std::bad_alloc in retdec-fileinfo
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
We are currently working on fuzz testing feature, and we found a crash on `retdec-fileinfo`.
The stack traces are as follow:
```st
terminate called after throwing an instance of 'std::bad_alloc'
what(): std::bad_alloc
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff5821921 in __GI_abort () at abort.c:79
#2 0x00007ffff6214957 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3 0x00007ffff621aae6 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#4 0x00007ffff621ab21 in std::terminate() () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#5 0x00007ffff621ad54 in __cxa_throw () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#6 0x00005555563a9b75 in llvm::report_bad_alloc_error(char const*, bool) ()
#7 0x00005555563b05d6 in llvm::SmallVectorBase::grow_pod(void*, unsigned long, unsigned long) ()
#8 0x00005555562d4a98 in (anonymous namespace)::DWARFObjInMemory::DWARFObjInMemory(llvm::object::ObjectFile const&, llvm::LoadedObjectInfo const*, llvm::function_ref) ()
#9 0x00005555562d5505 in llvm::DWARFContext::create(llvm::object::ObjectFile const&, llvm::LoadedObjectInfo const*, llvm::function_ref, std::__cxx11::basic_string, std::allocator >) ()
#10 0x0000555555e2aa2a in retdec::cpdetect::Heuristics::getDwarfInfo (this=this@entry=0x60d00002fda0) at .../retdec-git/src/cpdetect/heuristics/heuristics.cpp:724
#11 0x0000555555e35561 in retdec::cpdetect::Heuristics::getCommonToolsHeuristics (this=this@entry=0x60d00002fda0) at .../retdec-git/src/cpdetect/heuristics/heuristics.cpp:911
#12 0x0000555555e355c1 in retdec::cpdetect::Heuristics::getAllHeuristics (this=0x60d00002fda0) at .../retdec-git/src/cpdetect/heuristics/heuristics.cpp:989
#13 0x0000555555e42928 in retdec::cpdetect::CompilerDetector::getAllHeuristics (this=) at .../retdec-git/src/cpdetect/cpdetect.cpp:491
#14 0x0000555555e527c7 in retdec::cpdetect::CompilerDetector::getAllCompilers (this=this@entry=0x6120000049c0) at .../retdec-git/src/cpdetect/cpdetect.cpp:724
#15 0x0000555555e55aab in retdec::cpdetect::CompilerDetector::getAllInformation (this=0x6120000049c0) at .../retdec-git/src/cpdetect/cpdetect.cpp:793
#16 0x00005555557e55f5 in retdec::fileinfo::FileDetector::getCompilerInformation (this=this@entry=0x60700001d360) at .../retdec-git/src/fileinfo/file_detector/file_detector.cpp:77
#17 0x00005555557e78f3 in retdec::fileinfo::FileDetector::getAllInformation (this=0x60700001d360) at .../retdec-git/src/fileinfo/file_detector/file_detector.cpp:341
#18 0x0000555555727a23 in main (argc=, argv=) at .../retdec-git/src/fileinfo/fileinfo.cpp:812
```
Here is the full stack trace :
[stacktrace_retdec-fileinfo_3.zip](https://github.com/avast/retdec/files/7078385/stacktrace_retdec-fileinfo_3.zip)
**Step to reproduce**
We configured `retdec-fileinfo` using `CFLAGS="-g -O0 -fsanitize=address" CXXFLAGS="-g -O0 -fsanitize=address" cmake -DBUILD_SHARED_LIBS=OFF -DRETDEC_ENABLE_ALL=OFF -DRETDEC_ENABLE_FILEINFO=ON .. ` and built it using `make -j10; make install`, and run it with:
```
./retdec-fileinfo
```
Attachment:
[input_retdec-fileinfo_3.zip](https://github.com/avast/retdec/files/7078386/input_retdec-fileinfo_3.zip)
**Environment**
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- retdec version: latest commit of master branch on github ([link](https://github.com/avast/retdec/tree/e364c52dd07cf30d3e13820e84f3e11052ae4c03))
Thank you.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with src/cpdetect/heuristics/heuristics.cpp at getDwarfInfo(), then follow the calls through CompilerDetector and src/fileinfo/file_detector/file_detector.cpp. Build with the configuration in the report and run retdec-fileinfo on input_retdec-fileinfo_3.zip. Done means the attached input no longer terminates with std::bad_alloc.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- devtools, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100