Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

James Cowgill
Source: gsequencer
Version: 0.8.0-1
Severity: important

Hi,

While looking at #861645 I noticed that the gsequencer testsuite
crashes on x86 with a heap buffer overflow when AddressSanitizer
(-fsanitize=address) is enabled.


FAIL: ags_midi_buffer_util_test
===============================



     CUnit - A unit testing framework for C - Version 2.1-3
     http://cunit.sourceforge.net/


Suite: AgsMidiBufferUtilTest
  Test: test of ags_midi_buffer_util.c get varlength size ...passed
  Test: test of ags_midi_buffer_util.c put varlength ...passed
  Test: test of ags_midi_buffer_util.c get varlength ...passed
  Test: test of ags_midi_buffer_util.c put int16 ...passed
  Test: test of ags_midi_buffer_util.c get int16 ...passed
  Test: test of ags_midi_buffer_util.c put int24 ...passed
  Test: test of ags_midi_buffer_util.c get int24 ...passed
  Test: test of ags_midi_buffer_util.c put int32 ...passed
  Test: test of ags_midi_buffer_util.c get int32 ...passed
  Test: test of ags_midi_buffer_util.c put header ...
** (process:4236): WARNING **: invalid chunk length

** (process:4236): WARNING **: invalid chunk length
FAILED
    1. ags/test/audio/midi/ags_midi_buffer_util_test.c:518  - success == TRUE
    2. ags/test/audio/midi/ags_midi_buffer_util_test.c:535  - success == TRUE
  Test: test of ags_midi_buffer_util.c get header ...passed
  Test: test of ags_midi_buffer_util.c put track ...passed
  Test: test of ags_midi_buffer_util.c get track ...passed
  Test: test of ags_midi_buffer_util.c put key on ...passed
  Test: test of ags_midi_buffer_util.c get key on ...passed
  Test: test of ags_midi_buffer_util.c put key off ...passed
  Test: test of ags_midi_buffer_util.c get key off ...passed
  Test: test of ags_midi_buffer_util.c put key pressure ...passed
  Test: test of ags_midi_buffer_util.c get key pressure ...passed
  Test: test of ags_midi_buffer_util.c put change parameter ...passed
  Test: test of ags_midi_buffer_util.c get change parameter ...passed
  Test: test of ags_midi_buffer_util.c put change pitch bend ...passed
  Test: test of ags_midi_buffer_util.c get change pitch bend ...passed
  Test: test of ags_midi_buffer_util.c put change program ...FAILED
    1. ags/test/audio/midi/ags_midi_buffer_util_test.c:1044  - success == TRUE
  Test: test of ags_midi_buffer_util.c get change program ...=================================================================
==4236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dff6 at pc 0x7f0b047bfd7b bp 0x7fff86d9a050 sp 0x7fff86d99800
WRITE of size 3 at 0x60200000dff6 thread T0
    #0 0x7f0b047bfd7a  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
    #1 0x5618bff665ad in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
    #2 0x5618bff665ad in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1073
    #3 0x7f0b03741396  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4396)
    #4 0x7f0b037416cf  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x46cf)
    #5 0x7f0b03741a1d in CU_run_all_tests (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4a1d)
    #6 0x5618bff63203 in main ags/test/audio/midi/ags_midi_buffer_util_test.c:3257
    #7 0x7f0b00fdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #8 0x5618bff63269 in _start (/build/gsequencer-8YtPr4/gsequencer-0.8.0/.libs/ags_midi_buffer_util_test+0x7269)

0x60200000dff6 is located 0 bytes to the right of 6-byte region [0x60200000dff0,0x60200000dff6)
allocated by thread T0 here:
    #0 0x7f0b04824d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x5618bff663ff in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1057

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
Shadow bytes around the buggy address:
  0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
  0x0c047fff9c00: fa fa 00 00 fa fa 06 fa fa fa 07 fa fa fa 07 fa
  0x0c047fff9c10: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
  0x0c047fff9c20: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
  0x0c047fff9c30: fa fa 00 fa fa fa 00 00 fa fa fd fa fa fa fd fa
  0x0c047fff9c40: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 04 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4236==ABORTING

James


signature.asc (849 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

Joël Krähemann-2
Hi

the stack-trace above should be fixed commit:

http://git.savannah.nongnu.org/cgit/gsequencer.git/commit/?h=0.8.x&id=d6a5a226fa01525bbcce3824dfb5f7e82767eb62

Since I didn't test with address sanitizer this wasn't recognized.
I just do run it now. Might be there other issues.

Bests,
Joël


On Fri, May 5, 2017 at 6:06 PM, James Cowgill <[hidden email]> wrote:

> Source: gsequencer
> Version: 0.8.0-1
> Severity: important
>
> Hi,
>
> While looking at #861645 I noticed that the gsequencer testsuite
> crashes on x86 with a heap buffer overflow when AddressSanitizer
> (-fsanitize=address) is enabled.
>
>
> FAIL: ags_midi_buffer_util_test
> ===============================
>
>
>
>      CUnit - A unit testing framework for C - Version 2.1-3
>      http://cunit.sourceforge.net/
>
>
> Suite: AgsMidiBufferUtilTest
>   Test: test of ags_midi_buffer_util.c get varlength size ...passed
>   Test: test of ags_midi_buffer_util.c put varlength ...passed
>   Test: test of ags_midi_buffer_util.c get varlength ...passed
>   Test: test of ags_midi_buffer_util.c put int16 ...passed
>   Test: test of ags_midi_buffer_util.c get int16 ...passed
>   Test: test of ags_midi_buffer_util.c put int24 ...passed
>   Test: test of ags_midi_buffer_util.c get int24 ...passed
>   Test: test of ags_midi_buffer_util.c put int32 ...passed
>   Test: test of ags_midi_buffer_util.c get int32 ...passed
>   Test: test of ags_midi_buffer_util.c put header ...
> ** (process:4236): WARNING **: invalid chunk length
>
> ** (process:4236): WARNING **: invalid chunk length
> FAILED
>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:518  - success == TRUE
>     2. ags/test/audio/midi/ags_midi_buffer_util_test.c:535  - success == TRUE
>   Test: test of ags_midi_buffer_util.c get header ...passed
>   Test: test of ags_midi_buffer_util.c put track ...passed
>   Test: test of ags_midi_buffer_util.c get track ...passed
>   Test: test of ags_midi_buffer_util.c put key on ...passed
>   Test: test of ags_midi_buffer_util.c get key on ...passed
>   Test: test of ags_midi_buffer_util.c put key off ...passed
>   Test: test of ags_midi_buffer_util.c get key off ...passed
>   Test: test of ags_midi_buffer_util.c put key pressure ...passed
>   Test: test of ags_midi_buffer_util.c get key pressure ...passed
>   Test: test of ags_midi_buffer_util.c put change parameter ...passed
>   Test: test of ags_midi_buffer_util.c get change parameter ...passed
>   Test: test of ags_midi_buffer_util.c put change pitch bend ...passed
>   Test: test of ags_midi_buffer_util.c get change pitch bend ...passed
>   Test: test of ags_midi_buffer_util.c put change program ...FAILED
>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:1044  - success == TRUE
>   Test: test of ags_midi_buffer_util.c get change program ...=================================================================
> ==4236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dff6 at pc 0x7f0b047bfd7b bp 0x7fff86d9a050 sp 0x7fff86d99800
> WRITE of size 3 at 0x60200000dff6 thread T0
>     #0 0x7f0b047bfd7a  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>     #1 0x5618bff665ad in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
>     #2 0x5618bff665ad in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1073
>     #3 0x7f0b03741396  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4396)
>     #4 0x7f0b037416cf  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x46cf)
>     #5 0x7f0b03741a1d in CU_run_all_tests (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4a1d)
>     #6 0x5618bff63203 in main ags/test/audio/midi/ags_midi_buffer_util_test.c:3257
>     #7 0x7f0b00fdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
>     #8 0x5618bff63269 in _start (/build/gsequencer-8YtPr4/gsequencer-0.8.0/.libs/ags_midi_buffer_util_test+0x7269)
>
> 0x60200000dff6 is located 0 bytes to the right of 6-byte region [0x60200000dff0,0x60200000dff6)
> allocated by thread T0 here:
>     #0 0x7f0b04824d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
>     #1 0x5618bff663ff in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1057
>
> SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
> Shadow bytes around the buggy address:
>   0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> =>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
>   0x0c047fff9c00: fa fa 00 00 fa fa 06 fa fa fa 07 fa fa fa 07 fa
>   0x0c047fff9c10: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>   0x0c047fff9c20: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>   0x0c047fff9c30: fa fa 00 fa fa fa 00 00 fa fa fd fa fa fa fd fa
>   0x0c047fff9c40: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 04 fa
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Heap right redzone:      fb
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack partial redzone:   f4
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==4236==ABORTING
>
> James
>

Reply | Threaded
Open this post in threaded view
|

Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

Joël Krähemann-2
Hi

Just recognized every _ unit test fails.
So I'm busy for a while.

Cheers,
Joël


On Sun, May 21, 2017 at 11:15 PM, Joël Krähemann <[hidden email]> wrote:

> Hi
>
> the stack-trace above should be fixed commit:
>
> http://git.savannah.nongnu.org/cgit/gsequencer.git/commit/?h=0.8.x&id=d6a5a226fa01525bbcce3824dfb5f7e82767eb62
>
> Since I didn't test with address sanitizer this wasn't recognized.
> I just do run it now. Might be there other issues.
>
> Bests,
> Joël
>
>
> On Fri, May 5, 2017 at 6:06 PM, James Cowgill <[hidden email]> wrote:
>> Source: gsequencer
>> Version: 0.8.0-1
>> Severity: important
>>
>> Hi,
>>
>> While looking at #861645 I noticed that the gsequencer testsuite
>> crashes on x86 with a heap buffer overflow when AddressSanitizer
>> (-fsanitize=address) is enabled.
>>
>>
>> FAIL: ags_midi_buffer_util_test
>> ===============================
>>
>>
>>
>>      CUnit - A unit testing framework for C - Version 2.1-3
>>      http://cunit.sourceforge.net/
>>
>>
>> Suite: AgsMidiBufferUtilTest
>>   Test: test of ags_midi_buffer_util.c get varlength size ...passed
>>   Test: test of ags_midi_buffer_util.c put varlength ...passed
>>   Test: test of ags_midi_buffer_util.c get varlength ...passed
>>   Test: test of ags_midi_buffer_util.c put int16 ...passed
>>   Test: test of ags_midi_buffer_util.c get int16 ...passed
>>   Test: test of ags_midi_buffer_util.c put int24 ...passed
>>   Test: test of ags_midi_buffer_util.c get int24 ...passed
>>   Test: test of ags_midi_buffer_util.c put int32 ...passed
>>   Test: test of ags_midi_buffer_util.c get int32 ...passed
>>   Test: test of ags_midi_buffer_util.c put header ...
>> ** (process:4236): WARNING **: invalid chunk length
>>
>> ** (process:4236): WARNING **: invalid chunk length
>> FAILED
>>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:518  - success == TRUE
>>     2. ags/test/audio/midi/ags_midi_buffer_util_test.c:535  - success == TRUE
>>   Test: test of ags_midi_buffer_util.c get header ...passed
>>   Test: test of ags_midi_buffer_util.c put track ...passed
>>   Test: test of ags_midi_buffer_util.c get track ...passed
>>   Test: test of ags_midi_buffer_util.c put key on ...passed
>>   Test: test of ags_midi_buffer_util.c get key on ...passed
>>   Test: test of ags_midi_buffer_util.c put key off ...passed
>>   Test: test of ags_midi_buffer_util.c get key off ...passed
>>   Test: test of ags_midi_buffer_util.c put key pressure ...passed
>>   Test: test of ags_midi_buffer_util.c get key pressure ...passed
>>   Test: test of ags_midi_buffer_util.c put change parameter ...passed
>>   Test: test of ags_midi_buffer_util.c get change parameter ...passed
>>   Test: test of ags_midi_buffer_util.c put change pitch bend ...passed
>>   Test: test of ags_midi_buffer_util.c get change pitch bend ...passed
>>   Test: test of ags_midi_buffer_util.c put change program ...FAILED
>>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:1044  - success == TRUE
>>   Test: test of ags_midi_buffer_util.c get change program ...=================================================================
>> ==4236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dff6 at pc 0x7f0b047bfd7b bp 0x7fff86d9a050 sp 0x7fff86d99800
>> WRITE of size 3 at 0x60200000dff6 thread T0
>>     #0 0x7f0b047bfd7a  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>>     #1 0x5618bff665ad in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
>>     #2 0x5618bff665ad in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1073
>>     #3 0x7f0b03741396  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4396)
>>     #4 0x7f0b037416cf  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x46cf)
>>     #5 0x7f0b03741a1d in CU_run_all_tests (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4a1d)
>>     #6 0x5618bff63203 in main ags/test/audio/midi/ags_midi_buffer_util_test.c:3257
>>     #7 0x7f0b00fdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
>>     #8 0x5618bff63269 in _start (/build/gsequencer-8YtPr4/gsequencer-0.8.0/.libs/ags_midi_buffer_util_test+0x7269)
>>
>> 0x60200000dff6 is located 0 bytes to the right of 6-byte region [0x60200000dff0,0x60200000dff6)
>> allocated by thread T0 here:
>>     #0 0x7f0b04824d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
>>     #1 0x5618bff663ff in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1057
>>
>> SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>> Shadow bytes around the buggy address:
>>   0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>   0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>   0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>   0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>   0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>> =>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
>>   0x0c047fff9c00: fa fa 00 00 fa fa 06 fa fa fa 07 fa fa fa 07 fa
>>   0x0c047fff9c10: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>>   0x0c047fff9c20: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>>   0x0c047fff9c30: fa fa 00 fa fa fa 00 00 fa fa fd fa fa fa fd fa
>>   0x0c047fff9c40: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 04 fa
>> Shadow byte legend (one shadow byte represents 8 application bytes):
>>   Addressable:           00
>>   Partially addressable: 01 02 03 04 05 06 07
>>   Heap left redzone:       fa
>>   Heap right redzone:      fb
>>   Freed heap region:       fd
>>   Stack left redzone:      f1
>>   Stack mid redzone:       f2
>>   Stack right redzone:     f3
>>   Stack partial redzone:   f4
>>   Stack after return:      f5
>>   Stack use after scope:   f8
>>   Global redzone:          f9
>>   Global init order:       f6
>>   Poisoned by user:        f7
>>   Container overflow:      fc
>>   Array cookie:            ac
>>   Intra object redzone:    bb
>>   ASan internal:           fe
>>   Left alloca redzone:     ca
>>   Right alloca redzone:    cb
>> ==4236==ABORTING
>>
>> James
>>

Reply | Threaded
Open this post in threaded view
|

Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

Joël Krähemann-2
Hi

Just figured out that are mainly issues related
to memory leakes within the test that can be
safely ignored.

Note I have fixed additional issues with this
test:

http://git.savannah.nongnu.org/cgit/gsequencer.git/commit/?h=0.8.x&id=78e7b1877add068e59b18b13e2e3b4e245e0b3d3


On Sun, May 21, 2017 at 11:38 PM, Joël Krähemann <[hidden email]> wrote:

> Hi
>
> Just recognized every _ unit test fails.
> So I'm busy for a while.
>
> Cheers,
> Joël
>
>
> On Sun, May 21, 2017 at 11:15 PM, Joël Krähemann <[hidden email]> wrote:
>> Hi
>>
>> the stack-trace above should be fixed commit:
>>
>> http://git.savannah.nongnu.org/cgit/gsequencer.git/commit/?h=0.8.x&id=d6a5a226fa01525bbcce3824dfb5f7e82767eb62
>>
>> Since I didn't test with address sanitizer this wasn't recognized.
>> I just do run it now. Might be there other issues.
>>
>> Bests,
>> Joël
>>
>>
>> On Fri, May 5, 2017 at 6:06 PM, James Cowgill <[hidden email]> wrote:
>>> Source: gsequencer
>>> Version: 0.8.0-1
>>> Severity: important
>>>
>>> Hi,
>>>
>>> While looking at #861645 I noticed that the gsequencer testsuite
>>> crashes on x86 with a heap buffer overflow when AddressSanitizer
>>> (-fsanitize=address) is enabled.
>>>
>>>
>>> FAIL: ags_midi_buffer_util_test
>>> ===============================
>>>
>>>
>>>
>>>      CUnit - A unit testing framework for C - Version 2.1-3
>>>      http://cunit.sourceforge.net/
>>>
>>>
>>> Suite: AgsMidiBufferUtilTest
>>>   Test: test of ags_midi_buffer_util.c get varlength size ...passed
>>>   Test: test of ags_midi_buffer_util.c put varlength ...passed
>>>   Test: test of ags_midi_buffer_util.c get varlength ...passed
>>>   Test: test of ags_midi_buffer_util.c put int16 ...passed
>>>   Test: test of ags_midi_buffer_util.c get int16 ...passed
>>>   Test: test of ags_midi_buffer_util.c put int24 ...passed
>>>   Test: test of ags_midi_buffer_util.c get int24 ...passed
>>>   Test: test of ags_midi_buffer_util.c put int32 ...passed
>>>   Test: test of ags_midi_buffer_util.c get int32 ...passed
>>>   Test: test of ags_midi_buffer_util.c put header ...
>>> ** (process:4236): WARNING **: invalid chunk length
>>>
>>> ** (process:4236): WARNING **: invalid chunk length
>>> FAILED
>>>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:518  - success == TRUE
>>>     2. ags/test/audio/midi/ags_midi_buffer_util_test.c:535  - success == TRUE
>>>   Test: test of ags_midi_buffer_util.c get header ...passed
>>>   Test: test of ags_midi_buffer_util.c put track ...passed
>>>   Test: test of ags_midi_buffer_util.c get track ...passed
>>>   Test: test of ags_midi_buffer_util.c put key on ...passed
>>>   Test: test of ags_midi_buffer_util.c get key on ...passed
>>>   Test: test of ags_midi_buffer_util.c put key off ...passed
>>>   Test: test of ags_midi_buffer_util.c get key off ...passed
>>>   Test: test of ags_midi_buffer_util.c put key pressure ...passed
>>>   Test: test of ags_midi_buffer_util.c get key pressure ...passed
>>>   Test: test of ags_midi_buffer_util.c put change parameter ...passed
>>>   Test: test of ags_midi_buffer_util.c get change parameter ...passed
>>>   Test: test of ags_midi_buffer_util.c put change pitch bend ...passed
>>>   Test: test of ags_midi_buffer_util.c get change pitch bend ...passed
>>>   Test: test of ags_midi_buffer_util.c put change program ...FAILED
>>>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:1044  - success == TRUE
>>>   Test: test of ags_midi_buffer_util.c get change program ...=================================================================
>>> ==4236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dff6 at pc 0x7f0b047bfd7b bp 0x7fff86d9a050 sp 0x7fff86d99800
>>> WRITE of size 3 at 0x60200000dff6 thread T0
>>>     #0 0x7f0b047bfd7a  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>>>     #1 0x5618bff665ad in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
>>>     #2 0x5618bff665ad in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1073
>>>     #3 0x7f0b03741396  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4396)
>>>     #4 0x7f0b037416cf  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x46cf)
>>>     #5 0x7f0b03741a1d in CU_run_all_tests (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4a1d)
>>>     #6 0x5618bff63203 in main ags/test/audio/midi/ags_midi_buffer_util_test.c:3257
>>>     #7 0x7f0b00fdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
>>>     #8 0x5618bff63269 in _start (/build/gsequencer-8YtPr4/gsequencer-0.8.0/.libs/ags_midi_buffer_util_test+0x7269)
>>>
>>> 0x60200000dff6 is located 0 bytes to the right of 6-byte region [0x60200000dff0,0x60200000dff6)
>>> allocated by thread T0 here:
>>>     #0 0x7f0b04824d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
>>>     #1 0x5618bff663ff in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1057
>>>
>>> SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>>> Shadow bytes around the buggy address:
>>>   0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>   0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>   0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>   0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>   0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>> =>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
>>>   0x0c047fff9c00: fa fa 00 00 fa fa 06 fa fa fa 07 fa fa fa 07 fa
>>>   0x0c047fff9c10: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>>>   0x0c047fff9c20: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>>>   0x0c047fff9c30: fa fa 00 fa fa fa 00 00 fa fa fd fa fa fa fd fa
>>>   0x0c047fff9c40: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 04 fa
>>> Shadow byte legend (one shadow byte represents 8 application bytes):
>>>   Addressable:           00
>>>   Partially addressable: 01 02 03 04 05 06 07
>>>   Heap left redzone:       fa
>>>   Heap right redzone:      fb
>>>   Freed heap region:       fd
>>>   Stack left redzone:      f1
>>>   Stack mid redzone:       f2
>>>   Stack right redzone:     f3
>>>   Stack partial redzone:   f4
>>>   Stack after return:      f5
>>>   Stack use after scope:   f8
>>>   Global redzone:          f9
>>>   Global init order:       f6
>>>   Poisoned by user:        f7
>>>   Container overflow:      fc
>>>   Array cookie:            ac
>>>   Intra object redzone:    bb
>>>   ASan internal:           fe
>>>   Left alloca redzone:     ca
>>>   Right alloca redzone:    cb
>>> ==4236==ABORTING
>>>
>>> James
>>>

Reply | Threaded
Open this post in threaded view
|

Bug#861908: gsequencer: testsuite crashes if AddressSanitizer is enabled

Joël Krähemann-2
Hi

I have targeted the issue during release of gsequencer-0.8.7.
I think we should close this bug.

Bests,
Joël


On Mon, May 22, 2017 at 12:19 AM, Joël Krähemann <[hidden email]> wrote:

> Hi
>
> Just figured out that are mainly issues related
> to memory leakes within the test that can be
> safely ignored.
>
> Note I have fixed additional issues with this
> test:
>
> http://git.savannah.nongnu.org/cgit/gsequencer.git/commit/?h=0.8.x&id=78e7b1877add068e59b18b13e2e3b4e245e0b3d3
>
>
> On Sun, May 21, 2017 at 11:38 PM, Joël Krähemann <[hidden email]> wrote:
>> Hi
>>
>> Just recognized every _ unit test fails.
>> So I'm busy for a while.
>>
>> Cheers,
>> Joël
>>
>>
>> On Sun, May 21, 2017 at 11:15 PM, Joël Krähemann <[hidden email]> wrote:
>>> Hi
>>>
>>> the stack-trace above should be fixed commit:
>>>
>>> http://git.savannah.nongnu.org/cgit/gsequencer.git/commit/?h=0.8.x&id=d6a5a226fa01525bbcce3824dfb5f7e82767eb62
>>>
>>> Since I didn't test with address sanitizer this wasn't recognized.
>>> I just do run it now. Might be there other issues.
>>>
>>> Bests,
>>> Joël
>>>
>>>
>>> On Fri, May 5, 2017 at 6:06 PM, James Cowgill <[hidden email]> wrote:
>>>> Source: gsequencer
>>>> Version: 0.8.0-1
>>>> Severity: important
>>>>
>>>> Hi,
>>>>
>>>> While looking at #861645 I noticed that the gsequencer testsuite
>>>> crashes on x86 with a heap buffer overflow when AddressSanitizer
>>>> (-fsanitize=address) is enabled.
>>>>
>>>>
>>>> FAIL: ags_midi_buffer_util_test
>>>> ===============================
>>>>
>>>>
>>>>
>>>>      CUnit - A unit testing framework for C - Version 2.1-3
>>>>      http://cunit.sourceforge.net/
>>>>
>>>>
>>>> Suite: AgsMidiBufferUtilTest
>>>>   Test: test of ags_midi_buffer_util.c get varlength size ...passed
>>>>   Test: test of ags_midi_buffer_util.c put varlength ...passed
>>>>   Test: test of ags_midi_buffer_util.c get varlength ...passed
>>>>   Test: test of ags_midi_buffer_util.c put int16 ...passed
>>>>   Test: test of ags_midi_buffer_util.c get int16 ...passed
>>>>   Test: test of ags_midi_buffer_util.c put int24 ...passed
>>>>   Test: test of ags_midi_buffer_util.c get int24 ...passed
>>>>   Test: test of ags_midi_buffer_util.c put int32 ...passed
>>>>   Test: test of ags_midi_buffer_util.c get int32 ...passed
>>>>   Test: test of ags_midi_buffer_util.c put header ...
>>>> ** (process:4236): WARNING **: invalid chunk length
>>>>
>>>> ** (process:4236): WARNING **: invalid chunk length
>>>> FAILED
>>>>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:518  - success == TRUE
>>>>     2. ags/test/audio/midi/ags_midi_buffer_util_test.c:535  - success == TRUE
>>>>   Test: test of ags_midi_buffer_util.c get header ...passed
>>>>   Test: test of ags_midi_buffer_util.c put track ...passed
>>>>   Test: test of ags_midi_buffer_util.c get track ...passed
>>>>   Test: test of ags_midi_buffer_util.c put key on ...passed
>>>>   Test: test of ags_midi_buffer_util.c get key on ...passed
>>>>   Test: test of ags_midi_buffer_util.c put key off ...passed
>>>>   Test: test of ags_midi_buffer_util.c get key off ...passed
>>>>   Test: test of ags_midi_buffer_util.c put key pressure ...passed
>>>>   Test: test of ags_midi_buffer_util.c get key pressure ...passed
>>>>   Test: test of ags_midi_buffer_util.c put change parameter ...passed
>>>>   Test: test of ags_midi_buffer_util.c get change parameter ...passed
>>>>   Test: test of ags_midi_buffer_util.c put change pitch bend ...passed
>>>>   Test: test of ags_midi_buffer_util.c get change pitch bend ...passed
>>>>   Test: test of ags_midi_buffer_util.c put change program ...FAILED
>>>>     1. ags/test/audio/midi/ags_midi_buffer_util_test.c:1044  - success == TRUE
>>>>   Test: test of ags_midi_buffer_util.c get change program ...=================================================================
>>>> ==4236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dff6 at pc 0x7f0b047bfd7b bp 0x7fff86d9a050 sp 0x7fff86d99800
>>>> WRITE of size 3 at 0x60200000dff6 thread T0
>>>>     #0 0x7f0b047bfd7a  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>>>>     #1 0x5618bff665ad in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
>>>>     #2 0x5618bff665ad in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1073
>>>>     #3 0x7f0b03741396  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4396)
>>>>     #4 0x7f0b037416cf  (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x46cf)
>>>>     #5 0x7f0b03741a1d in CU_run_all_tests (/usr/lib/x86_64-linux-gnu/libcunit.so.1+0x4a1d)
>>>>     #6 0x5618bff63203 in main ags/test/audio/midi/ags_midi_buffer_util_test.c:3257
>>>>     #7 0x7f0b00fdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
>>>>     #8 0x5618bff63269 in _start (/build/gsequencer-8YtPr4/gsequencer-0.8.0/.libs/ags_midi_buffer_util_test+0x7269)
>>>>
>>>> 0x60200000dff6 is located 0 bytes to the right of 6-byte region [0x60200000dff0,0x60200000dff6)
>>>> allocated by thread T0 here:
>>>>     #0 0x7f0b04824d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
>>>>     #1 0x5618bff663ff in ags_midi_buffer_util_test_get_change_program ags/test/audio/midi/ags_midi_buffer_util_test.c:1057
>>>>
>>>> SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cd7a)
>>>> Shadow bytes around the buggy address:
>>>>   0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>>   0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>>   0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>>   0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>>   0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>>>> =>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
>>>>   0x0c047fff9c00: fa fa 00 00 fa fa 06 fa fa fa 07 fa fa fa 07 fa
>>>>   0x0c047fff9c10: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>>>>   0x0c047fff9c20: fa fa 07 fa fa fa 07 fa fa fa 07 fa fa fa 07 fa
>>>>   0x0c047fff9c30: fa fa 00 fa fa fa 00 00 fa fa fd fa fa fa fd fa
>>>>   0x0c047fff9c40: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 04 fa
>>>> Shadow byte legend (one shadow byte represents 8 application bytes):
>>>>   Addressable:           00
>>>>   Partially addressable: 01 02 03 04 05 06 07
>>>>   Heap left redzone:       fa
>>>>   Heap right redzone:      fb
>>>>   Freed heap region:       fd
>>>>   Stack left redzone:      f1
>>>>   Stack mid redzone:       f2
>>>>   Stack right redzone:     f3
>>>>   Stack partial redzone:   f4
>>>>   Stack after return:      f5
>>>>   Stack use after scope:   f8
>>>>   Global redzone:          f9
>>>>   Global init order:       f6
>>>>   Poisoned by user:        f7
>>>>   Container overflow:      fc
>>>>   Array cookie:            ac
>>>>   Intra object redzone:    bb
>>>>   ASan internal:           fe
>>>>   Left alloca redzone:     ca
>>>>   Right alloca redzone:    cb
>>>> ==4236==ABORTING
>>>>
>>>> James
>>>>