Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heap allocation size failed #209

Open
nyw0102 opened this issue Nov 12, 2024 · 0 comments
Open

Heap allocation size failed #209

nyw0102 opened this issue Nov 12, 2024 · 0 comments
Labels

Comments

@nyw0102
Copy link

nyw0102 commented Nov 12, 2024

Version

v0.11.14-1-gcc05721

Description

There is a heap allocation-size fail due to the unsafe "alloc" function used by 'customasm::util::bigint::BigInt::shl' function.

Current Behavior

ASAN detect heap allocation size failed due to the allocation by 'customasm::util::bigint::BigInt::shl' function exceed the maximum supported size

==1934128==ERROR: AddressSanitizer: requested allocation size 0x5659c624f518e40 (0x5659c624f519e40 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x55dfea3ce847 in malloc /home/nyw0102/s2fuzz/scripts/rust/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x55dfeadc2364 in alloc::alloc::alloc::h2068b468a191ea69 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:171:73
    #2 0x55dfeadc2364 in alloc::alloc::Global::alloc_impl::h5dbe6867d8aba98f /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:171:73
    #3 0x55dfeadf2976 in _$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Allocator$GT$::allocate::h77100fcb8636a305 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:231:9
    #4 0x55dfeade06b0 in alloc::raw_vec::RawVec$LT$T$C$A$GT$::allocate_in::h6447e80696de2d61 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/raw_vec.rs:185:45
    #5 0x55dfeadb409d in alloc::raw_vec::RawVec$LT$T$C$A$GT$::with_capacity_in::hf6d7227cf2b860ef /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:483:9
    #6 0x55dfeadb409d in alloc::vec::Vec$LT$T$C$A$GT$::with_capacity_in::he9d06f458c49d1a7 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:641:20
    #7 0x55dfeadb409d in alloc::vec::Vec$LT$T$GT$::with_capacity::hd6917faaecf238e8 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:483:9
    #8 0x55dfea86539a in _$LT$$RF$num_bigint..biguint..BigUint$u20$as$u20$core..ops..bit..Shl$LT$usize$GT$$GT$::shl::h1878d3849cd609f0 /home/nyw0102/.cargo/registry/src/github.com-1ecc6299db9ec823/num-bigint-0.1.44/src/biguint.rs:370:9
    #9 0x55dfea85ff45 in _$LT$$RF$num_bigint..bigint..BigInt$u20$as$u20$core..ops..bit..Shl$LT$usize$GT$$GT$::shl::hc8c492dc0ba8fb89 /home/nyw0102/.cargo/registry/src/github.com-1ecc6299db9ec823/num-bigint-0.1.44/src/bigint.rs:227:41
    #10 0x55dfeab5f724 in customasm::util::bigint::BigInt::shl::h9b8a42b728f6f372 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:149:9
    #11 0x55dfeab61142 in customasm::util::bigint::BigInt::checked_shl::_$u7b$$u7b$closure$u7d$$u7d$::h7dde0a7ee5998491 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:169:41
    #12 0x55dfea5f9c2e in core::option::Option$LT$T$GT$::map::hc57c5c3bec8e6496 /home/nyw0102/s2fuzz/scripts/rust/library/core/src/option.rs:929:29
    #13 0x55dfeab60cc6 in customasm::util::bigint::BigInt::checked_shl::hffcd886eb0228fe8 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:169:9
    #14 0x55dfeaa541f5 in customasm::expr::eval::_$LT$impl$u20$customasm..expr..expression..Expr$GT$::eval::hd50bedede7c4f298 /home/nyw0102/Test-Sets/customasm/src/expr/eval.rs:251:38
    #15 0x55dfeaa5181f in customasm::expr::eval::_$LT$impl$u20$customasm..expr..expression..Expr$GT$::eval::hd50bedede7c4f298 /home/nyw0102/Test-Sets/customasm/src/expr/eval.rs:206:16
    #16 0x55dfeaa991d5 in customasm::asm::state::State::eval_expr::hcf41250c70ade838 /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:1002:3
    #17 0x55dfeaa81627 in customasm::asm::state::State::resolve_data_invocation::h28e4be77f9705316 /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:614:18
    #18 0x55dfeab433f4 in customasm::asm::parser::data::parse_directive_data::hd8ba556143d26794 /home/nyw0102/Test-Sets/customasm/src/asm/parser/data.rs:32:24
    #19 0x55dfeaadf0f5 in customasm::asm::parser::file::parse_directive::h558beaaf9e13a01d /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:97:13
    #20 0x55dfeaadc55f in customasm::asm::parser::file::parse_line::h3a387eb6fb947b74 /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:55:9
    #21 0x55dfeaad727c in customasm::asm::parser::file::parse_file::hdc5553a5a1c95e28 /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:42:9
    #22 0x55dfeaa64020 in customasm::asm::state::Assembler::assemble::hbd438191f26eecbe /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:122:18
    #23 0x55dfeabc8a3c in customasm::driver::drive_inner::h299b7b51dfdf0f42 /home/nyw0102/Test-Sets/customasm/src/driver.rs:192:15
    #24 0x55dfeabbf074 in customasm::driver::drive::hd5fc72f7c2e70ee6 /home/nyw0102/Test-Sets/customasm/src/driver.rs:39:15
    #25 0x55dfea40ed19 in customasm::main::h23e4f4dfa8375648 /home/nyw0102/Test-Sets/customasm/src/main.rs:10:19
    #26 0x55dfea400f4a in core::ops::function::FnOnce::call_once::ha2625528851145be /home/nyw0102/s2fuzz/scripts/rust/library/core/src/ops/function.rs:248:5
    #27 0x55dfea3fe706 in std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h5d07d37f4c07bcb6 /home/nyw0102/s2fuzz/scripts/rust/library/std/src/rt.rs:145:18
    #28 0x55dfeae9a9f4 in std::rt::lang_start_internal::h4a61547abbd425a7 (/home/nyw0102/Test-Sets/customasm/target/x86_64-unknown-linux-gnu/debug/customasm+0xbb19f4) (BuildId: d53a25b51827aa08a6935884b3184aa2cb61527c)
    #29 0x55dfea40f2ef in main (/home/nyw0102/Test-Sets/customasm/target/x86_64-unknown-linux-gnu/debug/customasm+0x1262ef) (BuildId: d53a25b51827aa08a6935884b3184aa2cb61527c)

==1934128==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big /home/nyw0102/s2fuzz/scripts/rust/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 in malloc
==1934128==ABORTING

Expected Behavior

Memory-safety code with no allocation-size failed. This might be handled by denying allocation when the size of object exceeds the maximum allocation size.

@hlorenzi hlorenzi added the bug label Nov 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants