You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The validate_stack and validate_heap tests in src/addr_validate.rs both pass pointers to variables smaller than CHECK_LENGTH (16 bytes = 2 × pointer size on 64-bit) to validate().
validate() always reads exactly CHECK_LENGTH = 2 * size_of::<*const c_void>() bytes from the given address via write() to a pipe (the mechanism used to check readability). Both tests therefore read past the end of their variables into the ASAN redzone:
CHECK_LENGTH is 16 bytes because validate() is used to preflight reads of FramePointerLayout (two pointer-sized fields: frame_pointer + ret) before the frame pointer unwinder dereferences them.
Summary
The
validate_stackandvalidate_heaptests insrc/addr_validate.rsboth pass pointers to variables smaller thanCHECK_LENGTH(16 bytes = 2 × pointer size on 64-bit) tovalidate().validate()always reads exactlyCHECK_LENGTH = 2 * size_of::<*const c_void>()bytes from the given address viawrite()to a pipe (the mechanism used to check readability). Both tests therefore read past the end of their variables into the ASAN redzone:validate_stack: passes&iwherei: i32(4 bytes) — 12-byte stack-buffer-overflowvalidate_heap: passes&elemfor eachi32in aVec— 12-byte heap-buffer-overflow on the last elementReproduction
ASAN reports:
Fix
Use variables at least 16 bytes in size:
CHECK_LENGTHis 16 bytes becausevalidate()is used to preflight reads ofFramePointerLayout(two pointer-sized fields:frame_pointer+ret) before the frame pointer unwinder dereferences them.