╰─❱ ./probe
DEBUG: './libjni.so' uses dynamic JNI linkage
DEBUG: './libjni.so' contains no Agent linkage
DEBUG: [./libjni.so]::JNI_OnLoad -> 0x7fd666c822e0
DEBUG: [./libjni.so]::JNI_OnUnload -> 0x7fd666c827e0
DEBUG: Created library: './libjni.so'
DEBUG: [./libjni.so]::JNI_OnLoad
EXAMPLE AGENT: JNI_OnLoad!
DEBUG: JNIInvokeInterface_::GetEnv
DEBUG: JNINativeInterface_::FindClass
BARON INFO: Fabricated class 'yo_this is not a valid class name_' -> 0x613000000040
DEBUG: JNINativeInterface_::GetMethodID
=================================================================
==1603154==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd3dc13dc8 at pc 0x7fd669f29533 bp 0x7ffd3dc13b30 sp 0x7ffd3dc13b28
READ of size 1 at 0x7ffd3dc13dc8 thread T0
#0 0x7fd669f29532 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int) baron/build/../fake-jni/src/jvm/method.cpp:269:45
#1 0x7fd66a0c356e in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:56:14
#2 0x7fd669e7ca7e in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::operator()(JNIEnv_*, _jclass*, char const*, char const*) const baron/build/../fake-jni/src/jni/native/native.cpp:159:15
#3 0x7fd669e7c80c in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::__invoke(JNIEnv_*, _jclass*, char const*, char const*) baron/build/../fake-jni/src/jni/native/native.cpp:156:17
#4 0x7fd666c829fb in JNIEnv_::GetMethodID(_jclass*, char const*, char const*) baron/build/../example/jni/include/jni.h:903:16
#5 0x7fd666c824c8 in JNI_OnLoad baron/build/../example/jni/src/jni.cpp:23:26
#6 0x7fd669e46464 in FakeJni::Library::jniLoad() const baron/build/../fake-jni/src/internal/library.cpp:189:11
#7 0x7fd669ef343c in FakeJni::Jvm::attachLibrary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, FakeJni::LibraryOptions) baron/build/../fake-jni/src/jvm/jvm.cpp:371:19
#8 0x5639bf227bfa in main baron/build/../example/probe/src/main.cpp:11:5
#9 0x7fd669857022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)
#10 0x5639bf14e28d in _start (baron/build/example/probe+0x2428d)
Address 0x7ffd3dc13dc8 is located in stack of thread T0 at offset 72 in frame
#0 0x7fd66a0c2edf in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:50
This frame has 3 object(s):
[32, 48) 'callback' (line 53)
[64, 72) 'agg.tmp' <== Memory access at offset 72 overflows this variable
[96, 112) 'agg.tmp18'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow baron/build/../fake-jni/src/jvm/method.cpp:269:45 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int)
Shadow bytes around the buggy address:
0x100027b7a760: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
0x100027b7a770: 00 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 00 f3 f3 f3
0x100027b7a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100027b7a790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100027b7a7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100027b7a7b0: f1 f1 f1 f1 00 00 f2 f2 00[f2]f2 f2 00 00 f3 f3
0x100027b7a7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100027b7a7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100027b7a7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100027b7a7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100027b7a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1603154==ABORTING
When compiling with
-DBUILD_BARON_ASAN=ON, astack-buffer-overflowis detected, however, it doesn't seem to affect execution unless ASAN is enabled.