fixed fuzzing crashes #6089
Merged
fixed fuzzing crashes #6089
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lib/checkautovariables.cpp
Outdated
| @@ -58,7 +58,7 @@ static bool isPtrArg(const Token *tok) | |||
| static bool isArrayArg(const Token *tok, const Settings* settings) | |||
| { | |||
| const Variable *var = tok->variable(); | |||
| return (var && var->isArgument() && var->isArray() && !settings->library.isentrypoint(var->scope()->className)); | |||
| return (var && var->isArgument() && var->isArray() && var->scope() && !settings->library.isentrypoint(var->scope()->className)); | |||
There was a problem hiding this comment.
Should we even create a variable without a scope?
There was a problem hiding this comment.
That question sounds quite rhetorical.
There was a problem hiding this comment.
Maybe we should catch this where it happens, since it it sort of an invariant that we probably rely on elsewhere.
There was a problem hiding this comment.
I am all for that if it makes more sense. It seems similar to https://trac.cppcheck.net/ticket/12494 which I did not try to fix.
There was a problem hiding this comment.
If this needs a different approach but the others are fine I will drop this from the PR and a file a ticket about it instead. That way this could be merged.
There was a problem hiding this comment.
It seems we started to hit this in daca:
Packages: [trilinos](http://cppcheck1.osuosl.org:8000/trilinos)
0x00007ffff7d4eba4 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::compare(char const*) const () from /lib/x86_64-linux-gnu/libstdc++.so.6
#0 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::compare(char const*) const (...) from /lib/x86_64-linux-gnu/libstdc++.so.6
#1 std::operator==<char, std::char_traits<char>, std::allocator<char> >(...) at /usr/include/c++/11/bits/basic_string.h:6248
#2 Library::isentrypoint (...) at lib/library.h:427
#3 isArrayArg (...) at build/checkautovariables.cpp:432
#4 CheckAutoVariables::autoVariables (...) at build/checkautovariables.cpp:664
#5 CheckAutoVariables::runChecks(...) at lib/checkautovariables.h:62
#6 CppCheck::checkNormalTokens(...) at build/cppcheck.cpp:1133
#7 CppCheck::checkFile(...) at build/cppcheck.cpp:966
#8 CppCheck::check(...) at build/cppcheck.cpp:567
#9 SingleExecutor::check(...) at cli/singleexecutor.cpp:53
#10 CppCheckExecutor::check_internal(...) at cli/cppcheckexecutor.cpp:278
#11 CppCheckExecutor::check_wrapper(...) at cli/cppcheckexecutor.cpp:217
#12 CppCheckExecutor::check (...) at cli/cppcheckexecutor.cpp:203
#13 main(...) at cli/main.cpp:91
There was a problem hiding this comment.
I think https://trac.cppcheck.net/ticket/12501 has a different root cause though.
Can we add a nullptr check + debug message?
There was a problem hiding this comment.
Will look into it.
Are the remaining fixes fine? I would pull it out into a different PR then and merge the rest.
==77069==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5818456d58e8 bp 0x7ffefda33930 sp 0x7ffefda32ec0 T0)
==77069==The signal is caused by a READ memory access.
==77069==Hint: address points to the zero page.
#0 0x5818456d58e8 in _M_data /sbin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/basic_string.h:223:28
#1 0x5818456d58e8 in c_str /sbin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/basic_string.h:2584:16
danmar#2 0x5818456d58e8 in operator==<2U> /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/matchcompiler.h:57:29
danmar#3 0x5818456d58e8 in operator!=<2U> /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/matchcompiler.h:63:17
danmar#4 0x5818456d58e8 in Tokenizer::simplifyTypedefCpp() /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:9257:63
danmar#5 0x5818456b6a4e in Tokenizer::simplifyTypedef() /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:8440:5
danmar#6 0x581845728947 in Tokenizer::simplifyTokenList1(char const*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:12966:9
danmar#7 0x581845721160 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:10670:14
danmar#8 0x5818460d580d in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/cppcheck.cpp:907:32
danmar#9 0x5818460e19f1 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/cppcheck.cpp:561:12
danmar#10 0x58184655ea64 in LLVMFuzzerTestOneInput /home/user/CLionProjects/cppcheck-rider/oss-fuzz/main.cpp:47:18
danmar#11 0x5818452261e8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x6831e8) (BuildId: e178119f6c3ed0061522391da23885513ce32cf8)
danmar#12 0x5818452268e6 in fuzzer::Fuzzer::MinimizeCrashLoop(std::vector<unsigned char, std::allocator<unsigned char>> const&) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x6838e6) (BuildId: e178119f6c3ed0061522391da23885513ce32cf8)
danmar#13 0x5818451fcb0b in fuzzer::MinimizeCrashInputInternalStep(fuzzer::Fuzzer*, fuzzer::InputCorpus*) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x659b0b) (BuildId: e178119f6c3ed0061522391da23885513ce32cf8)
danmar#14 0x581845209218 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x666218) (BuildId: e178119f6c3ed0061522391da23885513ce32cf8)
danmar#15 0x58184518ef77 in main (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5ebf77) (BuildId: e178119f6c3ed0061522391da23885513ce32cf8)
danmar#16 0x7cd168c43ccf (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#17 0x7cd168c43d89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#18 0x5818451f3004 in _start (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x650004) (BuildId: e178119f6c3ed0061522391da23885513ce32cf8)
==149528==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x5d6ad25b3594 bp 0x7fffe27af570 sp 0x7fffe27af460 T0)
==149528==The signal is caused by a READ memory access.
==149528==Hint: address points to the zero page.
#0 0x5d6ad25b3594 in next /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/token.h:831:16
#1 0x5d6ad25b3594 in Tokenizer::simplifyNamespaceAliases() /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:17826:40
danmar#2 0x5d6ad24f6ac2 in Tokenizer::simplifyTokenList1(char const*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:12822:5
danmar#3 0x5d6ad24f1190 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/tokenize.cpp:10670:14
danmar#4 0x5d6ad2ea58cd in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/cppcheck.cpp:907:32
danmar#5 0x5d6ad2eb1ab1 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/build/cppcheck.cpp:561:12
danmar#6 0x5d6ad332eb24 in LLVMFuzzerTestOneInput /home/user/CLionProjects/cppcheck-rider/oss-fuzz/main.cpp:47:18
danmar#7 0x5d6ad1ff61e8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x6831e8) (BuildId: ccbc3e894f14691449044410c9da42fa3a09557b)
danmar#8 0x5d6ad1ff68e6 in fuzzer::Fuzzer::MinimizeCrashLoop(std::vector<unsigned char, std::allocator<unsigned char>> const&) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x6838e6) (BuildId: ccbc3e894f14691449044410c9da42fa3a09557b)
danmar#9 0x5d6ad1fccb0b in fuzzer::MinimizeCrashInputInternalStep(fuzzer::Fuzzer*, fuzzer::InputCorpus*) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x659b0b) (BuildId: ccbc3e894f14691449044410c9da42fa3a09557b)
danmar#10 0x5d6ad1fd9218 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x666218) (BuildId: ccbc3e894f14691449044410c9da42fa3a09557b)
danmar#11 0x5d6ad1f5ef77 in main (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5ebf77) (BuildId: ccbc3e894f14691449044410c9da42fa3a09557b)
danmar#12 0x7bb3d5955ccf (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#13 0x7bb3d5955d89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#14 0x5d6ad1fc3004 in _start (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x650004) (BuildId: ccbc3e894f14691449044410c9da42fa3a09557b)
/home/user/CLionProjects/cppcheck-rider/lib/checksizeof.cpp:239:37: runtime error: member call on null pointer of type 'Token'
#0 0x637fa171b539 in CheckSizeof::checkSizeofForPointerSize() /home/user/CLionProjects/cppcheck-rider/lib/checksizeof.cpp:239:37
#1 0x637fa1727816 in CheckSizeof::runChecks(Tokenizer const&, ErrorLogger*) /home/user/CLionProjects/cppcheck-rider/lib/checksizeof.h:61:21
danmar#2 0x637fa197f5bd in CppCheck::checkNormalTokens(Tokenizer const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:1122:20
danmar#3 0x637fa1998334 in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:955:17
danmar#4 0x637fa1985a87 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:556:12
danmar#5 0x637fa0a83f2b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
danmar#6 0x637fa09be8dc in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:277:32
danmar#7 0x637fa09bd73d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:216:12
danmar#8 0x637fa09bc67a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:202:21
danmar#9 0x637fa20cd247 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
danmar#10 0x7c50f5c0dccf (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#11 0x7c50f5c0dd89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#12 0x637fa07f79f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6c9f4) (BuildId: 780ff4c602598cd16715ae4e639db79b0c18f29d)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/user/CLionProjects/cppcheck-rider/lib/checksizeof.cpp:239:37 in
/home/user/CLionProjects/cppcheck-rider/lib/tokenlist.cpp:1584:57: runtime error: member call on null pointer of type 'Token'
#0 0x567b09ca144a in createAstAtToken(Token*, bool) /home/user/CLionProjects/cppcheck-rider/lib/tokenlist.cpp:1584:57
#1 0x567b09c9f318 in TokenList::createAst() const /home/user/CLionProjects/cppcheck-rider/lib/tokenlist.cpp:1757:15
danmar#2 0x567b08bffc19 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/tokenize.cpp:3380:14
danmar#3 0x567b096e08ea in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:925:32
danmar#4 0x567b096cfbb7 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/lib/cppcheck.cpp:556:12
danmar#5 0x567b087cdf2b in SingleExecutor::check() /home/user/CLionProjects/cppcheck-rider/cli/singleexecutor.cpp:53:29
danmar#6 0x567b087088dc in CppCheckExecutor::check_internal(Settings const&) const /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:277:32
danmar#7 0x567b0870773d in CppCheckExecutor::check_wrapper(Settings const&) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:216:12
danmar#8 0x567b0870667a in CppCheckExecutor::check(int, char const* const*) /home/user/CLionProjects/cppcheck-rider/cli/cppcheckexecutor.cpp:202:21
danmar#9 0x567b09e173a7 in main /home/user/CLionProjects/cppcheck-rider/cli/main.cpp:91:21
danmar#10 0x7a285fb55ccf (/usr/lib/libc.so.6+0x29ccf) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#11 0x7a285fb55d89 in __libc_start_main (/usr/lib/libc.so.6+0x29d89) (BuildId: 0865c4b9ba13e0094e8b45b78dfc7a2971f536d2)
danmar#12 0x567b085419f4 in _start (/home/user/CLionProjects/cppcheck-rider/cmake-build-debug-clang-asan-ubsan/bin/cppcheck+0xf6d9f4) (BuildId: 0c5083349039fc85dc8c8bb587f97bea024306ef)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.