WebAssembly / WebAssembly/wabt

Bug report on wabt( AddressSanitizer: SEGV)

Open
#1,793 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

sanitizer failures
Dominant language
C++
Stars
8.1k
Forks
827
Avg merge
4d 6h
Merged PRs (30d)
18

Description

Describe the bug
A bug was found within the wabt. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using wabt. It would be best if the affected logic is checked beforehand.
The bug was found with a fuzzer based on the function "string_view.rfind2".
This may cause problems in the use of libraries

How To Reproduce

  1. Download the attached file
  2. Execute make_wabt_bug1.sh
  3. wabt/build/wabt-unittests --gtest_filter=string_view.rfind2string_view.rfind2

==47462==ERROR: AddressSanitizer: SEGV on unknown address 0x001a401df790 (pc 0x000000acb859 bp 0x7ffcf6f85950 sp 0x7ffcf6f85900 T0)
==47462==The signal is caused by a READ memory access.
#0 0xacb859 in bool __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> >::operator()<std::reverse_iterator<char const*> >(std::reverse_iterator<char const*>) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/predefined_ops.h:262:21
#1 0xacb287 in std::reverse_iterator<char const*> std::__find_if<std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> > >(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> >, std::random_access_iterator_tag) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:120:8
#2 0xacaced in std::reverse_iterator<char const*> std::__find_if<std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> > >(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equals_iter<std::reverse_iterator<char const*> >) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:161:14
#3 0xaca7cb in std::reverse_iterator<char const*> std::__search<std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equal_to_iter>(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, __gnu_cxx::__ops::_Iter_equal_to_iter) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:226:6
#4 0xac6e40 in std::reverse_iterator<char const*> std::search<std::reverse_iterator<char const*>, std::reverse_iterator<char const*> >(std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>, std::reverse_iterator<char const*>) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_algo.h:4151:14
#5 0xac6a9d in wabt::string_view::rfind(wabt::string_view, unsigned long) const wabt/src/string-view.cc:127:27
#6 0xac73a8 in wabt::string_view::rfind(char const*, unsigned long, unsigned long) const wabt/src/string-view.cc:140:10

Platform (please complete the following information):
OS: Ubuntu 18.04
wabt_bug1.tar.gz

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with wabt/src/string-view.cc at the rfind calls on lines 127 and 140, then reproduce the failure using the attached file and make_wabt_bug1.sh. Run wabt/build/wabt-unittests with the reported string_view.rfind2 filter under AddressSanitizer; done means the reproducer no longer causes a segmentation fault.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.