Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AddressSanitizer found buffer-overflow during jl_restore_system_image #28995

Closed
vchuravy opened this issue Sep 1, 2018 · 4 comments
Closed

Comments

@vchuravy
Copy link
Member

vchuravy commented Sep 1, 2018

Occurs on: 804d12e
Does not occur on: 255030e
So I suspect this was introduced by #28888

  LINK /home/vchuravy/builds/julia-sanitizer/usr/lib/julia/sys-debug.so
=================================================================
==23051==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7ffff7de07e0 at pc 0x7ffff723937a bp 0x7fffffffdb90 sp 0x7fffffffdb88
WRITE of size 8 at 0x7ffff7de07e0 thread T0
    #0 0x7ffff7239379 in jl_dlsym /home/vchuravy/src/julia/src/dlload.c:214:12
    #1 0x7ffff7288fd4 in jl_load_sysimg_so /home/vchuravy/src/julia/src/staticdata.c:172:9
    #2 0x7ffff7288b38 in jl_restore_system_image /home/vchuravy/src/julia/src/staticdata.c:1582:9
    #3 0x7ffff723f741 in _julia_init /home/vchuravy/src/julia/src/init.c:760:13
    #4 0x7ffff7244758 in julia_init__threading /home/vchuravy/src/julia/src/task.c:305:5
    #5 0x516d61 in main /home/vchuravy/src/julia/ui/repl.c:227:5
    #6 0x7ffff6d2d222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
    #7 0x41e57d in _start (/home/vchuravy/builds/julia-sanitizer/usr/bin/julia-debug+0x41e57d)

0x7ffff7de07e4 is located 0 bytes to the right of global variable 'globalUnique' defined in '/home/vchuravy/src/julia/src/codegen.cpp:347:9' (0x7ffff7de07e0) of size 4
SUMMARY: AddressSanitizer: global-buffer-overflow /home/vchuravy/src/julia/src/dlload.c:214:12 in jl_dlsym
Shadow bytes around the buggy address:
  0x10007efb40a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007efb40b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007efb40c0: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x10007efb40d0: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x10007efb40e0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
=>0x10007efb40f0: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9[04]f9 f9 f9
  0x10007efb4100: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9
  0x10007efb4110: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x10007efb4120: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x10007efb4130: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x10007efb4140: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==23051==ABORTING
make: *** [/home/vchuravy/src/julia/Makefile:223: julia-base-cache] Error 1
@Keno
Copy link
Member

Keno commented Sep 1, 2018

cc @staticfloat

@staticfloat
Copy link
Member

Let’s see if this persists after the fixup PR is merged?

@Keno
Copy link
Member

Keno commented Sep 3, 2018

@vchuravy Check this again now that the follow up PR is merged?

@vchuravy
Copy link
Member Author

I think when I last checked it didn't occur anymore. Closing for now and I will reopen if I encounter it again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants