WebAssembly / WebAssembly/wabt
Bug report on wabt( AddressSanitizer: SEGV)
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 8.1k
- Forks
- 827
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 18
Description
Describe the bug
A bug was found within the wabt. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using wabt. It would be best if the affected logic is checked beforehand.
The bug was found with a fuzzer based on the function "string_view.rfind2".
This may cause problems in the use of libraries
How To Reproduce
- Download the attached file
- Execute make_wabt_bug1.sh
- wabt/build/wabt-unittests --gtest_filter=string_view.rfind2string_view.rfind2
==47462==ERROR: AddressSanitizer: SEGV on unknown address 0x001a401df790 (pc 0x000000acb859 bp 0x7ffcf6f85950 sp 0x7ffcf6f85900 T0)
==47462==The signal is caused by a READ memory access.
#0 0xacb859 in bool __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> >::operator()<std::reverse_iterator<char const*> >(std::reverse_iterator<char const*>) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/predefined_ops.h:262:21
#1 0xacb287 in std::reverse_iterator<char const*> std::__find_if<std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> > >(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> >, std::random_access_iterator_tag) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:120:8
#2 0xacaced in std::reverse_iterator<char const*> std::__find_if<std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> > >(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> >) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:161:14
#3 0xaca7cb in std::reverse_iterator<char const*> std::__search<std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equal_to_iter>(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equal_to_iter) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:226:6
#4 0xac6e40 in std::reverse_iterator<char const*> std::search<std::reverse_iterator<char const*>, std::reverse_iterator<char const*> >(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:4151:14
#5 0xac6a9d in wabt::string_view::rfind(wabt::string_view, unsigned long) const wabt/src/string-view.cc:127:27
#6 0xac73a8 in wabt::string_view::rfind(char const*, unsigned long, unsigned long) const wabt/src/string-view.cc:140:10
Platform (please complete the following information):
OS: Ubuntu 18.04
wabt_bug1.tar.gz
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with wabt/src/string-view.cc at the rfind calls on lines 127 and 140, then reproduce the failure using the attached file and make_wabt_bug1.sh. Run wabt/build/wabt-unittests with the reported string_view.rfind2 filter under AddressSanitizer; done means the reproducer no longer causes a segmentation fault.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100