Skip to content

Investigate potential stack-buffer-overflow #5

Description

@Matthewacon

When compiling with -DBUILD_BARON_ASAN=ON, a stack-buffer-overflow is detected, however, it doesn't seem to affect execution unless ASAN is enabled.

╰─❱ ./probe            
DEBUG: './libjni.so' uses dynamic JNI linkage
DEBUG: './libjni.so' contains no Agent linkage
DEBUG: [./libjni.so]::JNI_OnLoad -> 0x7fd666c822e0
DEBUG: [./libjni.so]::JNI_OnUnload -> 0x7fd666c827e0
DEBUG: Created library: './libjni.so'
DEBUG: [./libjni.so]::JNI_OnLoad
EXAMPLE AGENT: JNI_OnLoad!
DEBUG: JNIInvokeInterface_::GetEnv
DEBUG: JNINativeInterface_::FindClass
BARON INFO: Fabricated class 'yo_this is not a valid class name_' -> 0x613000000040
DEBUG: JNINativeInterface_::GetMethodID
=================================================================
==1603154==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd3dc13dc8 at pc 0x7fd669f29533 bp 0x7ffd3dc13b30 sp 0x7ffd3dc13b28
READ of size 1 at 0x7ffd3dc13dc8 thread T0
    #0 0x7fd669f29532 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int) baron/build/../fake-jni/src/jvm/method.cpp:269:45
    #1 0x7fd66a0c356e in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:56:14
    #2 0x7fd669e7ca7e in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::operator()(JNIEnv_*, _jclass*, char const*, char const*) const baron/build/../fake-jni/src/jni/native/native.cpp:159:15
    #3 0x7fd669e7c80c in FakeJni::NativeInterface::NativeInterface(FakeJni::Jvm const&)::$_28::__invoke(JNIEnv_*, _jclass*, char const*, char const*) baron/build/../fake-jni/src/jni/native/native.cpp:156:17
    #4 0x7fd666c829fb in JNIEnv_::GetMethodID(_jclass*, char const*, char const*) baron/build/../example/jni/include/jni.h:903:16
    #5 0x7fd666c824c8 in JNI_OnLoad baron/build/../example/jni/src/jni.cpp:23:26
    #6 0x7fd669e46464 in FakeJni::Library::jniLoad() const baron/build/../fake-jni/src/internal/library.cpp:189:11
    #7 0x7fd669ef343c in FakeJni::Jvm::attachLibrary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, FakeJni::LibraryOptions) baron/build/../fake-jni/src/jvm/jvm.cpp:371:19
    #8 0x5639bf227bfa in main baron/build/../example/probe/src/main.cpp:11:5
    #9 0x7fd669857022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)
    #10 0x5639bf14e28d in _start (baron/build/example/probe+0x2428d)

Address 0x7ffd3dc13dc8 is located in stack of thread T0 at offset 72 in frame
    #0 0x7fd66a0c2edf in Baron::Interface::NativeInterface::getMethodID(_jclass*, char const*, char const*) const baron/build/../src/impl/interface/native/method.cpp:50

  This frame has 3 object(s):
    [32, 48) 'callback' (line 53)
    [64, 72) 'agg.tmp' <== Memory access at offset 72 overflows this variable
    [96, 112) 'agg.tmp18'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow baron/build/../fake-jni/src/jvm/method.cpp:269:45 in FakeJni::JMethodID::JMethodID(CX::Lambda<jvalue (JNIEnv_*, _jobject*, jvalue*), true>, char const*, char const*, unsigned int)
Shadow bytes around the buggy address:
  0x100027b7a760: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
  0x100027b7a770: 00 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 00 f3 f3 f3
  0x100027b7a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100027b7a7b0: f1 f1 f1 f1 00 00 f2 f2 00[f2]f2 f2 00 00 f3 f3
  0x100027b7a7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100027b7a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1603154==ABORTING

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingpreventativePrevent future issues

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions