AddressSanitizer: SEGV on unknown address #180
Comments
|
Thanks for running Check with Clang's ASAN and sharing the results. As a part of Check's own tests there are several cases which intentionally raise SIGFPE (here and here) and SIGSEGV (here, here, and here) to verify that the behavior can be caught and reported. I do not think that the sanitizer output shows failures in Check itself, but instead show that some of Check's tests are intentionally doing bad things. The type and number of signals reported by ASAN is expected. It is interesting that the ASAN reports show the state from the parent process observing the signal rather that the children which forked and caused the signal. Might the ASAN output from the forked children (which is where the tests run) not being captured or reported? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi Team,
Summary
While fuzzing check using clang 6.0 with ASAN multiple segfaults were observed in check_run.c, check_check_master.c and check_check_main.c.
Vulnerable code from check_run.c:
{ setpgid(0, 0); group_pid = getpgrp(); tr = tcase_run_checked_setup(sr, tc); free(tr); clock_gettime(check_get_clockid(), &ts_start); tcase_fn_start(tfun->ttest->name, tfun->ttest->file, tfun->ttest->line); tfun->ttest->fn(i); clock_gettime(check_get_clockid(), &ts_end); tcase_run_checked_teardown(tc); send_duration_info(DIFF_IN_USEC(ts_start, ts_end)); exit(EXIT_SUCCESS); }Vulnerable code from check_check_master.c:
{ Suite *s = make_sub_suite(); SRunner *sr = srunner_create(s); init_signal_strings(); /* * Create files that will contain the test names and line numbers of the failures * in check_check_sub.c, as they occur. */ #if !HAVE_MKSTEMP test_names_file_name = tempnam(NULL, "check_test_names_"); test_names_file = fopen(test_names_file_name, "w+b"); line_num_failures_file_name = tempnam(NULL, "check_error_linenums_"); line_num_failures = fopen(line_num_failures_file_name, "w+b"); #else test_names_file_name = strdup("check_test_names__XXXXXX"); assert(test_names_file_name != NULL && "strdup() failed"); test_names_file = fdopen(mkstemp(test_names_file_name), "w+b"); line_num_failures_file_name = strdup("check_error_linenums_XXXXXX"); assert(line_num_failures_file_name != NULL && "strdup() failed"); line_num_failures = fdopen(mkstemp(line_num_failures_file_name), "w+b"); #endif srunner_add_suite(sr, make_sub2_suite()); srunner_run_all(sr, CK_VERBOSE); tr_fail_array = srunner_failures(sr); tr_all_array = srunner_results(sr); sub_nfailed = srunner_ntests_failed(sr); sub_ntests = srunner_ntests_run(sr); }Vulnerable code from check_check_main.c:
{ int n; SRunner *sr; fork_setup(); setup_fixture(); setup(); sr = srunner_create (make_master_suite()); srunner_add_suite(sr, make_list_suite()); srunner_add_suite(sr, make_msg_suite()); srunner_add_suite(sr, make_log_suite()); srunner_add_suite(sr, make_log_internal_suite()); srunner_add_suite(sr, make_limit_suite()); srunner_add_suite(sr, make_fork_suite()); srunner_add_suite(sr, make_fixture_suite()); srunner_add_suite(sr, make_pack_suite()); srunner_add_suite(sr, make_tag_suite()); #if defined(HAVE_FORK) && HAVE_FORK==1 srunner_add_suite(sr, make_exit_suite()); #endif srunner_add_suite(sr, make_selective_suite()); printf ("Ran %d tests in subordinate suite\n", sub_ntests); srunner_run_all (sr, CK_VERBOSE); cleanup(); fork_teardown(); teardown_fixture(); n = srunner_ntests_failed(sr); srunner_free(sr); return (n == 0) ? EXIT_SUCCESS : EXIT_FAILURE; }Output from ASAN:
Kindly requesting the team to have a look and validate.
Thanks.
The text was updated successfully, but these errors were encountered: