fts-rs icon indicating copy to clipboard operation
fts-rs copied to clipboard

heap-buffer-overflow in to_fts_entry

Open riking opened this issue 1 year ago • 0 comments

https://asan.saethlin.dev/ub?crate=fts&version=0.3.0

test fts::test::logical ... =================================================================
==8465==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5120000701e0 at pc 0x563166a2e51a bp 0x7f4670af43e0 sp 0x7f4670af3ba0
READ of size 144 at 0x5120000701e0 thread T3
    #0 0x563166a2e519 in __asan_memcpy /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3
    #1 0x563167279b31 in _$LT$libc..unix..linux_like..linux..gnu..b64..x86_64..stat64$u20$as$u20$core..clone..Clone$GT$::clone::h6539a29de0678ba0 /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/libc-0.2.148/src/macros.rs:83:37
    #2 0x563166a68a4b in _$LT$std..sys..unix..fs..FileAttr$u20$as$u20$core..clone..Clone$GT$::clone::hd9d4693078208361 /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys/unix/fs.rs:134:9
    #3 0x563166a7fa0e in _$LT$std..fs..Metadata$u20$as$u20$core..clone..Clone$GT$::clone::h61cc69825d249a1d /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/fs.rs:112:21
    #4 0x563166a831c3 in fts::fts::Fts::to_fts_entry::hdb2914648383e348 /build/src/fts.rs:191:22
    #5 0x563166a82806 in fts::fts::Fts::read::h3dcc6a7c20bf1ad4 /build/src/fts.rs:154:9
    #6 0x563166a6ec7c in fts::fts::test::logical::hf838d1a977efde1e /build/src/fts.rs:441:26
    #7 0x563166a6e572 in fts::fts::test::logical::_$u7b$$u7b$closure$u7d$$u7d$::h72a41ceb4cbab91d /build/src/fts.rs:435:17
0x5120000701e0 is located 0 bytes after 288-byte region [0x5120000700c0,0x5120000701e0)
allocated by thread T3 here:
    #0 0x563166a303ee in malloc /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x7f46731fa08b in fts_open (/lib/x86_64-linux-gnu/libc.so.6+0x11808b) (BuildId: 229b7dc509053fe4df5e29e8629911f0c3bc66dd)
SUMMARY: AddressSanitizer: heap-buffer-overflow /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 in __asan_memcpy
Shadow bytes around the buggy address:
  0x51200006ff00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x51200006ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x512000070000: 00 00 00 00 00 00 00 00 00 00 07 fa fa fa fa fa
  0x512000070080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x512000070100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x512000070180: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa
  0x512000070200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x512000070280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x512000070300: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x512000070380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x512000070400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8465==ABORTING

riking avatar Feb 27 '24 23:02 riking