Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AddressSanitizer: negative-size-param in addRule #1694

Open
cx104906 opened this issue Dec 16, 2024 · 0 comments
Open

AddressSanitizer: negative-size-param in addRule #1694

cx104906 opened this issue Dec 16, 2024 · 0 comments
Labels
bug Bug in the code (not in a table)
Milestone

Comments

@cx104906
Copy link

Can reproduce with clang but can not reproduce by gcc.
Unclear whether this is a bug in liblouis or a bug in Clang.
reproduce in docker:

docker pull ubuntu:20.04
docker run --name test -it --privileged=true --net=host ubuntu:20.04
apt update
apt install git clang gcc g++ autoconf automake libtool build-essential pkg-config -y
git clone https://github.com/liblouis/liblouis.git
./autogen.sh
CC=clang CXX=clang++ CFLAGS="-fsanitize=address -g -fPIC -O0" CXXFLAGS="-fsanitize=address -g -fPIC -O0" ./configure --enable-static --disable-shared
make
git clone https://github.com/cx104906/poc.git
./tools/lou_checktable poc/lou_checktable/id1

ASAN says:

root@cas-PC:/liblouis# ./tools/lou_checktable poc/lou_checktable/id1
poc/lou_checktable/id1:1: error: invalid escape sequence '\ '
poc/lou_checktable/id1:2: warning: invalid UTF-8. Assuming Latin-1.
poc/lou_checktable/id1:2: warning: invalid UTF-8. Assuming Latin-1.
poc/lou_checktable/id1:2: error: liblouis has not been compiled for 32-bit Unicode
=================================================================
==22623==ERROR: AddressSanitizer: negative-size-param: (size=-2)
    #0 0x492e47 in __asan_memcpy (/liblouis/tools/lou_checktable+0x492e47)
    #1 0x4ed6ea in addRule /liblouis/liblouis/compileTranslationTable.c:1039:3
    #2 0x4f65e8 in compileSwap /liblouis/liblouis/compileTranslationTable.c:1668:7
    #3 0x4e557f in compileRule /liblouis/liblouis/compileTranslationTable.c:4301:11
    #4 0x4d0a78 in compileFile /liblouis/liblouis/compileTranslationTable.c:4869:9
    #5 0x4cb61d in compileTable /liblouis/liblouis/compileTranslationTable.c:4991:9
    #6 0x4c98ce in getTable /liblouis/liblouis/compileTranslationTable.c:5164:7
    #7 0x4c8ca3 in _lou_getTable /liblouis/liblouis/compileTranslationTable.c:5073:2
    #8 0x4caef8 in lou_getTable /liblouis/liblouis/compileTranslationTable.c:5085:2
    #9 0x4c36a4 in main /liblouis/tools/lou_checktable.c:115:16
    #10 0x7ffff7c58082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #11 0x41b31d in _start (/liblouis/tools/lou_checktable+0x41b31d)

Address 0x7ffffffe3df2 is located in stack of thread T0 at offset 4402 in frame
    #0 0x4f5fff in compileSwap /liblouis/liblouis/compileTranslationTable.c:1648

  This frame has 6 object(s):
    [32, 4130) 'ruleChars' (line 1649)
    [4400, 8498) 'ruleDots' (line 1650) <== Memory access at offset 4402 is inside this variable
    [8768, 12866) 'name' (line 1651)
    [13136, 17234) 'matches' (line 1652)
    [17504, 21602) 'replacements' (line 1653)
    [21872, 21876) 'ruleOffset' (line 1654)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: negative-size-param (/liblouis/tools/lou_checktable+0x492e47) in __asan_memcpy
==22623==ABORTING
@egli egli added the bug Bug in the code (not in a table) label Dec 16, 2024
@egli egli added this to the 3.33 milestone Dec 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Bug in the code (not in a table)
Projects
None yet
Development

No branches or pull requests

2 participants