Attachment 142341 Details for Bug 108636 – stack trace from asan

stack trace from asan

asan-uaf-mesa.txt (text/plain), 3.33 KB, created by Hanno Böck on 2018-11-02 14:32:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Hanno Böck

Created: 2018-11-02 14:32:30 UTC

Size: 3.33 KB

patch

obsolete

>=================================================================
>==6426==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000000311 at pc 0x55ee03c531f7 bp 0x7ffee8e53c60 sp 0x7ffee8e53c50
>READ of size 1 at 0x61a000000311 thread T0
>    #0 0x55ee03c531f6 in test_optpass(int, char**) glsl/test_optpass.cpp:270
>    #1 0x55ee03c50fe9 in main glsl/test.cpp:71
>    #2 0x7fbc5df4dae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)
>    #3 0x55ee03c50cc9 in _start (/mnt/ram/mesa-18.2.4/src/compiler/glsl/glsl_test+0x8acc9)
>
>0x61a000000311 is located 657 bytes inside of 1400-byte region [0x61a000000080,0x61a0000005f8)
>freed by thread T0 here:
>    #0 0x7fbc5efad750 in __interceptor_free (/usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/libasan.so.5+0xed750)
>    #1 0x55ee03f48dce in unsafe_free /mnt/ram/mesa-18.2.4/src/util/ralloc.c:276
>    #2 0x55ee03f48a4c in ralloc_free /mnt/ram/mesa-18.2.4/src/util/ralloc.c:239
>    #3 0x55ee03c531aa in test_optpass(int, char**) glsl/test_optpass.cpp:267
>    #4 0x55ee03c50fe9 in main glsl/test.cpp:71
>    #5 0x7fbc5df4dae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)
>    #6 0x55ee03c50cc9 in _start (/mnt/ram/mesa-18.2.4/src/compiler/glsl/glsl_test+0x8acc9)
>
>previously allocated by thread T0 here:
>    #0 0x7fbc5efadb10 in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/libasan.so.5+0xedb10)
>    #1 0x55ee03f484d1 in ralloc_size /mnt/ram/mesa-18.2.4/src/util/ralloc.c:121
>    #2 0x55ee03f48645 in rzalloc_size /mnt/ram/mesa-18.2.4/src/util/ralloc.c:153
>    #3 0x55ee03c535ee in _mesa_glsl_parse_state::operator new(unsigned long, void*) glsl/glsl_parser_extras.h:83
>    #4 0x55ee03c52884 in test_optpass(int, char**) glsl/test_optpass.cpp:209
>    #5 0x55ee03c50fe9 in main glsl/test.cpp:71
>    #6 0x7fbc5df4dae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)
>    #7 0x55ee03c50cc9 in _start (/mnt/ram/mesa-18.2.4/src/compiler/glsl/glsl_test+0x8acc9)
>
>SUMMARY: AddressSanitizer: heap-use-after-free glsl/test_optpass.cpp:270 in test_optpass(int, char**)
>Shadow bytes around the buggy address:
>  0x0c347fff8010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>=>0x0c347fff8060: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff8090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff80a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c347fff80b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
>Shadow byte legend (one shadow byte represents 8 application bytes):
>  Addressable:           00
>  Partially addressable: 01 02 03 04 05 06 07 
>  Heap left redzone:       fa
>  Freed heap region:       fd
>  Stack left redzone:      f1
>  Stack mid redzone:       f2
>  Stack right redzone:     f3
>  Stack after return:      f5
>  Stack use after scope:   f8
>  Global redzone:          f9
>  Global init order:       f6
>  Poisoned by user:        f7
>  Container overflow:      fc
>  Array cookie:            ac
>  Intra object redzone:    bb
>  ASan internal:           fe
>  Left alloca redzone:     ca
>  Right alloca redzone:    cb
>==6426==ABORTING

Actions: View

Attachments on bug 108636: 142340 | 142341

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.