<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Broken fopencookie() seek interceptor on i386"
href="https://bugs.llvm.org/show_bug.cgi?id=47342">47342</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Broken fopencookie() seek interceptor on i386
</td>
</tr>
<tr>
<th>Product</th>
<td>compiler-rt
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>asan
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>nikita.ppv@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Test case (based on an autoconf test for fopencookie):
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
struct cookiedata {
off64_t pos;
};
ssize_t reader(void *cookie, char *buffer, size_t size) {
return size;
}
ssize_t writer(void *cookie, const char *buffer, size_t size) {
return size;
}
int closer(void *cookie) {
return 0;
}
int seeker(void *cookie, off64_t *position, int whence) {
((struct cookiedata*)cookie)->pos = *position;
return 0;
}
cookie_io_functions_t funcs = {reader, writer, seeker, closer};
int main() {
struct cookiedata g = { 0 };
FILE *fp = fopencookie(&g, "r", funcs);
if (fp && fseek(fp, 8192, SEEK_SET) == 0 && g.pos == 8192)
exit(0);
exit(1);
}
Compiled using `clang -m32 -g -Wall -fsanitize=address test.c` crashes with the
following trace:
(gdb) bt
#0 0x08109c6d in seeker (cookie=0xffffced0, position=0x2000, whence=0) at
test.c:19
#1 0x080b093a in wrapped_seek(void*, unsigned long long*, int) ()
#2 0xf7db0b53 in ?? () from /lib/i386-linux-gnu/libc.so.6
#3 0xf7ce563f in _IO_file_seekoff () from /lib/i386-linux-gnu/libc.so.6
#4 0xf7ce1769 in fseek () from /lib/i386-linux-gnu/libc.so.6
#5 0x08109e50 in main () at test.c:29
It looks like the function receives the offset rather than a pointer to the
offset.
The implementation of the seek interceptor can be found here:
<a href="https://github.com/llvm/llvm-project/blob/6148cca70888ead020a808279043fd013ca72a2a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc#L6332-L6339">https://github.com/llvm/llvm-project/blob/6148cca70888ead020a808279043fd013ca72a2a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc#L6332-L6339</a>
>From a cursory look, I don't see anything wrong with it though. It just passes
through the offset pointer.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>