Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bugfix] Fix #425 #430

Merged
merged 2 commits into from
Feb 7, 2025
Merged

Conversation

ChunYen-Chen
Copy link
Collaborator

@ChunYen-Chen ChunYen-Chen commented Feb 7, 2025

Solve #425.
Thank you, @salmanhiro and @technic960183, for identifying this issue. Thank you, @vivi235711 for your help.

Reproduce the issue with the error message

  1. Compile gamer with AddressSanitizer (ASan) flags
  2. Run gamer
Error message
==58858==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00010259625c at pc 0x00010b4ef33d bp 0x0003089dd110 sp 0x0003089dc8c0
WRITE of size 512 at 0x00010259625c thread T0
    #0 0x00010b4ef33c in strncpy+0x4cc (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x4e33c)
    #1 0x0001021b7ca7 in ReadPara_t::Read(char const*) ReadPara.h:290
    #2 0x0001021affcf in Init_Load_Parameter() Init_Load_Parameter.cpp:626
    #3 0x0001021a8708 in Init_GAMER(int*, char***) Init_GAMER.cpp:38
    #4 0x0001020802e8 in main Main.cpp:614
    #5 0x00020283e2cc  ()

0x00010259625c is located 0 bytes after global variable 'OUTPUT_DIR' defined in 'Main/Main.cpp' (0x0001025960c0) of size 412
SUMMARY: AddressSanitizer: global-buffer-overflow ReadPara.h:290 in ReadPara_t::Read(char const*)
Shadow bytes around the buggy address:
  0x000102595f80: 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9
  0x000102596000: 00 f9 f9 f9 00 f9 f9 f9 04 f9 f9 f9 00 f9 f9 f9
  0x000102596080: 00 f9 f9 f9 00 f9 f9 f9 00 00 00 00 00 00 00 00
  0x000102596100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000102596180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x000102596200: 00 00 00 00 00 00 00 00 00 00 00[04]f9 f9 f9 f9
  0x000102596280: f9 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9
  0x000102596300: 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9
  0x000102596380: 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9
  0x000102596400: 04 f9 f9 f9 04 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x000102596480: 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==58858==ABORTING
zsh: abort      ./gamer

How to fix

  1. Declare the length of OUTPUT_DIR as MAX_STRING
  2. If the code uses sprintf() with OUTPUT_DIR, I append the destination string length to 2*MAX_STRING.

@ChunYen-Chen ChunYen-Chen added the bugfix Fix bugs label Feb 7, 2025
@hyschive hyschive self-assigned this Feb 7, 2025
@hyschive hyschive self-requested a review February 7, 2025 02:42
@hyschive hyschive added the general General issues and improvement label Feb 7, 2025
Copy link
Contributor

@hyschive hyschive left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ChunYen-Chen Thanks for the prompt fix!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix Fix bugs general General issues and improvement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants