AcademySoftwareFoundation / AcademySoftwareFoundation/OpenColorIO

Asan container overflow when reading configuration file

Abierto
#2,118 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
C++
Estrellas
2.1k
Forks
503
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

I'm using the source for v2.4.0 and I'm seeing a container overflow when building with address sanitizer enabled:
```
#0 0x0000000311ca31a8 in __asan::AsanDie ()
#1 0x0000000311cbe7a0 in __sanitizer::Die ()
#2 0x0000000311ca109c in __asan::ScopedInErrorReport::~ScopedInErrorReport ()
#3 0x0000000311ca03d8 in __asan::ReportGenericError ()
#4 0x0000000311c95d10 in __asan_memcpy ()
#5 0x000000010cb6b4b0 in OpenColorIO_v2_4::ColorSpace::getAllocationVars at /build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/ColorSpace.cpp:305
#6 0x000000010ccb5f8c in OpenColorIO_v2_4::(anonymous namespace)::save at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/OCIOYaml.cpp:3356
#7 0x000000010cc5826c in OpenColorIO_v2_4::(anonymous namespace)::save at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/OCIOYaml.cpp:5097
#8 0x000000010cc5367c in OpenColorIO_v2_4::OCIOYaml::Write at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/OCIOYaml.cpp:5151
#9 0x000000010cbb81d0 in OpenColorIO_v2_4::Config::serialize at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/Config.cpp:4937
#10 0x000000010cbb8a84 in OpenColorIO_v2_4::Config::getCacheID at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/Config.cpp:4882
#11 0x000000010cbb8564 in OpenColorIO_v2_4::Config::getCacheID at build/mb/git/adobe/thirdparty/OpenColorIO/src/OpenColorIO/Config.cpp:4861
#12 0x000000010cb43100 in OCIOW::OCIOConfiguration::OCIOConfiguration at MediaCore/OCIOModules/OCIOWrapper/Src/OCIOConfigurationFileManager.cpp:238
#13 0x000000010cb47a18 in OCIOW::OCIOConfiguration::ValidateOCIOConfigurationFile [inlined] at MediaCore/OCIOModules/OCIOWrapper/Src/OCIOConfigurationFileManager.cpp:220
...

```

This is reported as a container overflow issue [here](https://github.com/AcademySoftwareFoundation/OpenColorIO/blob/d807b380d24d826bd97ca1bb356ff8b83c006563/src/OpenColorIO/OCIOYaml.cpp#L3355-L3356)

With all the manual memory copying happening into that vector, I'm not surprised an overflow happens. Instead it should be:
```
std::vector allocationvars;
allocationvars.resize(cs->getAllocationNumVars());
```
It's important that the vector's capacity can handle the size of memory that's going to be copied into it by the manual memcpy. Otherwise this is always at risk of a container overflow if the vector's capacity is different than the size (which can happen if the vector starts as 0 elements and a memcpy tries to copy in 3, like what I encountered in my container overflow debug case locally.

It looks to me like there is a similar risk [here](https://github.com/AcademySoftwareFoundation/OpenColorIO/blob/d807b380d24d826bd97ca1bb356ff8b83c006563/src/OpenColorIO/OCIOYaml.cpp#L503) as well.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Inspecciona src/OpenColorIO/OCIOYaml.cpp alrededor de las líneas 3355-3356 y 503, junto con ColorSpace::getAllocationVars en src/OpenColorIO/ColorSpace.cpp. Reproduce el problema con una compilación de AddressSanitizer y una configuración que active la serialización. Se considera completado cuando los vectores de variables de asignación tienen un tamaño suficiente antes de copiar y ambas ubicaciones reportadas están cubiertas sin que se genere un informe de ASan container-overflow.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
cpp
Área
computer-graphics
Tipo de issue
Error
Dificultad
2/5
Tiempo estimado
1-3 horas
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
48/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.