https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82164
Bug ID: 82164
Summary: AddressSanitizer: stack-buffer-overflow while
constructing std::regex
Product: gcc
Version: 7.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c++
Assignee: unassigned at gcc dot gnu.org
Reporter: bique.alexandre at gmail dot com
Target Milestone: ---
Hi,
I'd like to report a bug regarding libstdc++ crashing in the regex engine:
Compiling this:
const std::regex kNewLineEscaped("(\\\\r\\\\n)|(\\\\n)|(\\\\r)");
const std::regex kNewLineRaw("[\n\r]+", std::regex::basic |
std::regex::optimize);
const std::regex kTabRaw("[\t]");
const std::regex kComma("[,]");
const std::regex kSlash("[/]");
Will generate the following error at runtime:
==6700==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7ffce71cd978 at pc 0x7f31c9b2402d bp 0x7ffce71cd890 sp
0x7ffce71cd880
WRITE of size 8 at 0x7ffce71cd978 thread T0
#0 0x7f31c9b2402c in _Deque_iterator
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/stl_deque.h:153
#1 0x7f31c9b24b6f in
std::deque<std::__detail::_StateSeq<std::__cxx11::regex_traits<char>
>, std::allocator<std::__detail::_StateSeq<std::__cxx11::regex_traits<char>
> > >::begin()
> > >/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/stl_deque.h:1167
#2 0x7f31c9b24a34 in ~deque
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/stl_deque.h:1045
#3 0x7f31c9ac3554 in ~stack
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/stl_stack.h:99
#4 0x7f31c9ac1824 in _Compiler
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/regex_compiler.tcc:90
#5 0x7f31c9ac112d in
_ZNSt8__detail13__compile_nfaIPKcNSt7__cxx1112regex_traitsIcEEEENSt9enable_ifIXsr27__is_contiguous_normal_iterIT_EE5valueESt10shared_ptrIKNS_4_NFAIT0_EEEE4typeES7_S7_RKNSA_11locale_typeENSt15regex_constants18syntax_option_typeE
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/regex_compiler.h:203
#6 0x7f31c9ac0e33 in basic_regex<const char *>
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/regex.h:768
#7 0x7f31c9ac0986 in basic_regex<const char *>
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/regex.h:512
#8 0x7f31c9abf336 in basic_regex
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/regex.h:445
#9 0x7f31c97606fb in __cxx_global_var_init.6
../../AudioModulesFrame/AM_StdLibExtensions.cpp:11
#10 0x7f31c976084d in _GLOBAL__sub_I_AM_StdLibExtensions.cpp
../../AudioModulesFrame/AM_StdLibExtensions.cpp
#11 0x7f31d0329579 in call_init.part.0 (/lib64/ld-linux-x86-64.so.2+0xf579)
#12 0x7f31d0329685 in _dl_init (/lib64/ld-linux-x86-64.so.2+0xf685)
#13 0x7f31d032db5d in dl_open_worker (/lib64/ld-linux-x86-64.so.2+0x13b5d)
#14 0x7f31ce54beb3 in __GI__dl_catch_error (/usr/lib/libc.so.6+0x131eb3)
#15 0x7f31d032d379 in _dl_open (/lib64/ld-linux-x86-64.so.2+0x13379)
#16 0x7f31cef52e85 (/usr/lib/libdl.so.2+0xe85)
#17 0x7f31ce54beb3 in __GI__dl_catch_error (/usr/lib/libc.so.6+0x131eb3)
#18 0x7f31cef53586 (/usr/lib/libdl.so.2+0x1586)
#19 0x7f31cef52f21 in dlopen (/usr/lib/libdl.so.2+0xf21)
#20 0x7f31cf3abd98 in __interceptor_dlopen
/build/gcc-multilib/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:5364
#21 0x55abc3a21cb7 in Vst2Plugin::loadDLL()
(/home/abique/develop/bitwig/alex-future/target/bin/release/BitwigPluginHost64+0xa8cb7)
#22 0x55abc3a2218e in Vst2PluginApi::loadPlugin(PluginHost*,
base::core::String)
(/home/abique/develop/bitwig/alex-future/target/bin/release/BitwigPluginHost64+0xa918e)
#23 0x55abc39cc7d5 in PluginHost::getPlugin(base::core::String
const&)
(/home/abique/develop/bitwig/alex-future/target/bin/release/BitwigPluginHost64+0x537d5)
#24 0x55abc39d41a1 in writePluginInfo(base::core::String,
base::core::OutputStream*)
(/home/abique/develop/bitwig/alex-future/target/bin/release/BitwigPluginHost64+0x5b1a1)
#25 0x55abc39bb47f in main
(/home/abique/develop/bitwig/alex-future/target/bin/release/BitwigPluginHost64+0x4247f)
#26 0x7f31ce43af69 in __libc_start_main (/usr/lib/libc.so.6+0x20f69)
#27 0x55abc39be9d9 in _start
(/home/abique/develop/bitwig/alex-future/target/bin/release/BitwigPluginHost64+0x459d9)
Address 0x7ffce71cd978 is located in stack of thread T0 at offset 56 in frame
#0 0x7f31c9b2493f in ~deque
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/stl_deque.h:1045
This frame has 2 object(s):
[32, 64) 'agg.tmp' <== Memory access at offset 56 is inside this variable
[96, 128) 'agg.tmp2'
HINT: this may be a false positive if your program uses some custom
stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/7.2.0/../../../../include/c++/7.2.0/bits/stl_deque.h:153
in _Deque_iterator
Shadow bytes around the buggy address:
0x10001ce31ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001ce31ae0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x10001ce31af0: 00 00 00 f2 f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f2
0x10001ce31b00: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x10001ce31b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10001ce31b20: f1 f1 f1 f1 00 00 00 f2 f1 f1 f1 f1 00 00 00[f2]
0x10001ce31b30: f2 f2 f2 f2 00 00 00 f3 f3 f3 f3 f3 00 00 00 00
0x10001ce31b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001ce31b50: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
0x10001ce31b60: 00 00 00 f2 f2 f2 f2 f2 00 00 00 f3 f3 f3 f3 f3
0x10001ce31b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==6700==ABORTING
I am using Archlinux 64 bits, my system is up to date as of 10-09-2017.
I believe that the bug is in the libstdc++/regex, as I could reproduce the
issue with clang 4.0.1.
pacman -Qi gcc-multilib
Name : gcc-multilib
Version : 7.2.0-1
pacman -Qi binutils
Name : binutils
Version : 2.29.0-1
Regards,
Alexandre
