[llvm-bugs] [Bug 47342] New: Broken fopencookie() seek interceptor on i386

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=47342

            Bug ID: 47342
           Summary: Broken fopencookie() seek interceptor on i386
           Product: compiler-rt
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: asan
          Assignee: unassignedbugs at nondot.org
          Reporter: nikita.ppv at gmail.com
                CC: llvm-bugs at lists.llvm.org

Test case (based on an autoconf test for fopencookie):

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>

struct cookiedata {
    off64_t pos;
};

ssize_t reader(void *cookie, char *buffer, size_t size) {
    return size;
}
ssize_t writer(void *cookie, const char *buffer, size_t size) {
    return size;
}
int closer(void *cookie) {
    return 0;
}
int seeker(void *cookie, off64_t *position, int whence) {
    ((struct cookiedata*)cookie)->pos = *position;
    return 0;
}

cookie_io_functions_t funcs = {reader, writer, seeker, closer};

int main() {
    struct cookiedata g = { 0 };
    FILE *fp = fopencookie(&g, "r", funcs);

    if (fp && fseek(fp, 8192, SEEK_SET) == 0 && g.pos == 8192)
        exit(0);
    exit(1);
}

Compiled using `clang -m32 -g -Wall -fsanitize=address test.c` crashes with the
following trace:

(gdb) bt
#0  0x08109c6d in seeker (cookie=0xffffced0, position=0x2000, whence=0) at
test.c:19
#1  0x080b093a in wrapped_seek(void*, unsigned long long*, int) ()
#2  0xf7db0b53 in ?? () from /lib/i386-linux-gnu/libc.so.6
#3  0xf7ce563f in _IO_file_seekoff () from /lib/i386-linux-gnu/libc.so.6
#4  0xf7ce1769 in fseek () from /lib/i386-linux-gnu/libc.so.6
#5  0x08109e50 in main () at test.c:29

It looks like the function receives the offset rather than a pointer to the
offset.

The implementation of the seek interceptor can be found here:
https://github.com/llvm/llvm-project/blob/6148cca70888ead020a808279043fd013ca72a2a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc#L6332-L6339
>From a cursory look, I don't see anything wrong with it though. It just passes
through the offset pointer.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200828/1a403a6b/attachment-0001.html>