2021-02-24 16:07:10.172287+0900 minishell[31389:202379]   0x1c0600000370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2021-02-24 16:07:10.172292+0900 minishell[31389:202379]   0x1c0600000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2021-02-24 16:07:10.172298+0900 minishell[31389:202379]   0x1c0600000390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2021-02-24 16:07:10.172304+0900 minishell[31389:202379]   0x1c06000003a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
2021-02-24 16:07:10.172309+0900 minishell[31389:202379] Shadow byte legend (one shadow byte represents 8 application bytes):
2021-02-24 16:07:10.172314+0900 minishell[31389:202379]   Addressable:           00
2021-02-24 16:07:10.172319+0900 minishell[31389:202379]   Partially addressable: 01 02 03 04 05 06 07
2021-02-24 16:07:10.172328+0900 minishell[31389:202379]   Heap left redzone:       fa
2021-02-24 16:07:10.172333+0900 minishell[31389:202379]   Freed heap region:       fd
2021-02-24 16:07:10.172338+0900 minishell[31389:202379]   Stack left redzone:      f1
2021-02-24 16:07:10.172343+0900 minishell[31389:202379]   Stack mid redzone:       f2
2021-02-24 16:07:10.172349+0900 minishell[31389:202379]   Stack right redzone:     f3
2021-02-24 16:07:10.172356+0900 minishell[31389:202379]   Stack after return:      f5
2021-02-24 16:07:10.172366+0900 minishell[31389:202379]   Stack use after scope:   f8
2021-02-24 16:07:10.172371+0900 minishell[31389:202379]   Global redzone:          f9
2021-02-24 16:07:10.172376+0900 minishell[31389:202379]   Global init order:       f6
2021-02-24 16:07:10.172382+0900 minishell[31389:202379]   Poisoned by user:        f7
2021-02-24 16:07:10.172391+0900 minishell[31389:202379]   Container overflow:      fc
2021-02-24 16:07:10.172398+0900 minishell[31389:202379]   Array cookie:            ac
2021-02-24 16:07:10.172403+0900 minishell[31389:202379]   Intra object redzone:    bb
2021-02-24 16:07:10.172410+0900 minishell[31389:202379]   ASan internal:           fe
2021-02-24 16:07:10.172419+0900 minishell[31389:202379]   Left alloca redzone:     ca
2021-02-24 16:07:10.172430+0900 minishell[31389:202379]   Right alloca redzone:    cb
2021-02-24 16:07:10.172439+0900 minishell[31389:202379]   Shadow gap:              cc
==31389==ABORTING
(lldb) AddressSanitizer report breakpoint hit. Use 'thread info -s' to get extended information about the report.
Process 31389 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = Use of deallocated memory
    frame #0: 0x000000010017eb20 libclang_rt.asan_osx_dynamic.dylib`__asan::AsanDie()
libclang_rt.asan_osx_dynamic.dylib`__asan::AsanDie:
->  0x10017eb20 <+0>: pushq  %rbp
    0x10017eb21 <+1>: movq   %rsp, %rbp
    0x10017eb24 <+4>: pushq  %rbx
    0x10017eb25 <+5>: pushq  %rax
Target 0: (minishell) stopped.
tkomatsu commented 3 years ago

空のトークンが先頭にきてしまった時の処理が抜けているようです。