[LLVMbugs] [Bug 19734] New: getgrnam_r interceptor can crash

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=19734

            Bug ID: 19734
           Summary: getgrnam_r interceptor can crash
           Product: compiler-rt
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: compiler-rt
          Assignee: unassignedbugs at nondot.org
          Reporter: davem at iabyn.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

This relates to sanitizer_common_interceptors.inc @r208530.

The interceptor for getgrnam_r() (and possibly others, including getgrid_r())
can crash, because it unpoisons the fields of the struct group even when no
matches have been found.

getgrnam_r(...., &result) is documented to return zero on lack of error (even
including no matches), and to set result to a non-NULL value if a match occurs.
The interceptor only checks for !res and not for result before unpoisoning.

On my system, the fields of grp on no-match happen to point to the last entry
in /etc/group, so this is harmless; on another system (which I don't have
access to)
and which has 'group: compat' in nsswitch.conf (which may or may not be
relevant), the fields of grp on no-match contain garbage. Here's what gdb shows
just after the return from the libc getgrnam_r() call on that system:

$3 = {gr_name = 0xbebebebebebebebe <Address 0xbebebebebebebebe out of bounds>,
  gr_passwd = 0xbebebebebebebebe <Address 0xbebebebebebebebe out of bounds>,
  gr_gid = 3200171710, gr_mem = 0xbebebebebebebebe}

So clearly the getgrnam_r interceptor shouldn't call unpoison_group() (and
possibly some other actions too?) unless result is non-NULL.

Also I think the places where it checks for result being non-null should be
checking *result????

This was originally discovered in the test suite for the perl interpreter;
under ASan on one person's test server, it was consistently crashing when doing
a getgrnam on an unknown name on a perl built using getgrnam_r() (i.e. a
threaded interpreter).

The original thread can be seen here:

http://www.nntp.perl.org/group/perl.perl5.porters/2014/05/msg215176.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20140513/32415561/attachment.html>