forked from lix-project/lix
jade
b9b1bbd22f
Found by looking for interesting asan reports from the test suite.
What happened here is that name got overwritten, but it was what
actually held the backing memory for the thing it got overwritten by,
which was a by-reference value coming out of std::regex.
Due to absurd reasons I cannot seem to use a string_view iterator here,
so I just copy the string with a longer lifetime instead. idk lol
==3796364==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000014c61 at pc 0x74843523bf1d bp 0x7ffc68351330 sp 0x7ffc68350af0
READ of size 3 at 0x503000014c61 thread T0
0 0x74843523bf1c in __asan_memcpy (/nix/store/mzhqknx2mc94jdz4n320hn1lml86398y-clang-wrapper-17.0.6/resource-root/lib/linux/libclang_rt.asan-x86_64.so+0x159f1c)
1 0x6403cf6cbff4 in std::char_traits<char>::copy(char*, char const*, unsigned long) /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/char_traits.h:445:33
<...>
7 0x6403cf6cbff4 in std::__cxx11::sub_match<__gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>::str() const /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/regex.h:966:6
8 0x6403cf6cbff4 in std::__cxx11::sub_match<__gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>::operator std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>() const /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/regex.h:955:16
9 0x6403cf6cbff4 in nix::getClosureInfo[abi:cxx11](nix::ref<nix::Store>, nix::StorePath const&) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:37:26
10 0x6403cf6cd70c in nix::printClosureDiff(nix::ref<nix::Store>, nix::StorePath const&, nix::StorePath const&, std::basic_string_view<char, std::char_traits<char>>) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:54:25
11 0x6403cf873331 in CmdProfileDiffClosures::run(nix::ref<nix::Store>) /home/jade/lix/lix2/build/src/nix/profile.cc:479:17
<...>
0x503000014c61 is located 17 bytes inside of 21-byte region [0x503000014c50,0x503000014c65)
freed by thread T0 here:
0 0x748435250470 in operator delete(void*) (/nix/store/mzhqknx2mc94jdz4n320hn1lml86398y-clang-wrapper-17.0.6/resource-root/lib/linux/libclang_rt.asan-x86_64.so+0x16e470)
<...>
6 0x6403cf6cbda2 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::~basic_string() /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/basic_string.h:792:9
7 0x6403cf6cbda2 in nix::getClosureInfo[abi:cxx11](nix::ref<nix::Store>, nix::StorePath const&) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:36:13
8 0x6403cf6cd70c in nix::printClosureDiff(nix::ref<nix::Store>, nix::StorePath const&, nix::StorePath const&, std::basic_string_view<char, std::char_traits<char>>) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:54:25
<...>
previously allocated by thread T0 here:
0 0x74843524fa38 in operator new(unsigned long) (/nix/store/mzhqknx2mc94jdz4n320hn1lml86398y-clang-wrapper-17.0.6/resource-root/lib/linux/libclang_rt.asan-x86_64.so+0x16da38)
<...>
9 0x6403cf6cb68c in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::basic_string<std::basic_string_view<char, std::char_traits<char>>, void>(std::basic_string_view<char, std::char_traits<char>> const&, std::allocator<char> const&) /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/basic_string.h:784:4
10 0x6403cf6cb68c in nix::getClosureInfo[abi:cxx11](nix::ref<nix::Store>, nix::StorePath const&) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:33:21
11 0x6403cf6cd70c in nix::printClosureDiff(nix::ref<nix::Store>, nix::StorePath const&, nix::StorePath const&, std::basic_string_view<char, std::char_traits<char>>) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:54:25
12 0x6403cf873331 in CmdProfileDiffClosures::run(nix::ref<nix::Store>) /home/jade/lix/lix2/build/src/nix/profile.cc:479:17
<...>
Change-Id:
|
||
|---|---|---|
| .. | ||
| realisation | ||
| add-file.md | ||
| add-path.md | ||
| add-to-store.cc | ||
| app.cc | ||
| build.cc | ||
| build.md | ||
| bundle.cc | ||
| bundle.md | ||
| cat.cc | ||
| config.cc | ||
| copy.cc | ||
| copy.md | ||
| daemon.cc | ||
| daemon.md | ||
| derivation-add.cc | ||
| derivation-add.md | ||
| derivation-show.cc | ||
| derivation-show.md | ||
| derivation.cc | ||
| develop.cc | ||
| develop.md | ||
| diff-closures.cc | ||
| diff-closures.md | ||
| doctor.cc | ||
| dump-path.cc | ||
| edit.cc | ||
| edit.md | ||
| eval.cc | ||
| eval.md | ||
| flake-archive.md | ||
| flake-check.md | ||
| flake-clone.md | ||
| flake-init.md | ||
| flake-lock.md | ||
| flake-metadata.md | ||
| flake-new.md | ||
| flake-prefetch.md | ||
| flake-show.md | ||
| flake-update.md | ||
| flake.cc | ||
| flake.md | ||
| fmt.cc | ||
| fmt.md | ||
| get-env.sh | ||
| hash.cc | ||
| help-stores.md | ||
| help.md | ||
| key-convert-secret-to-public.md | ||
| key-generate-secret.md | ||
| log.cc | ||
| log.md | ||
| ls.cc | ||
| main.cc | ||
| make-content-addressed.cc | ||
| make-content-addressed.md | ||
| meson.build | ||
| nar-cat.md | ||
| nar-dump-path.md | ||
| nar-ls.md | ||
| nar.cc | ||
| nar.md | ||
| nix.md | ||
| optimise-store.cc | ||
| optimise-store.md | ||
| path-from-hash-part.cc | ||
| path-from-hash-part.md | ||
| path-info.cc | ||
| path-info.md | ||
| ping-store.cc | ||
| ping-store.md | ||
| prefetch.cc | ||
| print-dev-env.md | ||
| profile-diff-closures.md | ||
| profile-history.md | ||
| profile-install.md | ||
| profile-list.md | ||
| profile-remove.md | ||
| profile-rollback.md | ||
| profile-upgrade.md | ||
| profile-wipe-history.md | ||
| profile.cc | ||
| profile.md | ||
| realisation.cc | ||
| registry-add.md | ||
| registry-list.md | ||
| registry-pin.md | ||
| registry-remove.md | ||
| registry.cc | ||
| registry.md | ||
| repl.cc | ||
| repl.md | ||
| run.cc | ||
| run.hh | ||
| run.md | ||
| search.cc | ||
| search.md | ||
| shell.md | ||
| sigs.cc | ||
| store-cat.md | ||
| store-copy-log.cc | ||
| store-copy-log.md | ||
| store-delete.cc | ||
| store-delete.md | ||
| store-dump-path.md | ||
| store-gc.cc | ||
| store-gc.md | ||
| store-ls.md | ||
| store-prefetch-file.md | ||
| store-repair.cc | ||
| store-repair.md | ||
| store.cc | ||
| upgrade-nix.cc | ||
| upgrade-nix.md | ||
| verify.cc | ||
| verify.md | ||
| why-depends.cc | ||
| why-depends.md | ||