Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8327986

ASAN reports use-after-free in DirectivesParserTest.empty_object_vm

XMLWordPrintable

    • b17

      ASAN reports a use-after-free, because we feed the string we got from `setlocale` back to `setlocale`, but this string is owned by the libc, and the libc decided to free it in the meantime.

      ```
      [ RUN ] DirectivesParserTest.empty_object_vm
      =================================================================
      ==347387==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000ee10 at pc 0x7f54badf2ffd bp 0x7ffff2dd8410 sp 0x7ffff2dd7bb8
      READ of size 2 at 0x60200000ee10 thread T0
          #0 0x7f54badf2ffc in __interceptor_setlocale ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:3254
          #1 0x7f54b2a320a6 in DirectivesParserTest::~DirectivesParserTest() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:42
          #2 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
          #3 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
          #4 0x7f54b86dab8d in testing::Test::DeleteSelf_() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:336
          #5 0x7f54b86dab8d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2670
          #6 0x7f54b86dab8d in testing::TestInfo::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2842
          #7 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:3015
          #8 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2968
          #9 0x7f54b8713140 in testing::internal::UnitTestImpl::RunAllTests() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5920
          #10 0x7f54b8713e43 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /shared/projects/openjdk/gtest/g
      oogletest-1.14.0/googletest/src/gtest.cc:2670
          #11 0x7f54b8713e43 in testing::UnitTest::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5484
          #12 0x7f54b25eec15 in RUN_ALL_TESTS() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:2317
          #13 0x7f54b25eec15 in runUnitTestsInner /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:290
          #14 0x7f54b25ef430 in runUnitTests /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:371
          #15 0x561fec59123d in main /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestLauncher.cpp:40
          #16 0x7f54b1013082 in __libc_start_main ../csu/libc-start.c:308
          #17 0x561fec59110d in _start (/shared/projects/openjdk/jdk-jdk/output-fastdebug/hotspot/variant-server/libjvm/gtest/gtestLauncher+0x110d)

      0x60200000ee10 is located 0 bytes inside of 12-byte region [0x60200000ee10,0x60200000ee1c)
      freed by thread T0 here:
          #0 0x7f54bae8040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
          #1 0x7f54b101fc48 in setname /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:199
          #2 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:452
          #3 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:217

      previously allocated by thread T0 here:
          #0 0x7f54bae80808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
          #1 0x7f54b108e38e in __GI___strdup /build/glibc-wuryBv/glibc-2.31/string/strdup.c:42
      ```


            stuefe Thomas Stuefe
            stuefe Thomas Stuefe
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: