Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

"heap-use-after-free" is printed for buffer overflow bugs. #66

Closed
ramosian-glider opened this issue Aug 31, 2015 · 3 comments
Closed

"heap-use-after-free" is printed for buffer overflow bugs. #66

ramosian-glider opened this issue Aug 31, 2015 · 3 comments
Labels
Priority-Medium ProjectAddressSanitizer Status-Fixed Type-Defect

Comments

@ramosian-glider
Copy link
Member

Originally reported on Google Code with ID 66

In some cases asan mistakenly reports "heap-use-after-free" instead of "heap-buffer-overflow".

./bin_linux/asan_test64  --gtest_filter=*BufferOverflowAfterManeFrees --gtest_also_run_disabled_tests


==11906== ERROR: AddressSanitizer heap-use-after-free 
...

0x7fa16a0b0080 is located 0 bytes to the right of 8192-byte region [0x7fa16a0ae080,0x7fa16a0b0080)
allocated by thread T0 here:

Reported by konstantin.s.serebryany on 2012-04-19 14:53:16
@ramosian-glider
Copy link
Member Author 

This fix is simple (below), but it may have non-zero performance cost. 
Will check next week. 


===================================================================
--- asan_allocator.cc   (revision 155126)
+++ asan_allocator.cc   (working copy)
@@ -498,6 +498,7 @@

     CHECK(m->chunk_state == CHUNK_QUARANTINE);
     m->chunk_state = CHUNK_AVAILABLE;
+    PoisonShadow((uintptr_t)m, m->Size(), kAsanHeapLeftRedzoneMagic);
     CHECK(m->alloc_tid >= 0);
     CHECK(m->free_tid >= 0);

Reported by konstantin.s.serebryany on 2012-04-19 15:07:18

@ramosian-glider
Copy link
Member Author 

This change slows down the stress test by 5%:
(ASAN_OPTIONS=quarantine_size=1 ./bin_linux/asan_test64 --gtest_filter=AddressSanitizer.MallocStressTest)
This translates to a tolerable extra slowdown on usual programs. 

LLVM r155344.

Reported by konstantin.s.serebryany on 2012-04-23 10:10:40

  • Status changed: Fixed

@ramosian-glider
Copy link
Member Author 

Adding Project:AddressSanitizer as part of GitHub migration.

Reported by ramosian.glider on 2015-07-30 09:12:59

  • Labels added: ProjectAddressSanitizer

@oviano oviano mentioned this issue Mar 31, 2020
Open
@UjjwalChitransh UjjwalChitransh mentioned this issue Apr 3, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Priority-Medium ProjectAddressSanitizer Status-Fixed Type-Defect
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ramosian-glider