Project

General

Profile

Actions
Copy link

Bug #3727

closed

OBufferStream destructor use-after-free

Added by Davide Pesavento over 8 years ago. Updated about 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Junxiao Shi
Category:
Base
Target version:
v0.5
Start date:
Due date:
% Done:

100%

Estimated time:
2.00 h

Description

Environment: Ubuntu 16.04, ndn-cxx:commit:5a67310e89e02f1f5290901b57637e86b7d00104

Snippet to reproduce:

// g++ -o x -std=c++0x x.cpp $(pkg-config --cflags --libs libndn-cxx)
#include <ndn-cxx/encoding/buffer-stream.hpp>

int main()
{
  ndn::OBufferStream os;
  os << '1';

  return 0;
}

Valgrind output:

==3515== Invalid read of size 4
==3515==    at 0x804C081: void std::vector<unsigned char, std::allocator<unsigned char> >::emplace_back<unsigned char>(unsigned char&&) (in /code/x)
==3515==    by 0x804B957: std::vector<unsigned char, std::allocator<unsigned char> >::push_back(unsigned char&&) (in /code/x)
==3515==    by 0x804B264: std::back_insert_iterator<ndn::Buffer>::operator=(unsigned char&&) (in /code/x)
==3515==    by 0x804AF2A: std::back_insert_iterator<ndn::Buffer> std::__copy_move<false, false, std::random_access_iterator_tag>::__copy_m<char const*, std::back_insert_iterator<ndn::Buffer> >(char const*, char const*, std::back_insert_iterator<ndn::Buffer>) (in /code/x)
==3515==    by 0x804ACC9: std::back_insert_iterator<ndn::Buffer> std::__copy_move_a<false, char const*, std::back_insert_iterator<ndn::Buffer> >(char const*, char const*, std::back_insert_iterator<ndn::Buffer>) (in /code/x)
==3515==    by 0x804A8BE: std::back_insert_iterator<ndn::Buffer> std::__copy_move_a2<false, char const*, std::back_insert_iterator<ndn::Buffer> >(char const*, char const*, std::back_insert_iterator<ndn::Buffer>) (in /code/x)
==3515==    by 0x804A470: std::back_insert_iterator<ndn::Buffer> std::copy<char const*, std::back_insert_iterator<ndn::Buffer> >(char const*, char const*, std::back_insert_iterator<ndn::Buffer>) (in /code/x)
==3515==    by 0x804A0DF: ndn::iostreams::buffer_append_device::write(char const*, int) (in /code/x)
==3515==    by 0x804CE57: int boost::iostreams::detail::write_device_impl<boost::iostreams::output>::write<ndn::iostreams::buffer_append_device>(ndn::iostreams::buffer_append_device&, boost::iostreams::char_type_of<ndn::iostreams::buffer_append_device>::type const*, int) (in /code/x)
==3515==    by 0x804CD95: int boost::iostreams::write<ndn::iostreams::buffer_append_device>(ndn::iostreams::buffer_append_device&, boost::iostreams::char_type_of<ndn::iostreams::buffer_append_device>::type const*, int) (in /code/x)
==3515==    by 0x804CC9B: int boost::iostreams::detail::device_wrapper_impl<boost::iostreams::output>::write<ndn::iostreams::buffer_append_device, boost::iostreams::detail::linked_streambuf<char, std::char_traits<char> > >(ndn::iostreams::buffer_append_device&, boost::iostreams::detail::linked_streambuf<char, std::char_traits<char> >*, boost::iostreams::char_type_of<ndn::iostreams::buffer_append_device>::type const*, int) (in /code/x)
==3515==    by 0x804CA0B: int boost::iostreams::detail::concept_adapter<ndn::iostreams::buffer_append_device>::write<boost::iostreams::detail::linked_streambuf<char, std::char_traits<char> > >(char const*, int, boost::iostreams::detail::linked_streambuf<char, std::char_traits<char> >*) (in /code/x)
==3515==  Address 0x4409a68 is 16 bytes inside a block of size 24 free'd
==3515==    at 0x402E7B8: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==3515==    by 0x804C910: __gnu_cxx::new_allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> >::deallocate(std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2>*, unsigned int) (in /code/x)
==3515==    by 0x804C13B: std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> > >::deallocate(std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> >&, std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2>*, unsigned int) (in /code/x)
==3515==    by 0x804B9E2: std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> > >::~__allocated_ptr() (in /code/x)
==3515==    by 0x804D280: std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2>::_M_destroy() (in /code/x)
==3515==    by 0x804A9B9: std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() (in /code/x)
==3515==    by 0x804A52E: std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() (in /code/x)
==3515==    by 0x804A10E: std::__shared_ptr<ndn::Buffer, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() (in /code/x)
==3515==    by 0x804A127: std::shared_ptr<ndn::Buffer>::~shared_ptr() (in /code/x)
==3515==    by 0x804CFE3: ndn::OBufferStream::~OBufferStream() (in /code/x)
==3515==    by 0x8049B9A: main (in /code/x)
==3515==  Block was alloc'd at
==3515==    at 0x402D6BC: operator new(unsigned int) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==3515==    by 0x804C8F9: __gnu_cxx::new_allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> >::allocate(unsigned int, void const*) (in /code/x)
==3515==    by 0x804C107: std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> > >::allocate(std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> >&, unsigned int) (in /code/x)
==3515==    by 0x804B99F: std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> > > std::__allocate_guarded<std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> > >(std::allocator<std::_Sp_counted_ptr_inplace<ndn::Buffer, std::allocator<ndn::Buffer>, (__gnu_cxx::_Lock_policy)2> >&) (in /code/x)
==3515==    by 0x804B2CE: std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count<ndn::Buffer, std::allocator<ndn::Buffer>>(std::_Sp_make_shared_tag, ndn::Buffer*, std::allocator<ndn::Buffer> const&) (in /code/x)
==3515==    by 0x804AF88: std::__shared_ptr<ndn::Buffer, (__gnu_cxx::_Lock_policy)2>::__shared_ptr<std::allocator<ndn::Buffer>>(std::_Sp_make_shared_tag, std::allocator<ndn::Buffer> const&) (in /code/x)
==3515==    by 0x804AD07: std::shared_ptr<ndn::Buffer>::shared_ptr<std::allocator<ndn::Buffer>>(std::_Sp_make_shared_tag, std::allocator<ndn::Buffer> const&) (in /code/x)
==3515==    by 0x804A938: std::shared_ptr<ndn::Buffer> std::allocate_shared<ndn::Buffer, std::allocator<ndn::Buffer>>(std::allocator<ndn::Buffer> const&) (in /code/x)
==3515==    by 0x804A4C5: std::shared_ptr<ndn::Buffer> std::make_shared<ndn::Buffer>() (in /code/x)
==3515==    by 0x804A2A8: ndn::OBufferStream::OBufferStream() (in /code/x)
==3515==    by 0x8049B6F: main (in /code/x)

Related issues 1 (0 open — 1 closed)

Blocks NFD - Task #2589: CI: enable AddressSanitizer for unit testsClosedDavide Pesavento

Actions
Actions
Copy link

Also available in: Atom PDF