Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8327986

ASAN reports use-after-free in DirectivesParserTest.empty_object_vm

XMLWordPrintable

    • b17

        ASAN reports a use-after-free, because we feed the string we got from `setlocale` back to `setlocale`, but this string is owned by the libc, and the libc decided to free it in the meantime.

        ```
        [ RUN ] DirectivesParserTest.empty_object_vm
        =================================================================
        ==347387==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000ee10 at pc 0x7f54badf2ffd bp 0x7ffff2dd8410 sp 0x7ffff2dd7bb8
        READ of size 2 at 0x60200000ee10 thread T0
            #0 0x7f54badf2ffc in __interceptor_setlocale ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:3254
            #1 0x7f54b2a320a6 in DirectivesParserTest::~DirectivesParserTest() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:42
            #2 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
            #3 0x7f54b2a320a6 in DirectivesParserTest_empty_object_vm_Test::~DirectivesParserTest_empty_object_vm_Test() /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/compiler/test_directivesParser.cpp:62
            #4 0x7f54b86dab8d in testing::Test::DeleteSelf_() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:336
            #5 0x7f54b86dab8d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2670
            #6 0x7f54b86dab8d in testing::TestInfo::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2842
            #7 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:3015
            #8 0x7f54b8711861 in testing::TestSuite::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:2968
            #9 0x7f54b8713140 in testing::internal::UnitTestImpl::RunAllTests() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5920
            #10 0x7f54b8713e43 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /shared/projects/openjdk/gtest/g
        oogletest-1.14.0/googletest/src/gtest.cc:2670
            #11 0x7f54b8713e43 in testing::UnitTest::Run() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/src/gtest.cc:5484
            #12 0x7f54b25eec15 in RUN_ALL_TESTS() /shared/projects/openjdk/gtest/googletest-1.14.0/googletest/include/gtest/gtest.h:2317
            #13 0x7f54b25eec15 in runUnitTestsInner /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:290
            #14 0x7f54b25ef430 in runUnitTests /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestMain.cpp:371
            #15 0x561fec59123d in main /shared/projects/openjdk/jdk-jdk/source/test/hotspot/gtest/gtestLauncher.cpp:40
            #16 0x7f54b1013082 in __libc_start_main ../csu/libc-start.c:308
            #17 0x561fec59110d in _start (/shared/projects/openjdk/jdk-jdk/output-fastdebug/hotspot/variant-server/libjvm/gtest/gtestLauncher+0x110d)

        0x60200000ee10 is located 0 bytes inside of 12-byte region [0x60200000ee10,0x60200000ee1c)
        freed by thread T0 here:
            #0 0x7f54bae8040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
            #1 0x7f54b101fc48 in setname /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:199
            #2 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:452
            #3 0x7f54b101fc48 in __GI_setlocale /build/glibc-wuryBv/glibc-2.31/locale/setlocale.c:217

        previously allocated by thread T0 here:
            #0 0x7f54bae80808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
            #1 0x7f54b108e38e in __GI___strdup /build/glibc-wuryBv/glibc-2.31/string/strdup.c:42
        ```


              stuefe Thomas Stuefe
              stuefe Thomas Stuefe
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: