public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "hjl.tools at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/102911] New: AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46
Date: Sat, 23 Oct 2021 23:37:12 +0000 [thread overview]
Message-ID: <bug-102911-4@http.gcc.gnu.org/bugzilla/> (raw)
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911
Bug ID: 102911
Summary: AddressSanitizer: CHECK failed:
asan_malloc_linux.cpp:46
Product: gcc
Version: 12.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: sanitizer
Assignee: unassigned at gcc dot gnu.org
Reporter: hjl.tools at gmail dot com
CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
Target Milestone: ---
On Fedora 35/x86-64 with glibc 2.34, I got
[hjl@gnu-skx-1 gcc]$
/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/gcc/xgcc
-B/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/gcc/
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c
-m32
-B/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/
-B/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/
-L/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs
-fsanitize=address -g
-I/export/gnu/import/git/sources/gcc/gcc/testsuite/../../libsanitizer/include
-fdiagnostics-plain-output -O0 -lm -o
./alloca_detect_custom_size.exe.bad
[hjl@gnu-skx-1 gcc]$ export
LD_LIBRARY_PATH=/export/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs
[hjl@gnu-skx-1 gcc]$ ./alloca_detect_custom_size.exe.bad
=================================================================
==3485262==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address
0xffe51f80 at pc 0x08049279 bp 0xffe51e98 sp 0xffe51e8c
WRITE of size 1 at 0xffe51f80 thread T0
#0 0x8049278 in foo
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c:16
#1 0x80492dc in main
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c:20
#2 0xf7653468 in __libc_start_call_main (/lib/libc.so.6+0x25468)
#3 0xf765355f in __libc_start_main@@GLIBC_2.34 (/lib/libc.so.6+0x2555f)
#4 0x80490eb in _start
(/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/gcc/testsuite/gcc/alloca_detect_custom_size.exe.bad+0x80490eb)
Address 0xffe51f80 is located in stack of thread T0
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c:16
in foo
Shadow bytes around the buggy address:
0x3ffca3a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca3b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca3c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca3d0: 00 00 00 00 00 00 00 00 ca ca ca ca 00 00 00 00
0x3ffca3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x3ffca3f0:[cb]cb cb cb 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x3ffca440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3485262==ABORTING
[hjl@gnu-skx-1 gcc]$ export
LD_LIBRARY_PATH=/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs
[hjl@gnu-skx-1 gcc]$ ./alloca_detect_custom_size.exe.bad
AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46
"((allocated_for_dlsym)) < ((kDlsymAllocPoolSize))" (0x421, 0x400)
(tid=3485264)
<empty stack>
[hjl@gnu-skx-1 gcc]$ ls -l /export/build
lrwxrwxrwx 1 hjl hjl 15 Dec 4 2018 /export/build -> users/hjl/build
[hjl@gnu-skx-1 gcc]$
It is related to
https://bugs.llvm.org/show_bug.cgi?id=33206
next reply other threads:[~2021-10-23 23:37 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-23 23:37 hjl.tools at gmail dot com [this message]
2021-10-24 0:35 ` [Bug sanitizer/102911] " hjl.tools at gmail dot com
2021-10-24 11:52 ` hjl.tools at gmail dot com
2021-11-13 13:18 ` cvs-commit at gcc dot gnu.org
2021-11-13 13:23 ` hjl.tools at gmail dot com
2021-11-14 22:36 ` pinskia at gcc dot gnu.org
2022-01-12 2:34 ` cvs-commit at gcc dot gnu.org
2022-01-19 19:49 ` cvs-commit at gcc dot gnu.org
2022-01-19 21:21 ` cvs-commit at gcc dot gnu.org
2022-01-19 21:23 ` hjl.tools at gmail dot com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-102911-4@http.gcc.gnu.org/bugzilla/ \
--to=gcc-bugzilla@gcc.gnu.org \
--cc=gcc-bugs@gcc.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).