public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "sirl at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug sanitizer/65769] New: [UBSAN] qt-4.6 and qt-4.7 applications using qobject_cast may crash Date: Wed, 15 Apr 2015 08:23:00 -0000 [thread overview] Message-ID: <bug-65769-4@http.gcc.gnu.org/bugzilla/> (raw) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65769 Bug ID: 65769 Summary: [UBSAN] qt-4.6 and qt-4.7 applications using qobject_cast may crash Product: gcc Version: 5.0 Status: UNCONFIRMED Severity: minor Priority: P3 Component: sanitizer Assignee: unassigned at gcc dot gnu.org Reporter: sirl at gcc dot gnu.org CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org, jakub at gcc dot gnu.org, kcc at gcc dot gnu.org This is actually a bug in the qt headers, which contains this undefined construct: template <class T> inline T qobject_cast(QObject *object) { #if !defined(QT_NO_MEMBER_TEMPLATES) && !defined(QT_NO_QOBJECT_CHECK) reinterpret_cast<T>(0)->qt_check_for_QOBJECT_macro(*reinterpret_cast<T>(object)); #endif return static_cast<T>(reinterpret_cast<T>(0)->staticMetaObject.cast(object)); } Here UBSAN lets the application crash like this: /usr/include/QtCore/qobject.h:453:5: runtime error: member access within null pointer of type 'struct QObject' Segmentation fault What happens is that UBSAN creates 2 checks here (from gimple dump of demos/undo/mainwindow.cpp): UBSAN_NULL (0B, 4B, 8); D.90545 = 0B; D.90546 = D.90545->_vptr.QObject; D.90547 = (long unsigned int) D.90546; UBSAN_VPTR (0B, D.90547, 3589049094360264299, &_ZTI8Document, 4B); Naturally D.90546 = D.90545->_vptr.QObject leads to a NULL dereference. 3 workarounds are possible: 1. compile your qt code with -DQT_NO_QOBJECT_CHECK 2. change the affected header like this (maybe best for LTS distros like SLES11 or RHEL6): template <class T> inline T qobject_cast(QObject *object) { #if !defined(QT_NO_MEMBER_TEMPLATES) && !defined(QT_NO_QOBJECT_CHECK) reinterpret_cast<T>(object)->qt_check_for_QOBJECT_macro(*reinterpret_cast<T>(object)); #endif return static_cast<T>(reinterpret_cast<T>(object)->staticMetaObject.cast(object)); } There are more occurrences in the header, but I didn't check them all. Use the fixed qt-4.8 qobject.h as a reference. 3. Change to qt >= 4.8 which fixed this header. If someone thinks it might be worth (from a QOI POV that instrumentation shouldn't influence user code like that) changing UBSAN to skip the UBSAN_VPTR check in case the UBSAN_NULL already reported the NULL, keep the bug open. Otherwise it can be closed as INVALID.
next reply other threads:[~2015-04-15 8:23 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-04-15 8:23 sirl at gcc dot gnu.org [this message] 2015-04-15 9:50 ` [Bug sanitizer/65769] " jakub at gcc dot gnu.org 2015-04-15 11:12 ` rguenth at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-65769-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).