boostorg / boostorg/process

Buffer overflow in bp::env

Open
#180 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
145
Forks
151
PR merge metrics
No merged PRs in 30d

Description

[AddressSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizer) reports a `heap-buffer-overflow` on the following program in Boost version 1.74:

```cpp
#include

namespace bp = boost::process;

int main(int, char**) {
bp::system("/usr/bin/env", bp::env["VALUE_VALUE_VALUE_111VALUE_1"]="foo", bp::env["VALUE_2"]+={"bar1", "bar2"});
}
```

The example is taken from the [tutorial](https://www.boost.org/doc/libs/1_74_0/doc/html/boost_process/tutorial.html#boost_process.tutorial.env) but uses a longer variable name. (The original example does not experience the problem.)

Compile and run like so (assuming above code is in `testbp.cpp`, adapt paths if necessary):

```
clang++-9.0 testbp.cpp -std=c++17 -o testbp -I /opt/boost-1.74.0/include/ -fsanitize=address,undefined -fno-omit-frame-pointer
./testbp
```

The full output on my machine is:

```
==8012==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000054 at pc 0x000000439152 bp 0x7ffd8f5f7750 sp 0x7ffd8f5f6ef8
READ of size 29 at 0x603000000054 thread T0
#0 0x439151 (/home/muellein/git/jitq/backend/build/testbp+0x439151)
#1 0x4394fa (/home/muellein/git/jitq/backend/build/testbp+0x4394fa)
#2 0x504b9d (/home/muellein/git/jitq/backend/build/testbp+0x504b9d)
#3 0x504960 (/home/muellein/git/jitq/backend/build/testbp+0x504960)
#4 0x5040e4 (/home/muellein/git/jitq/backend/build/testbp+0x5040e4)
#5 0x5032cf (/home/muellein/git/jitq/backend/build/testbp+0x5032cf)
#6 0x50286a (/home/muellein/git/jitq/backend/build/testbp+0x50286a)
#7 0x500ce0 (/home/muellein/git/jitq/backend/build/testbp+0x500ce0)
#8 0x500336 (/home/muellein/git/jitq/backend/build/testbp+0x500336)
#9 0x4fa39d (/home/muellein/git/jitq/backend/build/testbp+0x4fa39d)
#10 0x4f9abc (/home/muellein/git/jitq/backend/build/testbp+0x4f9abc)
#11 0x4f96e2 (/home/muellein/git/jitq/backend/build/testbp+0x4f96e2)
#12 0x4f93fa (/home/muellein/git/jitq/backend/build/testbp+0x4f93fa)
#13 0x4eb37c (/home/muellein/git/jitq/backend/build/testbp+0x4eb37c)
#14 0x4ea490 (/home/muellein/git/jitq/backend/build/testbp+0x4ea490)
#15 0x4e9f43 (/home/muellein/git/jitq/backend/build/testbp+0x4e9f43)
#16 0x4e9206 (/home/muellein/git/jitq/backend/build/testbp+0x4e9206)
#17 0x4e8af5 (/home/muellein/git/jitq/backend/build/testbp+0x4e8af5)
#18 0x4d06b7 (/home/muellein/git/jitq/backend/build/testbp+0x4d06b7)
#19 0x4cc025 (/home/muellein/git/jitq/backend/build/testbp+0x4cc025)
#20 0x7ff8ad2f209a (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
#21 0x421d79 (/home/muellein/git/jitq/backend/build/testbp+0x421d79)

0x603000000054 is located 0 bytes to the right of 20-byte region [0x603000000040,0x603000000054)
allocated by thread T0 here:
#0 0x4c93dd (/home/muellein/git/jitq/backend/build/testbp+0x4c93dd)
#1 0x4e35ef (/home/muellein/git/jitq/backend/build/testbp+0x4e35ef)
#2 0x4e3400 (/home/muellein/git/jitq/backend/build/testbp+0x4e3400)
#3 0x4e2eb2 (/home/muellein/git/jitq/backend/build/testbp+0x4e2eb2)
#4 0x4e27fe (/home/muellein/git/jitq/backend/build/testbp+0x4e27fe)
#5 0x4e25a6 (/home/muellein/git/jitq/backend/build/testbp+0x4e25a6)
#6 0x4e2327 (/home/muellein/git/jitq/backend/build/testbp+0x4e2327)
#7 0x4d0863 (/home/muellein/git/jitq/backend/build/testbp+0x4d0863)
#8 0x4f78fe (/home/muellein/git/jitq/backend/build/testbp+0x4f78fe)
#9 0x4f75c4 (/home/muellein/git/jitq/backend/build/testbp+0x4f75c4)
#10 0x4f74e0 (/home/muellein/git/jitq/backend/build/testbp+0x4f74e0)
#11 0x4f6ab0 (/home/muellein/git/jitq/backend/build/testbp+0x4f6ab0)
#12 0x4f6411 (/home/muellein/git/jitq/backend/build/testbp+0x4f6411)
#13 0x4f5259 (/home/muellein/git/jitq/backend/build/testbp+0x4f5259)
#14 0x4f501e (/home/muellein/git/jitq/backend/build/testbp+0x4f501e)
#15 0x4eda97 (/home/muellein/git/jitq/backend/build/testbp+0x4eda97)
#16 0x4ed0c7 (/home/muellein/git/jitq/backend/build/testbp+0x4ed0c7)
#17 0x4ecdf2 (/home/muellein/git/jitq/backend/build/testbp+0x4ecdf2)
#18 0x4ecc12 (/home/muellein/git/jitq/backend/build/testbp+0x4ecc12)
#19 0x4ecaa3 (/home/muellein/git/jitq/backend/build/testbp+0x4ecaa3)
#20 0x4ec557 (/home/muellein/git/jitq/backend/build/testbp+0x4ec557)
#21 0x4ec44c (/home/muellein/git/jitq/backend/build/testbp+0x4ec44c)
#22 0x4ec34a (/home/muellein/git/jitq/backend/build/testbp+0x4ec34a)
#23 0x4eb13e (/home/muellein/git/jitq/backend/build/testbp+0x4eb13e)
#24 0x4ea430 (/home/muellein/git/jitq/backend/build/testbp+0x4ea430)
#25 0x4e9f43 (/home/muellein/git/jitq/backend/build/testbp+0x4e9f43)
#26 0x4e9206 (/home/muellein/git/jitq/backend/build/testbp+0x4e9206)
#27 0x4e8af5 (/home/muellein/git/jitq/backend/build/testbp+0x4e8af5)
#28 0x4d06b7 (/home/muellein/git/jitq/backend/build/testbp+0x4d06b7)
#29 0x4cc025 (/home/muellein/git/jitq/backend/build/testbp+0x4cc025)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/muellein/git/jitq/backend/build/testbp+0x439151)
Shadow bytes around the buggy address:
0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c067fff8000: fa fa 00 00 00 05 fa fa 00 00[04]fa fa fa 00 00
0x0c067fff8010: 01 fa fa fa 00 00 04 fa fa fa 00 00 05 fa fa fa
0x0c067fff8020: 00 00 01 fa fa fa 00 00 00 00 fa fa 00 00 02 fa
0x0c067fff8030: fa fa 00 00 04 fa fa fa 00 00 00 03 fa fa 00 00
0x0c067fff8040: 04 fa fa fa 00 00 00 fa fa fa 00 00 03 fa fa fa
0x0c067fff8050: 00 00 00 07 fa fa fd fd fd fd fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==8012==ABORTING
```

Note that I have tested a few variable names of different lengths but they all cause a message that talks about a `20-byte region`. Maybe there is some statically-sized buffer somewhere?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.