Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Asan complains about zero length string in sprintf #1572

Open
ankurrj7 opened this issue Sep 21, 2022 · 0 comments
Open

Asan complains about zero length string in sprintf #1572

ankurrj7 opened this issue Sep 21, 2022 · 0 comments

Comments

@ankurrj7
Copy link

ankurrj7 commented Sep 21, 2022

Asan complain buffer overflow in this example

#include <stdio.h>
#include<string.h>
#include<stdlib.h>

int main()
{
   char buffer[10];
   char *s = (char*)malloc(8);
   memcpy(s,"abcdefgh",8);
   int j = snprintf(buffer, 4, "%.0s\n", s);
   return 0;
}

==3850459==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000018 at pc 0x7f325e905786 bp 0x7ffd41264150 sp 0x7ffd412638c8
READ of size 9 at 0x602000000018 thread T0
#0 0x7f325e905785 (/lib64/libasan.so.5+0x55785)
#1 0x7f325e907555 in vsnprintf (/lib64/libasan.so.5+0x57555)
#2 0x7f325e90782e in __interceptor_snprintf (/lib64/libasan.so.5+0x5782e)
#3 0x4009ab in main /tmp/sample.c:11
#4 0x7f325e50e492 in __libc_start_main (/lib64/libc.so.6+0x23492)
#5 0x40082d in _start (/tmp/a.out+0x40082d)

0x602000000018 is located 0 bytes to the right of 8-byte region [0x602000000010,0x602000000018)
allocated by thread T0 here:
#0 0x7f325e99fb98 in __interceptor_malloc (/lib64/libasan.so.5+0xefb98)
#1 0x400969 in main /tmp/sample.c:9
#2 0x7f325e50e492 in __libc_start_main (/lib64/libc.so.6+0x23492)

it seems ASAN does not recognises "%.0s" format specifier ?
and it seems to continue reading bytes (and overshoot since there is no null terminator ?)

if i change " int j = snprintf(buffer, 4, "%.0s\n", s);" to int j = snprintf(buffer, 4, "%.1s\n", s);
it works fine

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant