Uploaded image for project: 'Traffic Server'
  1. Traffic Server
  2. TS-4005

Disable freelist command line option fails under ASAN

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 6.1.0
    • Core
    • None

    Description

      [bcall@homer trafficserver]$ sudo /usr/local/bin/traffic_server -f
      traffic_server: using root directory '/usr/local'
      =================================================================
      ==877==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000117a3e0 at pc 0x7f6685cd2d9b bp 0x7ffc4f8cfaa0 sp 0x7ffc4f8cfa90
      READ of size 4 at 0x00000117a3e0 thread T0
          #0 0x7f6685cd2d9a in process_arg /home/bcall/dev/apache/trafficserver/lib/ts/ink_args.cc:89
          #1 0x7f6685cd34a5 in process_args_ex(AppVersionInfo const*, ArgumentDescription const*, unsigned int, char const**) /home/bcall/dev/apache/trafficserver/lib/ts/ink_args.cc:238
          #2 0x7f6685cd3f2a in process_args(AppVersionInfo const*, ArgumentDescription const*, unsigned int, char const**, char const*) /home/bcall/dev/apache/trafficserver/lib/ts/ink_args.cc:167
          #3 0x494c10 in main /home/bcall/dev/apache/trafficserver/proxy/Main.cc:1498
          #4 0x7f6682f6e6ff in __libc_start_main (/lib64/libc.so.6+0x206ff)
          #5 0x4a6d88 in _start (/usr/local/bin/traffic_server+0x4a6d88)
      
      0x00000117a3e1 is located 0 bytes to the right of global variable 'cmd_disable_freelist' defined in 'Main.cc:169:13' (0x117a3e0) of size 1
        'cmd_disable_freelist' is ascii string ''
      SUMMARY: AddressSanitizer: global-buffer-overflow /home/bcall/dev/apache/trafficserver/lib/ts/ink_args.cc:89 process_arg
      Shadow bytes around the buggy address:
        0x000080227420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x000080227430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x000080227440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x000080227450: 00 00 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9
        0x000080227460: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
      =>0x000080227470: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9[01]f9 f9 f9
        0x000080227480: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
        0x000080227490: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
        0x0000802274a0: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
        0x0000802274b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0000802274c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
      ==877==ABORTING
      

      Attachments

        Issue Links

          Activity

            People

              bcall Bryan Call
              bcall Bryan Call
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Slack

                  Issue deployment