Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-32205

heap-buffer-overflow in sigar_port.c in find_interesting_procs

    XMLWordPrintable

Details

    • Triaged
    • Unknown

    Description

      As identified by AddressSanitizer when running `make simple-test` with Asan enabled:

      =================================================================
      ==18888==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000002314 at pc 0x00000040312d bp 0x7ffd332ff300 sp 0x7ffd332ff2f8
      READ of size 4 at 0x625000002314 thread T0
          #0 0x40312c in find_interesting_procs /home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/sigar/programs/sigar_port.c:187
          #1 0x40312c in main /home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/sigar/programs/sigar_port.c:310
          #2 0x7f7685e2e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
          #3 0x4033c8 in _start (/home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/install/bin/sigar_port+0x4033c8)
       
      0x625000002314 is located 4 bytes to the right of 8720-byte region [0x625000000100,0x625000002310)
      allocated by thread T0 here:
          #0 0x7f7687452290 in __interceptor_malloc (/home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/install/bin/../lib/libasan.so.4+0xd9290)
          #1 0x40221f in find_interesting_procs /home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/sigar/programs/sigar_port.c:126
          #2 0x40221f in main /home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/sigar/programs/sigar_port.c:310
          #3 0x7f7685e2e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
       
      SUMMARY: AddressSanitizer: heap-buffer-overflow /home/couchbase/jenkins/workspace/kv-engine-master-post-commit-DJR/sub_workspace/sigar/programs/sigar_port.c:187 in find_interesting_procs
      Shadow bytes around the buggy address:
        0x0c4a7fff8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c4a7fff8420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c4a7fff8430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c4a7fff8440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c4a7fff8450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c4a7fff8460: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c4a7fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c4a7fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c4a7fff8490: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c4a7fff84a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c4a7fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==18888==ABORTING
      

      Full logs: http://cv.jenkins.couchbase.com/job/kv-engine-master-post-commit-DJR/label=ubuntu-1604&&master/143/

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            drigby Dave Rigby (Inactive)
            drigby Dave Rigby (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty