Skip to content

AddressSanitizer detects buffer overflows, comparator names must be null-terminated #56

@saethlin

Description

@saethlin

You can reproduce this with

RUSTFLAGS=-Zsanitizer=address cargo +nightly test -Zbuild-std --target=x86_64-unknown-linux-gnu

And you should see an error that looks like this:

==155398==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56533814bf07 at pc 0x565337537676 bp 0x7fcf7a4f4d20 sp 0x7fcf7a4f44e8
READ of size 8 at 0x56533814bf07 thread T7 (comparator::com)
    #0 0x565337537675 in strlen /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5
    #1 0x565337999bd6 in leveldb::Slice::Slice(char const*) /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/include/leveldb/slice.h:40:48
    #2 0x56533799de56 in leveldb::DBImpl::NewDB() /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/db_impl.cc:184:27
    #3 0x56533799ea20 in leveldb::DBImpl::Recover(leveldb::VersionEdit*, bool*) /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/db_impl.cc:295:16
    #4 0x5653379a4f10 in leveldb::DB::Open(leveldb::Options const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, leveldb::DB**) /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/db_impl.cc:1482:49
    #5 0x565337999f9e in leveldb_open /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/c.cc:167:33
    #6 0x5653375d0ac7 in leveldb::database::Database$LT$K$GT$::open_with_comparator::h8a9ab6d14aae33c4 /tmp/leveldb-0.8.6/src/database/mod.rs:151:22
    #7 0x5653375e1cd4 in tests::comparator::comparator::test_comparator::h968093db9d08b506 /tmp/leveldb-0.8.6/tests/comparator.rs:37:29

The problem is that leveldb is eventually going to call strlen on the comparator name pointers. This is a soundness bub because the Comparator trait is safe to implement.

Normally I'd make some attempt to patch this but I'm not really sure what to do here, and I think this is project is pretty abandoned. Figured it would be good to let you know anyway :)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions