-
Notifications
You must be signed in to change notification settings - Fork 54
AddressSanitizer detects buffer overflows, comparator names must be null-terminated #56
Copy link
Copy link
Open
Description
You can reproduce this with
RUSTFLAGS=-Zsanitizer=address cargo +nightly test -Zbuild-std --target=x86_64-unknown-linux-gnu
And you should see an error that looks like this:
==155398==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56533814bf07 at pc 0x565337537676 bp 0x7fcf7a4f4d20 sp 0x7fcf7a4f44e8
READ of size 8 at 0x56533814bf07 thread T7 (comparator::com)
#0 0x565337537675 in strlen /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5
#1 0x565337999bd6 in leveldb::Slice::Slice(char const*) /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/include/leveldb/slice.h:40:48
#2 0x56533799de56 in leveldb::DBImpl::NewDB() /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/db_impl.cc:184:27
#3 0x56533799ea20 in leveldb::DBImpl::Recover(leveldb::VersionEdit*, bool*) /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/db_impl.cc:295:16
#4 0x5653379a4f10 in leveldb::DB::Open(leveldb::Options const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, leveldb::DB**) /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/db_impl.cc:1482:49
#5 0x565337999f9e in leveldb_open /home/ben/.cargo/registry/src/github.com-1ecc6299db9ec823/leveldb-sys-2.0.9/deps/leveldb-1.22/db/c.cc:167:33
#6 0x5653375d0ac7 in leveldb::database::Database$LT$K$GT$::open_with_comparator::h8a9ab6d14aae33c4 /tmp/leveldb-0.8.6/src/database/mod.rs:151:22
#7 0x5653375e1cd4 in tests::comparator::comparator::test_comparator::h968093db9d08b506 /tmp/leveldb-0.8.6/tests/comparator.rs:37:29
The problem is that leveldb is eventually going to call strlen on the comparator name pointers. This is a soundness bub because the Comparator trait is safe to implement.
Normally I'd make some attempt to patch this but I'm not really sure what to do here, and I think this is project is pretty abandoned. Figured it would be good to let you know anyway :)
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels