On Mon, Nov 13, 2017 at 9:20 AM, Kuba Mracek <[email protected]> wrote:
> > > On Nov 13, 2017, at 9:05 AM, Konstantin Serebryany < > [email protected]> wrote: > > > > On Sat, Nov 11, 2017 at 3:48 AM, Christian Holler <[email protected]> w > rote: > >> Hello, >> >> >> we're currently shipping an llvm-symbolizer binary next to the firefox >> > > "shipping" as in "shipping to the testing farm" or as in "shipping to > early adopters who run asan-ified firefox as their main browser" > If the latter -- please don't. > llvm-symbolizer deals with extremely complicated data format (DWARF) and > is likely to have horrible security bugs. > > > Isn't the same true for the ASan runtime per se? > To some extent, but much less so. At least ASan doesn't parse DWARF. > > Kuba > > > If the former, I would simply suggest to have llvm-symbolizer in PATH on > the testing machines (or some such) > > >> binary in our Firefox+ASan tarball. Would it make sense for the asan-rt >> to try and locate llvm-symbolizer also when it is not on PATH but in the >> same directory as the running binary and executable? I realize we could >> use ASan options or ASAN_SYMBOLIZER_PATH but that again requires custom >> wrappers or early C code that modifies the default ASan options and I >> figured this use case might not be so unusual. The target systems won't >> have llvm-symbolizer installed. >> >> >> Thanks, >> >> Chris >> >> -- >> You received this message because you are subscribed to the Google Groups >> "address-sanitizer" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > > > -- > You received this message because you are subscribed to the Google Groups > "address-sanitizer" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > > > -- You received this message because you are subscribed to the Google Groups "address-sanitizer" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
