Re: [PATCH 0/7] Fixing all cex leaks
Akim Demaille <[email protected]>
| Newsgroups | gmane.comp.parsers.bison.patches |
|---|---|
| Message-ID | <[email protected]> |
Hi Vincent,
We crash on the Cim grammar (test 545) when enabling cex.
Cheers!
$ lldb -- ./_build/ga/src/bison -Wcou ./_build/ga/tests/testsuite.dir/545/input.y
(lldb) target create "./_build/ga/src/bison"
Current executable set to './_build/ga/src/bison' (x86_64).
(lldb) settings set -- target.run-args "-Wcou" "./_build/ga/tests/testsuite.dir/545/input.y"
(lldb) r
yProcess 50187 launched: '/Users/akim/src/gnu/bison/_build/ga/src/bison' (x86_64)
y=================================================================
==50187==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000746c8 at pc 0x0001000fc840 bp 0x7ffeefbfd160 sp 0x7ffeefbfd158
READ of size 8 at 0x6060000746c8 thread T0
#0 0x1000fc83f in bitset_reset bitset.h:152
#1 0x100102949 in prune_disabled_paths state-item.c:430
#2 0x100104069 in state_items_init state-item.c:509
#3 0x100023ecf in counterexample_init counterexample.c:1133
#4 0x10005d25d in main main.c:149
#5 0x7fff6df8d3d4 in start (libdyld.dylib:x86_64+0x163d4)
0x6060000746c8 is located 8 bytes inside of 56-byte region [0x6060000746c0,0x6060000746f8)
freed by thread T0 here:
#0 0x10046ac0b (libasan.6.dylib:x86_64+0x36c0b)
#1 0x10011c503 in bitset_free bitset.c:174
#2 0x100102334 in disable_state_item state-item.c:387
#3 0x100102ba2 in prune_disabled_paths state-item.c:433
#4 0x100104069 in state_items_init state-item.c:509
#5 0x100023ecf in counterexample_init counterexample.c:1133
#6 0x10005d25d in main main.c:149
#7 0x7fff6df8d3d4 in start (libdyld.dylib:x86_64+0x163d4)
previously allocated by thread T0 here:
#0 0x10046ae9e (libasan.6.dylib:x86_64+0x36e9e)
#1 0x1001624f8 in xcalloc xmalloc.c:112
#2 0x1001624ab in xzalloc xmalloc.c:97
#3 0x10011bfac in bitset_alloc bitset.c:132
#4 0x10011c430 in bitset_create bitset.c:163
#5 0x100100912 in init_prods state-item.c:280
#6 0x10010405a in state_items_init state-item.c:506
#7 0x100023ecf in counterexample_init counterexample.c:1133
#8 0x10005d25d in main main.c:149
#9 0x7fff6df8d3d4 in start (libdyld.dylib:x86_64+0x163d4)
SUMMARY: AddressSanitizer: heap-use-after-free bitset.h:152 in bitset_reset
Shadow bytes around the buggy address:
0x1c0c0000e880: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x1c0c0000e890: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x1c0c0000e8a0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x1c0c0000e8b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x1c0c0000e8c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
=>0x1c0c0000e8d0: 00 00 00 fa fa fa fa fa fd[fd]fd fd fd fd fd fa
0x1c0c0000e8e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x1c0c0000e8f0: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd
0x1c0c0000e900: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x1c0c0000e910: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x1c0c0000e920: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
2020-05-23 11:42:48.783213+0200 bison[50187:48263898] =================================================================
2020-05-23 11:42:48.784274+0200 bison[50187:48263898] ==50187==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000746c8 at pc 0x0001000fc840 bp 0x7ffeefbfd160 sp 0x7ffeefbfd158
2020-05-23 11:42:48.784290+0200 bison[50187:48263898] READ of size 8 at 0x6060000746c8 thread T0
2020-05-23 11:42:48.784299+0200 bison[50187:48263898] #0 0x1000fc83f in bitset_reset bitset.h:152
2020-05-23 11:42:48.784307+0200 bison[50187:48263898] #1 0x100102949 in prune_disabled_paths state-item.c:430
2020-05-23 11:42:48.784315+0200 bison[50187:48263898] #2 0x100104069 in state_items_init state-item.c:509
2020-05-23 11:42:48.784324+0200 bison[50187:48263898] #3 0x100023ecf in counterexample_init counterexample.c:1133
2020-05-23 11:42:48.784332+0200 bison[50187:48263898] #4 0x10005d25d in main main.c:149
2020-05-23 11:42:48.784340+0200 bison[50187:48263898] #5 0x7fff6df8d3d4 in start (libdyld.dylib:x86_64+0x163d4)
2020-05-23 11:42:48.784348+0200 bison[50187:48263898]
2020-05-23 11:42:48.784356+0200 bison[50187:48263898] 0x6060000746c8 is located 8 bytes inside of 56-byte region [0x6060000746c0,0x6060000746f8)
2020-05-23 11:42:48.784366+0200 bison[50187:48263898] freed by thread T0 here:
2020-05-23 11:42:48.784373+0200 bison[50187:48263898] #0 0x10046ac0b (libasan.6.dylib:x86_64+0x36c0b)
2020-05-23 11:42:48.784381+0200 bison[50187:48263898] #1 0x10011c503 in bitset_free bitset.c:174
2020-05-23 11:42:48.784388+0200 bison[50187:48263898] #2 0x100102334 in disable_state_item state-item.c:387
2020-05-23 11:42:48.784396+0200 bison[50187:48263898] #3 0x100102ba2 in prune_disabled_paths state-item.c:433
2020-05-23 11:42:48.784403+0200 bison[50187:48263898] #4 0x100104069 in state_items_init state-item.c:509
2020-05-23 11:42:48.784410+0200 bison[50187:48263898] #5 0x100023ecf in counterexample_init counterexample.c:1133
2020-05-23 11:42:48.784417+0200 bison[50187:48263898] #6 0x10005d25d in main main.c:149
2020-05-23 11:42:48.784427+0200 bison[50187:48263898] #7 0x7fff6df8d3d4 in start (libdyld.dylib:x86_64+0x163d4)
2020-05-23 11:42:48.784434+0200 bison[50187:48263898]
2020-05-23 11:42:48.784440+0200 bison[50187:48263898] previously allocated by thread T0 here:
2020-05-23 11:42:48.784448+0200 bison[50187:48263898] #0 0x10046ae9e (libasan.6.dylib:x86_64+0x36e9e)
2020-05-23 11:42:48.784456+0200 bison[50187:48263898] #1 0x1001624f8 in xcalloc xmalloc.c:112
2020-05-23 11:42:48.784463+0200 bison[50187:48263898] #2 0x1001624ab in xzalloc xmalloc.c:97
2020-05-23 11:42:48.784470+0200 bison[50187:48263898] #3 0x10011bfac in bitset_alloc bitset.c:132
2020-05-23 11:42:48.784478+0200 bison[50187:48263898] #4 0x10011c430 in bitset_create bitset.c:163
2020-05-23 11:42:48.784486+0200 bison[50187:48263898] #5 0x100100912 in init_prods state-item.c:280
2020-05-23 11:42:48.784495+0200 bison[50187:48263898] #6 0x10010405a in state_items_init state-item.c:506
2020-05-23 11:42:48.784503+0200 bison[50187:48263898] #7 0x100023ecf in counterexample_init counterexample.c:1133
2020-05-23 11:42:48.784510+0200 bison[50187:48263898] #8 0x10005d25d in main main.c:149
2020-05-23 11:42:48.784518+0200 bison[50187:48263898] #9 0x7fff6df8d3d4 in start (libdyld.dylib:x86_64+0x163d4)
2020-05-23 11:42:48.784526+0200 bison[50187:48263898]
2020-05-23 11:42:48.784533+0200 bison[50187:48263898] SUMMARY: AddressSanitizer: heap-use-after-free bitset.h:152 in bitset_reset
2020-05-23 11:42:48.784541+0200 bison[50187:48263898] Shadow bytes around the buggy address:
2020-05-23 11:42:48.784548+0200 bison[50187:48263898] 0x1c0c0000e880: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
2020-05-23 11:42:48.784558+0200 bison[50187:48263898] 0x1c0c0000e890: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
2020-05-23 11:42:48.784571+0200 bison[50187:48263898] 0x1c0c0000e8a0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
2020-05-23 11:42:48.784587+0200 bison[50187:48263898] 0x1c0c0000e8b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
2020-05-23 11:42:48.784597+0200 bison[50187:48263898] 0x1c0c0000e8c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
2020-05-23 11:42:48.784606+0200 bison[50187:48263898] =>0x1c0c0000e8d0: 00 00 00 fa fa fa fa fa fd[fd]fd fd fd fd fd fa
2020-05-23 11:42:48.784615+0200 bison[50187:48263898] 0x1c0c0000e8e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
2020-05-23 11:42:48.784623+0200 bison[50187:48263898] 0x1c0c0000e8f0: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd
2020-05-23 11:42:48.784631+0200 bison[50187:48263898] 0x1c0c0000e900: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa
2020-05-23 11:42:48.784643+0200 bison[50187:48263898] 0x1c0c0000e910: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
2020-05-23 11:42:48.784652+0200 bison[50187:48263898] 0x1c0c0000e920: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
2020-05-23 11:42:48.784660+0200 bison[50187:48263898] Shadow byte legend (one shadow byte represents 8 application bytes):
2020-05-23 11:42:48.784671+0200 bison[50187:48263898] Addressable: 00
2020-05-23 11:42:48.784679+0200 bison[50187:48263898] Partially addressable: 01 02 03 04 05 06 07
2020-05-23 11:42:48.784687+0200 bison[50187:48263898] Heap left redzone: fa
2020-05-23 11:42:48.784694+0200 bison[50187:48263898] Freed heap region: fd
2020-05-23 11:42:48.784701+0200 bison[50187:48263898] Stack left redzone: f1
2020-05-23 11:42:48.784708+0200 bison[50187:48263898] Stack mid redzone: f2
2020-05-23 11:42:48.784715+0200 bison[50187:48263898] Stack right redzone: f3
2020-05-23 11:42:48.784721+0200 bison[50187:48263898] Stack after return: f5
2020-05-23 11:42:48.784728+0200 bison[50187:48263898] Stack use after scope: f8
2020-05-23 11:42:48.784737+0200 bison[50187:48263898] Global redzone: f9
2020-05-23 11:42:48.784744+0200 bison[50187:48263898] Global init order: f6
2020-05-23 11:42:48.784750+0200 bison[50187:48263898] Poisoned by user: f7
2020-05-23 11:42:48.784758+0200 bison[50187:48263898] Container overflow: fc
2020-05-23 11:42:48.784765+0200 bison[50187:48263898] Array cookie: ac
2020-05-23 11:42:48.784772+0200 bison[50187:48263898] Intra object redzone: bb
2020-05-23 11:42:48.784780+0200 bison[50187:48263898] ASan internal: fe
2020-05-23 11:42:48.784788+0200 bison[50187:48263898] Left alloca redzone: ca
2020-05-23 11:42:48.784795+0200 bison[50187:48263898] Right alloca redzone: cb
2020-05-23 11:42:48.784802+0200 bison[50187:48263898] Shadow gap: cc
==50187==ABORTING
Process 50187 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
frame #0: 0x00007fff6e0c82c2 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`__pthread_kill:
-> 0x7fff6e0c82c2 <+10>: jae 0x7fff6e0c82cc ; <+20>
0x7fff6e0c82c4 <+12>: movq %rax, %rdi
0x7fff6e0c82c7 <+15>: jmp 0x7fff6e0c2453 ; cerror_nocancel
0x7fff6e0c82cc <+20>: retq
Target 0: (bison) stopped.
Cheers!