Нужна лекция про поиск undefined behaviour и прочего

[andrewshadura]

Параметры компиляции:

• hardening
• -fsanitize=address, -fsanitize=undefined, -fsanitize=leak и прочее

Тулы:

• valgrind
• afl++
• всякие линтеры (splint etc)

Пример:

==7637==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffce1cb82b0 at pc 0x55a8cebccfc4 bp 0x7ffce1cb7f30 sp 0x7ffce1cb7f20
READ of size 8 at 0x7ffce1cb82b0 thread T0
    #0 0x55a8cebccfc3 in cms_to_buf ../../code/back_end/src/adapt_layer_openssl.c:371
    #1 0x55a8cebce555 in gen_sig_data_cms ../../code/back_end/src/adapt_layer_openssl.c:487
    #2 0x55a8cebce555 in gen_sig_data ../../code/back_end/src/adapt_layer_openssl.c:717
    #3 0x55a8ceb9d111 in create_sig_file ../../code/front_end/src/cst.c:1389
    #4 0x55a8ceba27d8 in cmd_handler_authenticatecsf ../../code/front_end/src/csf_cmd_aut_dat.c:410
    #5 0x55a8cebbb47a in yyparse ../../code/front_end/src/cst_parser.y:109
    #6 0x55a8cea6ccef in main ../../code/front_end/src/cst.c:1676
    #7 0x7f9400e2c1e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)
    #8 0x55a8cea6e43d in _start (/home/andrewsh/projects/apertis/cst/package/cst/code/cst/code/obj.linux64/cst+0x5043d)

Address 0x7ffce1cb82b0 is located in stack of thread T0 at offset 48 in frame
    #0 0x55a8ceb9cf7f in create_sig_file ../../code/front_end/src/cst.c:1347

  This frame has 2 object(s):
    [48, 52) 'sig_size' (line 1359) <== Memory access at offset 48 partially overflows this variable
    [64, 1088) 'sig' (line 1348)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../code/back_end/src/adapt_layer_openssl.c:371 in cms_to_buf
Shadow bytes around the buggy address:
  0x10001c38f000: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10001c38f010: 04 f2 04 f2 00 00 00 00 00 00 00 00 00 00 00 00
  0x10001c38f020: 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00
  0x10001c38f030: 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00
  0x10001c38f040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10001c38f050: f1 f1 f1 f1 f1 f1[04]f2 00 00 00 00 00 00 00 00
  0x10001c38f060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10001c38f070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10001c38f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10001c38f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10001c38f0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==7637==ABORTING