Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CHECK failed while printing a stack if a memory access hits an adjacent allocation #183

Closed
ramosian-glider opened this issue Aug 31, 2015 · 8 comments
Closed

CHECK failed while printing a stack if a memory access hits an adjacent allocation #183

ramosian-glider opened this issue Aug 31, 2015 · 8 comments
Labels
Priority-Medium ProjectAddressSanitizer Status-Fixed Type-Defect

Comments

@ramosian-glider
Copy link
Member

Originally reported on Google Code with ID 183

$ cat test.cpp 
int main() {
  int *test = new int[0];
  test[8] = 42;
}

As of r178511,
$ clang -fsanitize=address -g test.cpp && ./a.out |& asan_symbolize.py |& c++filt
=================================================================
==24955==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000f010 at
pc 0x42b54c ...
WRITE of size 4 at 0x60200000f010 thread T0
    #0 0x42b54b in main test.cpp:3
0x60200000f010 is located 0 bytes to the right of 0-byte region [0x60200000f010,0x60200000f010)
==24955==AddressSanitizer CHECK failed: /ssd/llvm/projects/compiler-rt/lib/asan/asan_allocator2.cc:217
"((id)) != (0)" (0x0, 0x0)
    #0 0x42276f in __asan::AsanCheckFailed(char const*, int, char const*, unsigned
long long, unsigned long long) _asan_rtl_
    #1 0x423f61 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned
long long, unsigned long long) ??:0
    #2 0x40f1f1 in __asan::AsanChunkView::GetAllocStack(__sanitizer::StackTrace*) ??:0
    #3 0x41f9c6 in __asan::DescribeHeapAddress(unsigned long, unsigned long) ??:0
    #4 0x420a32 in __asan_report_error ??:0
    #5 0x421c29 in __asan_report_store4 ??:0
    #6 0x42b54b in main test.cpp:3

Looks stackdepot-related?

Reported by timurrrr@google.com on 2013-05-04 12:22:57
@ramosian-glider
Copy link
Member Author 

Ah, funny.

This happens iff the access goes to a different allocation which has no id / stack
associated, e.g.:
  $ cat test.cpp 
  int main() {
    int *test = new int[5];
    test[12] = 42;  // Fails on CHECK,
    // Whilst "test[11] = 42;" doesn't fail the CHECK.
  }

Reported by timurrrr@google.com on 2013-05-04 12:27:35

@ramosian-glider
Copy link
Member Author

Reported by timurrrr@google.com on 2013-05-04 12:28:12

@ramosian-glider
Copy link
Member Author 

I'd argue that every CHECK on the error reporting path should be replaced by

  if (something_wrong) {
    print("couldn't get some info");
    return;
  }

Reported by timurrrr@google.com on 2013-10-11 07:05:38

@ramosian-glider
Copy link
Member Author 

AFAIK this CHECK will also be triggered if user sets malloc_context_size=0.

Reported by tetra2005 on 2013-10-11 07:42:37

@ramosian-glider
Copy link
Member Author

Reported by samsonov@google.com on 2013-10-11 09:05:30

@ramosian-glider
Copy link
Member Author 

This may be relevant: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58718

Reported by tetra2005 on 2013-10-14 06:06:22

@ramosian-glider
Copy link
Member Author 

I think this should be fixed by LLVM r192581

Reported by samsonov@google.com on 2013-10-14 11:17:48

  • Status changed: Fixed

@ramosian-glider
Copy link
Member Author 

Adding Project:AddressSanitizer as part of GitHub migration.

Reported by ramosian.glider on 2015-07-30 09:13:41

  • Labels added: ProjectAddressSanitizer

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Priority-Medium ProjectAddressSanitizer Status-Fixed Type-Defect
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ramosian-glider