http://llvm.org/bugs/show_bug.cgi?id=19734
Bug ID: 19734
Summary: getgrnam_r interceptor can crash
Product: compiler-rt
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P
Component: compiler-rt
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Classification: Unclassified
This relates to sanitizer_common_interceptors.inc @r208530.
The interceptor for getgrnam_r() (and possibly others, including getgrid_r())
can crash, because it unpoisons the fields of the struct group even when no
matches have been found.
getgrnam_r(...., &result) is documented to return zero on lack of error (even
including no matches), and to set result to a non-NULL value if a match occurs.
The interceptor only checks for !res and not for result before unpoisoning.
On my system, the fields of grp on no-match happen to point to the last entry
in /etc/group, so this is harmless; on another system (which I don't have
access to)
and which has 'group: compat' in nsswitch.conf (which may or may not be
relevant), the fields of grp on no-match contain garbage. Here's what gdb shows
just after the return from the libc getgrnam_r() call on that system:
$3 = {gr_name = 0xbebebebebebebebe <Address 0xbebebebebebebebe out of bounds>,
gr_passwd = 0xbebebebebebebebe <Address 0xbebebebebebebebe out of bounds>,
gr_gid = 3200171710, gr_mem = 0xbebebebebebebebe}
So clearly the getgrnam_r interceptor shouldn't call unpoison_group() (and
possibly some other actions too?) unless result is non-NULL.
Also I think the places where it checks for result being non-null should be
checking *result????
This was originally discovered in the test suite for the perl interpreter;
under ASan on one person's test server, it was consistently crashing when doing
a getgrnam on an unknown name on a perl built using getgrnam_r() (i.e. a
threaded interpreter).
The original thread can be seen here:
http://www.nntp.perl.org/group/perl.perl5.porters/2014/05/msg215176.html
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
LLVMbugs mailing list
[email protected]
http://lists.cs.uiuc.edu/mailman/listinfo/llvmbugs
