Global Buffer Overflow error

Hello,

when mruby compiles this file i get an error when running mrbtest, at least i believe this is causing the error since the offending code is using the symbols i created here.

```ruby
class IO::Uring
  class << self
    attr_accessor :default_io_uring
  end

  module UringSocketBase
    def recv_nonblock
      raise NotImplementedError
    end
    def recvfrom
      raise NotImplementedError
    end
  end

  module ClientSocketMethods
    include UringSocketBase

    def connect(addrinfo, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_connect(self, addrinfo, sqe_flags, &block)
    end

    def send(buf, flags = 0, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_send(self, buf, flags, sqe_flags, &block)
    end

    def recv(maxlen = 0, flags = 0, &block)
      IO::Uring.default_io_uring.prep_recv(self, maxlen, flags, &block)
    end
  end

  module ServerSocketMethods
    include UringSocketBase

    def bind(addrinfo, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_bind(self, addrinfo, sqe_flags, &block)
    end

    def listen(backlog = SOMAXCONN, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_listen(self, backlog, sqe_flags, &block)
    end

    def accept(flags = 0, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_accept(self, flags, sqe_flags, &block)
    end

    def multishot_accept(flags = 0, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_multishot_accept(self, flags, sqe_flags, &block)
    end

    def sysaccept
      raise NotImplementedError
    end
  end

  module UDPSocketMethods
    include ClientSocketMethods

    def bind(addrinfo, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_bind(self, addrinfo, sqe_flags, &block)
    end
  end

  module UringFileMethods
    def read(nbytes = 0, offset = 0, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_read(self, nbytes, offset, sqe_flags, &block)
    end

    def read_fixed(offset = 0, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_read_fixed(self, offset, sqe_flags, &block)
    end

    def write(buf, offset = 0, sqe_flags = 0, &block)
      IO::Uring.default_io_uring.prep_write(self, buf, offset, sqe_flags, &block)
    end
  end

  class File < ::File
    def initialize(fd_or_path, mode = nil, perm = -1, resolve = nil, sqe_flags = 0, &block)
      if fd_or_path.kind_of? Integer
        super(fd_or_path, mode)
      else
        @path = fd_or_path
        open_how = OpenHow.new(mode, perm, resolve)
        IO::Uring.default_io_uring.prep_openat2(fd_or_path, nil, open_how, sqe_flags) do |op|
          raise op.errno if op.errno
          super(op.fileno, op.open_how.flags)
          block.call(self) if block
        end
      end
    end
    include UringFileMethods
  end

  class TCPSocket < ::TCPSocket
    include ClientSocketMethods
  end

  class UNIXSocket < ::UNIXSocket
    include ClientSocketMethods
  end

  class TCPServer < ::TCPServer
    include ServerSocketMethods
  end

  class UNIXServer < ::UNIXServer
    include ServerSocketMethods
  end

  class UDPSocket < ::UDPSocket
    include UDPSocketMethods
  end

  class Socket < ::Socket
    include UringSocketBase
    include ClientSocketMethods
    include ServerSocketMethods
  end
end
```
```console
=================================================================
==49487==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5556125d175e at pc 0x5556121530c4 bp 0x7fffe9cfb7b0 sp 0x7fffe9cfb7c8
READ of size 1 at 0x5556125d175e thread T0
    #0 0x5556121530c0 in mrb_vm_exec /home/hendrik/code/totally-normal-keyboard/mruby/src/vm.c:1694
    #1 0x5556121a39b4 in mrb_vm_run /home/hendrik/code/totally-normal-keyboard/mruby/src/vm.c:1587
    #2 0x5556121ab63c in mrb_top_run /home/hendrik/code/totally-normal-keyboard/mruby/src/vm.c:3399
    #3 0x555612366ea8 in mrb_load_proc /home/hendrik/code/totally-normal-keyboard/mruby/src/load.c:714
    #4 0x5556123aeeb8 in GENERATED_TMP_mrb_mruby_io_uring_gem_init /home/hendrik/code/totally-normal-keyboard/mruby/build/debug/mrbgems/mruby-io-uring/gem_init.c:1014
    #5 0x555612313874 in mrb_init_mrbgems /home/hendrik/code/totally-normal-keyboard/mruby/build/debug/mrbgems/gem_init.c:201
    #6 0x555612118e70 in init_mrbgems /home/hendrik/code/totally-normal-keyboard/mruby/src/state.c:67
    #7 0x5556120e3dd8 in mrb_core_init_protect /home/hendrik/code/totally-normal-keyboard/mruby/src/error.c:741
    #8 0x55561211a334 in mrb_open /home/hendrik/code/totally-normal-keyboard/mruby/src/state.c:82
    #9 0x5556120afe00 in main /home/hendrik/code/totally-normal-keyboard/tools/tnk/tnk.c:624
    #10 0x7fffb8b72298 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7fffb8b72378 in __libc_start_main_impl ../csu/libc-start.c:360
    #12 0x5556120a872c in _start (/usr/local/sbin/tnk-debug+0x66872c) (BuildId: 7e3f094b0ec9347e239b74eeae458601e5fee9a4)

0x5556125d175e is located 34 bytes before global variable 'gem_mrblib_mruby_io_uring_proc_syms_1' defined in '/home/hendrik/code/totally-normal-keyboard/mruby/build/debug/mrbgems/mruby-io-uring/gem_init.c:611:1' (0x5556125d1780) of size 48
0x5556125d175e is located 0 bytes after global variable 'gem_mrblib_mruby_io_uring_proc_iseq_1' defined in '/home/hendrik/code/totally-normal-keyboard/mruby/build/debug/mrbgems/mruby-io-uring/gem_init.c:612:23' (0x5556125d16e0) of size 126
SUMMARY: AddressSanitizer: global-buffer-overflow /home/hendrik/code/totally-normal-keyboard/mruby/src/vm.c:1694 in mrb_vm_exec
Shadow bytes around the buggy address:
  0x5556125d1480: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 05 f9 f9 f9
  0x5556125d1500: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 07 f9
  0x5556125d1580: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
  0x5556125d1600: f9 f9 f9 f9 00 07 f9 f9 f9 f9 f9 f9 00 00 f9 f9
  0x5556125d1680: f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 00 00 00 00
=>0x5556125d1700: 00 00 00 00 00 00 00 00 00 00 00[06]f9 f9 f9 f9
  0x5556125d1780: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
  0x5556125d1800: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 f9 f9
  0x5556125d1880: f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9 00 01 f9 f9
  0x5556125d1900: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
  0x5556125d1980: f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==49487==ABORTING
```
this happens in mrb_open, the offending code is this here in gem_init.c
```c
mrb_DEFINE_SYMS_VAR(gem_mrblib_mruby_io_uring_proc_syms_1, 12, (MRB_SYM(UringSocketBase), MRB_SYM(ClientSocketMethods), MRB_SYM(ServerSocketMethods), MRB_SYM(UDPSocketMethods), MRB_SYM(UringFileMethods), MRB_SYM(File), MRB_SYM(TCPSocket), MRB_SYM(UNIXSocket), MRB_SYM(TCPServer), MRB_SYM(UNIXServer), MRB_SYM(UDPSocket), MRB_SYM(Socket), ), const);
static const mrb_code gem_mrblib_mruby_io_uring_proc_iseq_1[126] = {
```

mruby commit: https://github.com/mruby/mruby/commit/01091984e76bdd0f01cf1b025d1824613a1aebf3

Navigation Menu

Uh oh!

Global Buffer Overflow error #6635

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Global Buffer Overflow error #6635

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions