GCC ASAN breaks glob()?

GCC ASAN breaks glob()?

[Paul Smith]

OK here's something super-strange I discovered:

Enabling -faddress=sanitize in GCC, causes the glob(3) function to
misbehave.

I'm using GCC 11.3 / glibc 2.35 (x86_64 native).  I have this simple
program:

$ cat /tmp/tstglob.c
#include <stdio.h>
#include <glob.h>

int main(int argc, char *argv[])
{
    glob_t gl = {0};
    int res = glob(argv[1], 0, NULL, &gl);

    switch (res)
    {
        case 0: printf("success\n"); break;
        case GLOB_NOMATCH: printf("no match\n"); break;
        default: printf("unknown: %d\n", res); break;
    }

    return 0;
}

Now I create a symlink that doesn't point to anything:

  $ ln -s nosuchfile /tmp/badlink
  $ ls -al /tmp/badlink
  lrwxrwxrwx 1 pds pds 10 Mar 26 14:52 /tmp/badlink -> nosuchfile

Now I compile the above program normally and run it:

  $ gcc -o /tmp/tstglob /tmp/tstglob.c
  $ /tmp/tstglob /tmp/badlink
  success

This is what I expect: the symlink does exist even though it doesn't
point to anything so glob() should return it.

But now if I compile with ASAN:

  $ gcc -fsanitize=address -o /tmp/tstglob /tmp/tstglob.c
  $ /tmp/tstglob /tmp/badlink
  no match

...?!?!?!

Is there something in the ASAN library that takes over glob(3) and
installs a different version (there have been plenty of versions of
glob(3) over the years in glibc which behave incorrectly when faced
with broken symlinks, heavens knows...) that overrides the glibc
version?

Or...??

Re: GCC ASAN breaks glob()?

[Andrew Pinski]

On Sun, Mar 26, 2023 at 12:01 PM Paul Smith <paul@mad-scientist.net> wrote:
>
> OK here's something super-strange I discovered:
>
> Enabling -faddress=sanitize in GCC, causes the glob(3) function to
> misbehave.
>
> I'm using GCC 11.3 / glibc 2.35 (x86_64 native).  I have this simple
> program:

Maybe https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88054 .

Thanks,
Andrew

>
> $ cat /tmp/tstglob.c
> #include <stdio.h>
> #include <glob.h>
>
> int main(int argc, char *argv[])
> {
>     glob_t gl = {0};
>     int res = glob(argv[1], 0, NULL, &gl);
>
>     switch (res)
>     {
>         case 0: printf("success\n"); break;
>         case GLOB_NOMATCH: printf("no match\n"); break;
>         default: printf("unknown: %d\n", res); break;
>     }
>
>     return 0;
> }
>
> Now I create a symlink that doesn't point to anything:
>
>   $ ln -s nosuchfile /tmp/badlink
>   $ ls -al /tmp/badlink
>   lrwxrwxrwx 1 pds pds 10 Mar 26 14:52 /tmp/badlink -> nosuchfile
>
> Now I compile the above program normally and run it:
>
>   $ gcc -o /tmp/tstglob /tmp/tstglob.c
>   $ /tmp/tstglob /tmp/badlink
>   success
>
> This is what I expect: the symlink does exist even though it doesn't
> point to anything so glob() should return it.
>
> But now if I compile with ASAN:
>
>   $ gcc -fsanitize=address -o /tmp/tstglob /tmp/tstglob.c
>   $ /tmp/tstglob /tmp/badlink
>   no match
>
> ...?!?!?!
>
> Is there something in the ASAN library that takes over glob(3) and
> installs a different version (there have been plenty of versions of
> glob(3) over the years in glibc which behave incorrectly when faced
> with broken symlinks, heavens knows...) that overrides the glibc
> version?
>
> Or...??