-
Bug
-
Resolution: Fixed
-
P4
-
23
-
b17
ASAN reports a use-after-free, because we feed the string we got from `setlocale` back to `setlocale`, but this string is owned by the libc, and the libc decided to free it in the meantime.
```
[ RUN ] DirectivesParserTest.empty_object_vm
=================================================================
==347387==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000ee10 at pc 0x7f54badf2ffd bp 0x7ffff2dd8410 sp 0x7ffff2dd7bb8
READ of size 2 at 0x60200000ee10 thread T0
#0 0x7f54badf2ffc in __interceptor_setlocale ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:3254
#1 0x7f54b2a320a6 in DirectivesParserTest::~DirectivesParserTest() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:42
#2 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
#3 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
#4 0x7f54b86dab8d in testing::Test::DeleteSelf_() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:336
#5 0x7f54b86dab8d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2670
#6 0x7f54b86dab8d in testing::TestInfo::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2842
#7 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:3015
#8 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2968
#9 0x7f54b8713140 in testing::internal::UnitTestImpl::RunAllTests() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5920
#10 0x7f54b8713e43 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /shared/projects/openjdk/gtest/g
oogletest-1.14.0/googletest/src/gtest.cc:2670
#11 0x7f54b8713e43 in testing::UnitTest::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5484
#12 0x7f54b25eec15 in RUN_ALL_TESTS() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:2317
#13 0x7f54b25eec15 in runUnitTestsInner /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:290
#14 0x7f54b25ef430 in runUnitTests /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:371
#15 0x561fec59123d in main /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestLauncher.cpp:40
#16 0x7f54b1013082 in __libc_start_main ../csu/libc-start.c:308
#17 0x561fec59110d in _start (/shared/projects/openjdk/jdk-jdk/output-fastdebug/hotspot/variant-server/libjvm/gtest/gtestLauncher+0x110d)
0x60200000ee10 is located 0 bytes inside of 12-byte region [0x60200000ee10,0x60200000ee1c)
freed by thread T0 here:
#0 0x7f54bae8040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x7f54b101fc48 in setname /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:199
#2 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:452
#3 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:217
previously allocated by thread T0 here:
#0 0x7f54bae80808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x7f54b108e38e in __GI___strdup /build/glibc-wuryBv/glibc-2.31/string/strdup.c:42
```
```
[ RUN ] DirectivesParserTest.empty_object_vm
=================================================================
==347387==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000ee10 at pc 0x7f54badf2ffd bp 0x7ffff2dd8410 sp 0x7ffff2dd7bb8
READ of size 2 at 0x60200000ee10 thread T0
#0 0x7f54badf2ffc in __interceptor_setlocale ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:3254
#1 0x7f54b2a320a6 in DirectivesParserTest::~DirectivesParserTest() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:42
#2 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
#3 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
#4 0x7f54b86dab8d in testing::Test::DeleteSelf_() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:336
#5 0x7f54b86dab8d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2670
#6 0x7f54b86dab8d in testing::TestInfo::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2842
#7 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:3015
#8 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2968
#9 0x7f54b8713140 in testing::internal::UnitTestImpl::RunAllTests() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5920
#10 0x7f54b8713e43 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /shared/projects/openjdk/gtest/g
oogletest-1.14.0/googletest/src/gtest.cc:2670
#11 0x7f54b8713e43 in testing::UnitTest::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5484
#12 0x7f54b25eec15 in RUN_ALL_TESTS() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:2317
#13 0x7f54b25eec15 in runUnitTestsInner /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:290
#14 0x7f54b25ef430 in runUnitTests /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:371
#15 0x561fec59123d in main /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestLauncher.cpp:40
#16 0x7f54b1013082 in __libc_start_main ../csu/libc-start.c:308
#17 0x561fec59110d in _start (/shared/projects/openjdk/jdk-jdk/output-fastdebug/hotspot/variant-server/libjvm/gtest/gtestLauncher+0x110d)
0x60200000ee10 is located 0 bytes inside of 12-byte region [0x60200000ee10,0x60200000ee1c)
freed by thread T0 here:
#0 0x7f54bae8040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x7f54b101fc48 in setname /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:199
#2 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:452
#3 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:217
previously allocated by thread T0 here:
#0 0x7f54bae80808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x7f54b108e38e in __GI___strdup /build/glibc-wuryBv/glibc-2.31/string/strdup.c:42
```