Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix crash in NamedPipeCommands.cpp caused by stack-buffer-underflow #36465

Merged
merged 2 commits into from
Nov 15, 2024
Merged

Fix crash in NamedPipeCommands.cpp caused by stack-buffer-underflow #36465

merged 2 commits into from
Nov 15, 2024

Conversation

BoB13-Matter
Copy link
Contributor

Description

  • Running the chip-all-clusters-app example can result in a stack-buffer-underflow error when handling named pipes in NamedPipeCommands.cpp. The underflow occurs at NamedPipeCommands.cpp:85 by writing to readbuf[readBytes - 1] without checking if readBytes is zero. This leads to accessing memory out of bounds and can potentially crash the application.

Changes

  • Added a condition to verify readBytes is greater than zero before writing to readbuf[readBytes - 1]. This prevents stack-buffer-underflow by ensuring the code only accesses valid indices within readbuf.

Reproducing

To reproduce:

$ '' > /tmp/chip_all_clusters_fifo_12142

Expected error message before the fix:

../../examples/all-clusters-app/linux/third_party/connectedhomeip/examples/platform/linux/NamedPipeCommands.cpp:85:9: runtime error: index -1 out of bounds for type 'char[256]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../examples/all-clusters-app/linux/third_party/connectedhomeip/examples/platform/linux/NamedPipeCommands.cpp:85:9 
=================================================================
==12142==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7d0ff8f0901f at pc 0x6217ac4c01cf bp 0x7d0ff9fffad0 sp 0x7d0ff9fffac8
WRITE of size 1 at 0x7d0ff8f0901f thread T2
    #0 0x6217ac4c01ce  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x13171ce) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #1 0x6217ac2aee1c  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x1105e1c) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #2 0x6217ac214016  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x106b016) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #3 0x6217ac2a87cf  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x10ff7cf) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #4 0x6217ac2abe06  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x1102e06) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #5 0x6217ac2ace68  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x1103e68) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)

Address 0x7d0ff8f0901f is located in stack of thread T2 at offset 31 in frame
    #0 0x6217ac4bfb87  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x1316b87) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
  
  This frame has 1 object(s):
    [32, 288) 'readbuf' (line 71) <== Memory access at offset 31 underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Thread T2 created by T0 here:
    #0 0x6217ac2897b1  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x10e07b1) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #1 0x6217ac4bf152  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x1316152) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #2 0x6217ac47a9f0  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x12d19f0) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #3 0x6217ac488e89  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x12dfe89) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #4 0x6217ac2dd243  (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x1134243) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda)
    #5 0x7d0ffea29d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 490fef8403240c91833978d494d39e537409b92e)

SUMMARY: AddressSanitizer: stack-buffer-underflow (/home/beom/Desktop/connectedhomeip/out/linux-x64-all-clusters-asan-ubsan-clang/chip-all-clusters-app+0x13171ce) (BuildId: bad9472b693d466f1f24620bf834cbc228a1cfda) 
Shadow bytes around the buggy address:
  0x7d0ff8f08d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f08e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f08e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f08f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f08f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7d0ff8f09000: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f09080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f09100: 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00
  0x7d0ff8f09180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f09200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0ff8f09280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12142==ABORTING

@semanticdiff-com SemanticDiff.com
Copy link

Review changes with  SemanticDiff

@github-actions GitHub Actions
Copy link

github-actions bot commented Nov 12, 2024 •
edited
Loading

PR #36465: Size comparison from aba2383 to db94b60

Full report (68 builds for bl602, bl702, bl702l, cc13x4_26x4, cc32xx, cyw30739, efr32, esp32, linux, nrfconnect, nxp, psoc6, qpg, stm32, telink, tizen)
platform target config section aba2383 db94b60 change % change
bl602 lighting-app bl602+mfd+littlefs+rpc FLASH 1349446 1349448 2 0.0
RAM 104080 104080 0 0.0
bl702 lighting-app bl702+eth FLASH 649346 649346 0 0.0
RAM 25313 25313 0 0.0
bl702+wifi FLASH 826926 826926 0 0.0
RAM 14053 14053 0 0.0
bl706+mfd+rpc+littlefs FLASH 1055122 1055124 2 0.0
RAM 23893 23893 0 0.0
bl702l lighting-app bl702l+mfd+littlefs FLASH 976484 976486 2 0.0
RAM 16556 16556 0 0.0
cc13x4_26x4 lighting-app LP_EM_CC1354P10_6 FLASH 837852 837852 0 0.0
RAM 123632 123632 0 0.0
lock-ftd LP_EM_CC1354P10_6 FLASH 823768 823768 0 0.0
RAM 125520 125520 0 0.0
pump-app LP_EM_CC1354P10_6 FLASH 770492 770492 0 0.0
RAM 113988 113988 0 0.0
pump-controller-app LP_EM_CC1354P10_6 FLASH 754704 754704 0 0.0
RAM 114196 114196 0 0.0
cc32xx air-purifier CC3235SF_LAUNCHXL FLASH 625930 625930 0 0.0
RAM 205784 205784 0 0.0
lock CC3235SF_LAUNCHXL FLASH 667242 667242 0 0.0
RAM 205936 205936 0 0.0
cyw30739 light CYW30739B2-P5-EVK-01 unknown 2040 2040 0 0.0
FLASH 679489 679489 0 0.0
RAM 78692 78692 0 0.0
CYW30739B2-P5-EVK-02 unknown 2040 2040 0 0.0
FLASH 699341 699341 0 0.0
RAM 81324 81324 0 0.0
CYW30739B2-P5-EVK-03 unknown 2040 2040 0 0.0
FLASH 699341 699341 0 0.0
RAM 81324 81324 0 0.0
CYW930739M2EVB-02 unknown 2040 2040 0 0.0
FLASH 656277 656277 0 0.0
RAM 73760 73760 0 0.0
light-switch CYW30739B2-P5-EVK-01 unknown 2040 2040 0 0.0
FLASH 616345 616345 0 0.0
RAM 71644 71644 0 0.0
CYW30739B2-P5-EVK-02 unknown 2040 2040 0 0.0
FLASH 635973 635973 0 0.0
RAM 74196 74196 0 0.0
CYW30739B2-P5-EVK-03 unknown 2040 2040 0 0.0
FLASH 635973 635973 0 0.0
RAM 74196 74196 0 0.0
lock CYW30739B2-P5-EVK-01 unknown 2040 2040 0 0.0
FLASH 635801 635801 0 0.0
RAM 74692 74692 0 0.0
CYW30739B2-P5-EVK-02 unknown 2040 2040 0 0.0
FLASH 655517 655517 0 0.0
RAM 77244 77244 0 0.0
CYW30739B2-P5-EVK-03 unknown 2040 2040 0 0.0
FLASH 655517 655517 0 0.0
RAM 77244 77244 0 0.0
thermostat CYW30739B2-P5-EVK-01 unknown 2040 2040 0 0.0
FLASH 611197 611197 0 0.0
RAM 68780 68780 0 0.0
CYW30739B2-P5-EVK-02 unknown 2040 2040 0 0.0
FLASH 631049 631049 0 0.0
RAM 71412 71412 0 0.0
CYW30739B2-P5-EVK-03 unknown 2040 2040 0 0.0
FLASH 631049 631049 0 0.0
RAM 71412 71412 0 0.0
efr32 lock-app BRD4187C FLASH 927596 927596 0 0.0
RAM 160164 160164 0 0.0
BRD4338a FLASH 743712 743712 0 0.0
RAM 233296 233296 0 0.0
window-app BRD4187C FLASH 1018816 1018808 -8 -0.0
RAM 128264 128264 0 0.0
esp32 all-clusters-app c3devkit DRAM 95336 95336 0 0.0
FLASH 1540460 1540460 0 0.0
IRAM 82542 82542 0 0.0
m5stack DRAM 116264 116264 0 0.0
FLASH 1549306 1549306 0 0.0
IRAM 117039 117039 0 0.0
linux air-purifier-app debug unknown 4712 4712 0 0.0
FLASH 2699169 2699169 0 0.0
RAM 129696 129696 0 0.0
all-clusters-app debug unknown 5552 5552 0 0.0
FLASH 5992866 5992876 10 0.0
RAM 524000 524000 0 0.0
all-clusters-minimal-app debug unknown 5448 5448 0 0.0
FLASH 5328474 5328474 0 0.0
RAM 242512 242512 0 0.0
bridge-app debug unknown 5432 5432 0 0.0
FLASH 4671244 4671244 0 0.0
RAM 218432 218432 0 0.0
chip-tool debug unknown 5984 5984 0 0.0
FLASH 12872238 12872238 0 0.0
RAM 584466 584466 0 0.0
chip-tool-ipv6only arm64 unknown 21400 21400 0 0.0
FLASH 11002768 11002768 0 0.0
RAM 635368 635368 0 0.0
fabric-admin debug unknown 5808 5808 0 0.0
FLASH 11277331 11277331 0 0.0
RAM 584818 584818 0 0.0
fabric-bridge-app debug unknown 4688 4688 0 0.0
FLASH 4495514 4495514 0 0.0
RAM 205408 205408 0 0.0
fabric-sync debug unknown 4896 4896 0 0.0
FLASH 5309989 5309989 0 0.0
RAM 466920 466920 0 0.0
lighting-app debug+rpc+ui unknown 6096 6096 0 0.0
FLASH 5607169 5607185 16 0.0
RAM 228600 228600 0 0.0
lock-app debug unknown 5368 5368 0 0.0
FLASH 4720718 4720728 10 0.0
RAM 204600 204600 0 0.0
ota-provider-app debug unknown 4744 4744 0 0.0
FLASH 4346150 4346150 0 0.0
RAM 198272 198272 0 0.0
ota-requestor-app debug unknown 4680 4680 0 0.0
FLASH 4484552 4484552 0 0.0
RAM 202856 202856 0 0.0
shell debug unknown 4240 4240 0 0.0
FLASH 3011565 3011565 0 0.0
RAM 160344 160344 0 0.0
thermostat-no-ble arm64 unknown 9464 9464 0 0.0
FLASH 4090256 4090256 0 0.0
RAM 242984 242984 0 0.0
tv-app debug unknown 5664 5664 0 0.0
FLASH 5943941 5943941 0 0.0
RAM 596368 596368 0 0.0
tv-casting-app debug unknown 5232 5232 0 0.0
FLASH 11079677 11079677 0 0.0
RAM 694568 694568 0 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 FLASH 915332 915332 0 0.0
RAM 143289 143289 0 0.0
nrf7002dk_nrf5340_cpuapp FLASH 887596 887596 0 0.0
RAM 141476 141476 0 0.0
all-clusters-minimal-app nrf52840dk_nrf52840 FLASH 847588 847588 0 0.0
RAM 142197 142197 0 0.0
nxp contact k32w0+release FLASH 584128 584128 0 0.0
RAM 71048 71048 0 0.0
mcxw71+release FLASH 598664 598664 0 0.0
RAM 63144 63144 0 0.0
light k32w0+release FLASH 611172 611172 0 0.0
RAM 70440 70440 0 0.0
k32w1+release FLASH 684976 684976 0 0.0
RAM 48776 48776 0 0.0
lock mcxw71+release FLASH 748512 748512 0 0.0
RAM 67300 67300 0 0.0
psoc6 all-clusters cy8ckit_062s2_43012 FLASH 1642980 1642980 0 0.0
RAM 212064 212064 0 0.0
all-clusters-minimal cy8ckit_062s2_43012 FLASH 1550196 1550196 0 0.0
RAM 208864 208864 0 0.0
light cy8ckit_062s2_43012 FLASH 1466620 1466620 0 0.0
RAM 200848 200848 0 0.0
lock cy8ckit_062s2_43012 FLASH 1464796 1464796 0 0.0
RAM 225208 225208 0 0.0
qpg lighting-app qpg6105+debug FLASH 662144 662144 0 0.0
RAM 105384 105384 0 0.0
lock-app qpg6105+debug FLASH 620244 620244 0 0.0
RAM 99836 99836 0 0.0
stm32 light STM32WB5MM-DK FLASH 482944 482944 0 0.0
RAM 144848 144848 0 0.0
telink bridge-app tlsr9258a FLASH 684686 684686 0 0.0
RAM 91536 91536 0 0.0
contact-sensor-app tlsr9528a_retention FLASH 622694 622694 0 0.0
RAM 50472 50472 0 0.0
light-switch-app-ota-compress-lzma-shell-factory-data tlsr9528a FLASH 710624 710624 0 0.0
RAM 73812 73812 0 0.0
lighting-app-ota-factory-data tlsr9118bdk40d FLASH 628992 628992 0 0.0
RAM 145392 145392 0 0.0
lighting-app-ota-rpc-factory-data-4mb tlsr9518adk80d FLASH 814880 814880 0 0.0
RAM 100012 100012 0 0.0
tizen all-clusters-app arm unknown 4956 4956 0 0.0
FLASH 1722680 1722680 0 0.0
RAM 90660 90660 0 0.0
chip-tool-ubsan arm unknown 10832 10832 0 0.0
FLASH 18006302 18006302 0 0.0
RAM 7857036 7857036 0 0.0

@mergify mergify bot merged commit d73c821 into project-chip:master Nov 15, 2024
67 checks passed
yyzhong-g pushed a commit to yyzhong-g/connectedhomeip that referenced this pull request Dec 12, 2024
@BoB13-Matter @yyzhong-g
Fix crash in NamedPipeCommands.cpp caused by stack-buffer-underflow (p…
d99c089 
…roject-chip#36465)

* Fix stack-buffer-underflow in NamedPipeCommands.cpp

* Update NamedPipeCommands.cpp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andy31415 andy31415 andy31415 approved these changes

Assignees
No one assigned
Labels
examples fast track linux platform review - pending
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@BoB13-Matter @andy31415