public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/98669] New: SIGSEGV on pc=0 in crypt() with -fsanitize=address
@ 2021-01-14  7:40 marko.makela at mariadb dot com
  2021-01-14  8:15 ` [Bug sanitizer/98669] " marxin at gcc dot gnu.org
                   ` (13 more replies)
  0 siblings, 14 replies; 15+ messages in thread
From: marko.makela at mariadb dot com @ 2021-01-14  7:40 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98669

            Bug ID: 98669
           Summary: SIGSEGV on pc=0 in crypt() with -fsanitize=address
           Product: gcc
           Version: 10.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marko.makela at mariadb dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

The following test program would crash when compiled with AddressSanitizer
instrumentation in GCC 10.2.1 for AMD64 on Debian GNU/Linux Sid (unstable):

cat > crypt.c << EOF
#include <crypt.h>
#include <stdio.h>

int main (int argc, char **argv)
{
  puts(crypt(*argv, "salt"));
}
EOF
gcc -fsanitize=address crypt.c -lcrypt
./a.out


AddressSanitizer:DEADLYSIGNAL
=================================================================
==664877==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x000000000000 bp 0x7fffb2b2b970 sp 0x7fffb2b2b958 T0)
==664877==Hint: pc points to the zero page.
==664877==The signal is caused by a READ memory access.
==664877==Hint: address points to the zero page.
    #0 0x0  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>) 
==664877==ABORTING


If I compile the same without -fsanitize=address, or with clang-10 or clang-11,
the program will complete normally, outputting a line of text.

I traced the crash to the second (!) invocation of the function
__interceptor_crypt():

gdb a.out
break __interceptor_crypt
continue
display/i $pc
continue
nexti
nexti
...

The trace would end with the following:

1: x/i $pc
=> 0x7ffff762ba4d <__interceptor_crypt(char*, char*)+125>:      
    jmp    *0xdf55d(%rip)        # 0x7ffff770afb0
<_ZN14__interception10real_cryptE>
(gdb) 
0x0000000000000000 in ?? ()

^ permalink raw reply	[flat|nested] 15+ messages in thread
end of thread, other threads:[~2022-09-06  7:05 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-14  7:40 [Bug sanitizer/98669] New: SIGSEGV on pc=0 in crypt() with -fsanitize=address marko.makela at mariadb dot com
2021-01-14  8:15 ` [Bug sanitizer/98669] " marxin at gcc dot gnu.org
2021-01-14  9:32 ` marko.makela at mariadb dot com
2021-01-14 10:25 ` doko at debian dot org
2021-01-14 10:36 ` doko at debian dot org
2021-01-14 10:43 ` marxin at gcc dot gnu.org
2021-01-14 10:51 ` marxin at gcc dot gnu.org
2021-01-14 10:52 ` doko at debian dot org
2021-01-14 10:56 ` marxin at gcc dot gnu.org
2021-01-14 11:39 ` doko at debian dot org
2021-01-14 11:45 ` jakub at gcc dot gnu.org
2021-01-14 13:11 ` doko at debian dot org
2021-01-14 13:35 ` marxin at gcc dot gnu.org
2021-01-14 16:25 ` marko.makela at mariadb dot com
2022-09-06  7:05 ` asn at samba dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).