You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
The coverage test coverage-shared-errors-testrunner seg faults on a build for ARM/Linux. The seg fault happens in function OS_GetErrorName at this line.
*err_name[sizeof(*err_name) - 1] = 0;
Here err_name is a pointer to a char array. The order of operations for C indicates that the array subscripting [] will be evaluated before the pointer dereferecing *. This results in dereferencing a value outside of the char array defined in the coverage test for OS_GetErrorName.
I believe the syntax should be '(*err_name)[sizeof(*err_name) - 1] = 0; to ensure the pointer is dereferenced before the array subscripting. Making this change fixes the seg fault on my system.
To Reproduce
Run the coverage-shared-errors-testrunner coverage test.
Expected behavior
The test passes and does not seg fault.
System observed on:
ARM Cortex A9
Linux
Versions Draco-RC4
The text was updated successfully, but these errors were encountered:
./coverage-shared-errors-testrunner -d
[BEGIN] UNIT TEST
[BEGIN] 01 SETUP
[ END] No test cases
[BEGIN] 01 OS_GetErrorName
[DEBUG] utstubs.c:925:OCS_strncpy called (DEFAULT,0)
Segmentation fault (core dumped)
Here is the Godbolt compiler explorer showing the Assembly for this line as is. Note the 1190 offset which is well past the end of the char array. It thinks each array element size is 35 bytes. 34 * 35 = 1190.
Describe the bug
The coverage test
coverage-shared-errors-testrunner
seg faults on a build for ARM/Linux. The seg fault happens in functionOS_GetErrorName
at this line.Here
err_name
is a pointer to a char array. The order of operations for C indicates that the array subscripting[]
will be evaluated before the pointer dereferecing*
. This results in dereferencing a value outside of the char array defined in the coverage test for OS_GetErrorName.I believe the syntax should be '
(*err_name)[sizeof(*err_name) - 1] = 0;
to ensure the pointer is dereferenced before the array subscripting. Making this change fixes the seg fault on my system.To Reproduce
Run the coverage-shared-errors-testrunner coverage test.
Expected behavior
The test passes and does not seg fault.
System observed on:
The text was updated successfully, but these errors were encountered: