rust-jni icon indicating copy to clipboard operation
rust-jni copied to clipboard

stack-use-after-scope in class_tests::clone

Open riking opened this issue 1 year ago • 0 comments

https://asan.saethlin.dev/ub?crate=rust-jni&version=0.1.0

test jni::class::class_tests::clone ... =================================================================
==7323==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f2e0e2f6130 at pc 0x55b433012831 bp 0x7f2e4e6f2ec0 sp 0x7f2e4e6f2eb8
READ of size 8 at 0x7f2e0e2f6130 thread T30
    #0 0x55b433012830 in rust_jni::jni::Object::clone::_$u7b$$u7b$closure$u7d$$u7d$::hafc4f8c7adf2f53a /build/src/jni/call_jni_method.rs:24:17
    #1 0x55b432fb300c in rust_jni::jni::with_checked_exception::h907ed1f3eda544f7 /build/src/jni/mod.rs:1606:11
    #2 0x55b432fb46b2 in rust_jni::jni::Object::clone::h3957f324b59d42fb /build/src/jni/mod.rs:1869:22
    #3 0x55b432fba548 in rust_jni::jni::class::Class::clone::h145e30efbc8d2c77 /build/src/jni/generate_class.rs:252:17
    #4 0x55b432da8643 in rust_jni::jni::class::class_tests::clone::h6191a089d90a6277 /build/src/jni/generate_class.rs:389:25
    #5 0x55b432da0ea2 in rust_jni::jni::class::class_tests::clone::_$u7b$$u7b$closure$u7d$$u7d$::h86ad5419169fc36f /build/src/jni/generate_class.rs:379:19
Address 0x7f2e0e2f6130 is located in stack of thread T30 at offset 304 in frame
    #0 0x55b432da0ecf in rust_jni::jni::class::class_tests::clone::h6191a089d90a6277 /build/src/jni/generate_class.rs:379

  This frame has 9 object(s):
    [32, 48) '' (line 379)
    [64, 88) '_66' (line 389)
    [128, 144) 'clone' (line 389)
    [160, 176) 'object' (line 388)
    [192, 240) 'env' (line 387)
    [272, 288) 'vm' (line 386)
    [304, 312) '_56' (line 382) <== Memory access at offset 304 is inside this variable
    [336, 2200) '_50' (line 382)
    [2336, 4200) 'raw_env' (line 382)
SUMMARY: AddressSanitizer: stack-use-after-scope /build/src/jni/call_jni_method.rs:24:17 in rust_jni::jni::Object::clone::_$u7b$$u7b$closure$u7d$$u7d$::hafc4f8c7adf2f53a
Shadow bytes around the buggy address:
  0x7f2e0e2f5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f2e0e2f5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f2e0e2f5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f2e0e2f6000: f1 f1 f1 f1 f8 f8 f2 f2 00 00 00 f2 f2 f2 f2 f2
  0x7f2e0e2f6080: 00 00 f2 f2 00 00 f2 f2 00 00 00 00 00 00 f2 f2
=>0x7f2e0e2f6100: f2 f2 00 00 f2 f2[f8]f2 f2 f2 f8 f8 f8 f8 f8 f8
  0x7f2e0e2f6180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x7f2e0e2f6200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x7f2e0e2f6280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x7f2e0e2f6300: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x7f2e0e2f6380: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==7323==ABORTING

riking avatar Feb 28 '24 00:02 riking