Skip to content
This repository was archived by the owner on Jun 5, 2026. It is now read-only.
This repository was archived by the owner on Jun 5, 2026. It is now read-only.

fix: addr_validate tests trigger stack/heap buffer overflow under ASAN #38

Description

@korniltsev-grafanista

Summary

The validate_stack and validate_heap tests in src/addr_validate.rs both pass pointers to variables smaller than CHECK_LENGTH (16 bytes = 2 × pointer size on 64-bit) to validate().

validate() always reads exactly CHECK_LENGTH = 2 * size_of::<*const c_void>() bytes from the given address via write() to a pipe (the mechanism used to check readability). Both tests therefore read past the end of their variables into the ASAN redzone:

  • validate_stack: passes &i where i: i32 (4 bytes) — 12-byte stack-buffer-overflow
  • validate_heap: passes &elem for each i32 in a Vec — 12-byte heap-buffer-overflow on the last element

Reproduction

RUSTFLAGS="-Zsanitizer=address" cargo +nightly test --target aarch64-apple-darwin --lib

ASAN reports:

ERROR: AddressSanitizer: stack-buffer-overflow on address ... 
  [32, 36) 'i' (line 115) <== Memory access at offset 36 overflows this variable

Fix

Use variables at least 16 bytes in size:

// validate_stack
let i: [u8; 16] = [0; 16];
assert!(validate(i.as_ptr() as *const libc::c_void));

// validate_heap
let vec: Vec<u128> = vec![0; 1000];

CHECK_LENGTH is 16 bytes because validate() is used to preflight reads of FramePointerLayout (two pointer-sized fields: frame_pointer + ret) before the frame pointer unwinder dereferences them.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions