AcademySoftwareFoundation / AcademySoftwareFoundation/OpenColorIO

Asan container overflow when reading configuration file

Offen
#2,118 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
C++
Sterne
2.1k
Forks
503
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

I'm using the source for v2.4.0 and I'm seeing a container overflow when building with address sanitizer enabled:
```
#0 0x0000000311ca31a8 in __asan::AsanDie ()
#1 0x0000000311cbe7a0 in __sanitizer::Die ()
#2 0x0000000311ca109c in __asan::ScopedInErrorReport::~ScopedInErrorReport ()
#3 0x0000000311ca03d8 in __asan::ReportGenericError ()
#4 0x0000000311c95d10 in __asan_memcpy ()
#5 0x000000010cb6b4b0 in OpenColorIO_v2_4::ColorSpace::getAllocationVars at /build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/ColorSpace.cpp:305
#6 0x000000010ccb5f8c in OpenColorIO_v2_4::(anonymous namespace)::save at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/OCIOYaml.cpp:3356
#7 0x000000010cc5826c in OpenColorIO_v2_4::(anonymous namespace)::save at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/OCIOYaml.cpp:5097
#8 0x000000010cc5367c in OpenColorIO_v2_4::OCIOYaml::Write at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/OCIOYaml.cpp:5151
#9 0x000000010cbb81d0 in OpenColorIO_v2_4::Config::serialize at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/Config.cpp:4937
#10 0x000000010cbb8a84 in OpenColorIO_v2_4::Config::getCacheID at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/Config.cpp:4882
#11 0x000000010cbb8564 in OpenColorIO_v2_4::Config::getCacheID at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/Config.cpp:4861
#12 0x000000010cb43100 in OCIOW::OCIOConfiguration::OCIOConfiguration at MediaCore/OCIOModules/OCIOWrapper/Src/OCIOConfigurationFileManager.cpp:238
#13 0x000000010cb47a18 in OCIOW::OCIOConfiguration::ValidateOCIOConfigurationFile [inlined] at MediaCore/OCIOModules/OCIOWrapper/Src/OCIOConfigurationFileManager.cpp:220
...

```

This is reported as a container overflow issue [here](https://github.com/AcademySoftwareFoundation/OpenColorIO/blob/d807b380d24d826bd97ca1bb356ff8b83c006563/src/OpenColorIO/OCIOYaml.cpp#L3355-L3356)

With all the manual memory copying happening into that vector, I'm not surprised an overflow happens. Instead it should be:
```
std::vector allocationvars;
allocationvars.resize(cs->getAllocationNumVars());
```
It's important that the vector's capacity can handle the size of memory that's going to be copied into it by the manual memcpy. Otherwise this is always at risk of a container overflow if the vector's capacity is different than the size (which can happen if the vector starts as 0 elements and a memcpy tries to copy in 3, like what I encountered in my container overflow debug case locally.

It looks to me like there is a similar risk [here](https://github.com/AcademySoftwareFoundation/OpenColorIO/blob/d807b380d24d826bd97ca1bb356ff8b83c006563/src/OpenColorIO/OCIOYaml.cpp#L503) as well.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Untersuche src/OpenColorIO/OCIOYaml.cpp um die Zeilen 3355-3356 und 503 herum sowie ColorSpace::getAllocationVars in src/OpenColorIO/ColorSpace.cpp. Reproduziere das Problem mit einem AddressSanitizer-Build und einer Konfiguration, die die Serialisierung auslöst. Als erledigt gilt die Aufgabe, wenn die Vektoren der Allokationsvariablen vor dem Kopieren eine ausreichende Größe haben und beide gemeldeten Stellen abgedeckt sind, ohne dass ein ASan-container-overflow-Bericht ausgegeben wird.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
cpp
Bereich
computer-graphics
Issue-Typ
Bug
Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
48/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.