Skip to content

The error content of AddressSanitizerComparisonOfMemoryTools page #1711

Open
@zhangm365

Description

@zhangm365
  1. Valgrind can detect the UAR memory error.
// g++ -g mem_UAR.cc
 #include<iostream>
 #include<new>
 
 int *ptr;
 __attribute__((noinline))
 void FunctionThatEscapesLocalObject() {
   int local[100];
   ptr = &local[0];
 }
 
 int main(int argc, char **argv) {
   FunctionThatEscapesLocalObject();
   printf("argc = %d\n", argc);
   return ptr[argc];
 }
valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all --gen-suppressions=all --time-stamp=yes --error-markers=VALGRINDERROR-BEGIN,VALGRINDERROR-END --log-file=$HOME/pg-valgrind/log/%p.log --trace-children=yes     ~/test/a.out 2>&1 | tee $HOME/pg-valgrind/postmaster.log

The log is as follows:

==00:00:00:01.098 1491957== VALGRINDERROR-BEGIN
==00:00:00:01.098 1491957== Invalid read of size 4
==00:00:00:01.098 1491957==    at 0x1091F7: main (mem_UAR.cc:13)
==00:00:00:01.098 1491957==  Address 0x1ffeffff34 is on thread 1's stack
==00:00:00:01.098 1491957==  428 bytes below stack pointer
==00:00:00:01.098 1491957== 
==00:00:00:01.098 1491957== VALGRINDERROR-END

So, the Valgrind can detect the UAF error.

  1. Valgrind can detect the StackOOB memory error.
 int main(int argc, char **argv) {
   int stack_array[100] = {0};
 
   return stack_array[argc + 100]; // BOOM
 }

Output file:

==00:00:00:01.257 1519192== VALGRINDERROR-BEGIN
==00:00:00:01.257 1519192== Syscall param exit_group(status) contains uninitialised byte(s)
==00:00:00:01.257 1519192==    at 0x4B81C31: _Exit (_exit.c:30)
==00:00:00:01.257 1519192==    by 0x4ADC551: __run_exit_handlers (exit.c:136)
==00:00:00:01.257 1519192==    by 0x4ADC60F: exit (exit.c:143)
==00:00:00:01.257 1519192==    by 0x4AC0D96: (below main) (libc_start_call_main.h:74)
==00:00:00:01.257 1519192==  Uninitialised value was created by a stack allocation
==00:00:00:01.257 1519192==    at 0x109189: main (mem_StackOOB.cc:4)
==00:00:00:01.257 1519192== 
==00:00:00:01.257 1519192== VALGRINDERROR-END

Please fix it in the summary table.
zhangm365.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions