avast / avast/retdec

std::bad_alloc in retdec-fileinfo

Open
#1,010 0 comments 0 reactions 0 assignees View on GitHub
bug C-fileinfo
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Hello,

We are currently working on fuzz testing feature, and we found a crash on `retdec-fileinfo`.

The stack traces are as follow:
```st
terminate called after throwing an instance of 'std::bad_alloc'
what(): std::bad_alloc

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff5821921 in __GI_abort () at abort.c:79
#2 0x00007ffff6214957 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3 0x00007ffff621aae6 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#4 0x00007ffff621ab21 in std::terminate() () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#5 0x00007ffff621ad54 in __cxa_throw () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#6 0x00005555563a9b75 in llvm::report_bad_alloc_error(char const*, bool) ()
#7 0x00005555563b05d6 in llvm::SmallVectorBase::grow_pod(void*, unsigned long, unsigned long) ()
#8 0x00005555562d4a98 in (anonymous namespace)::DWARFObjInMemory::DWARFObjInMemory(llvm::object::ObjectFile const&, llvm::LoadedObjectInfo const*, llvm::function_ref) ()
#9 0x00005555562d5505 in llvm::DWARFContext::create(llvm::object::ObjectFile const&, llvm::LoadedObjectInfo const*, llvm::function_ref, std::__cxx11::basic_string, std::allocator >) ()
#10 0x0000555555e2aa2a in retdec::cpdetect::Heuristics::getDwarfInfo (this=this@entry=0x60d00002fda0) at .../retdec-git/src/cpdetect/heuristics/heuristics.cpp:724
#11 0x0000555555e35561 in retdec::cpdetect::Heuristics::getCommonToolsHeuristics (this=this@entry=0x60d00002fda0) at .../retdec-git/src/cpdetect/heuristics/heuristics.cpp:911
#12 0x0000555555e355c1 in retdec::cpdetect::Heuristics::getAllHeuristics (this=0x60d00002fda0) at .../retdec-git/src/cpdetect/heuristics/heuristics.cpp:989
#13 0x0000555555e42928 in retdec::cpdetect::CompilerDetector::getAllHeuristics (this=) at .../retdec-git/src/cpdetect/cpdetect.cpp:491
#14 0x0000555555e527c7 in retdec::cpdetect::CompilerDetector::getAllCompilers (this=this@entry=0x6120000049c0) at .../retdec-git/src/cpdetect/cpdetect.cpp:724
#15 0x0000555555e55aab in retdec::cpdetect::CompilerDetector::getAllInformation (this=0x6120000049c0) at .../retdec-git/src/cpdetect/cpdetect.cpp:793
#16 0x00005555557e55f5 in retdec::fileinfo::FileDetector::getCompilerInformation (this=this@entry=0x60700001d360) at .../retdec-git/src/fileinfo/file_detector/file_detector.cpp:77
#17 0x00005555557e78f3 in retdec::fileinfo::FileDetector::getAllInformation (this=0x60700001d360) at .../retdec-git/src/fileinfo/file_detector/file_detector.cpp:341
#18 0x0000555555727a23 in main (argc=, argv=) at .../retdec-git/src/fileinfo/fileinfo.cpp:812
```
Here is the full stack trace :
[stacktrace_retdec-fileinfo_3.zip](https://github.com/avast/retdec/files/7078385/stacktrace_retdec-fileinfo_3.zip)

**Step to reproduce**

We configured `retdec-fileinfo` using `CFLAGS="-g -O0 -fsanitize=address" CXXFLAGS="-g -O0 -fsanitize=address" cmake -DBUILD_SHARED_LIBS=OFF -DRETDEC_ENABLE_ALL=OFF -DRETDEC_ENABLE_FILEINFO=ON .. ` and built it using `make -j10; make install`, and run it with:

```
./retdec-fileinfo
```
Attachment:
[input_retdec-fileinfo_3.zip](https://github.com/avast/retdec/files/7078386/input_retdec-fileinfo_3.zip)

**Environment**
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- retdec version: latest commit of master branch on github ([link](https://github.com/avast/retdec/tree/e364c52dd07cf30d3e13820e84f3e11052ae4c03))

Thank you.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with src/cpdetect/heuristics/heuristics.cpp at getDwarfInfo(), then follow the calls through CompilerDetector and src/fileinfo/file_detector/file_detector.cpp. Build with the configuration in the report and run retdec-fileinfo on input_retdec-fileinfo_3.zip. Done means the attached input no longer terminates with std::bad_alloc.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.