Skip to content

Commit d82ad03

Browse files
committed
Fixed buffer overflow in demangler
Changing the name of ErrorProtocol to Error broke this runtime test — causing a buffer overflow. The mangled name changed from _TtPs13ErrorProtocol_->_TtPs5Error_ but the strlen didn’t change from 21 to 12; I update the callers to use static string length instead of a literal string & length. Error reported is: ================================================================= ==88865==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0001028ba40d at pc 0x000103291a1f bp 0x7fff5d3492c0 sp 0x7fff5d348a80 READ of size 9 at 0x0001028ba40d thread T0 (libclang_rt.asan_osx_dynamic.dylib+0x42a1e) std::__1::char_traits<char>, std::__1::allocator<char> >::__init(char const*, unsigned long) (libc++.1.dylib+0x3f224) swift::Demangle::NodeFactory::create(swift::Demangle::Node::Kind, llvm::StringRef) string:2044 namespace)::Demangler::demangleTopLevel() Demangle.cpp:358 unsigned long, swift::Demangle::DemangleOptions const&) Demangle.cpp:2288 MetadataReader.h:772 0x0001028ba40d is located 51 bytes to the left of global variable '<string literal>' defined in '/Users/buildslave/jenkins/workspace/swift-incremental-asan-RDA/swift/to ols/swift-reflection-test/swift-reflection-test.c:458:19' (0x1028ba440) of size 41 '<string literal>' is ascii string 'swift-reflection-test <binary filename> ' 0x0001028ba40d is located 0 bytes to the right of global variable '<string literal>' defined in '/Users/buildslave/jenkins/workspace/swift-incremental-asan-RDA/swift/to ols/swift-reflection-test/swift-reflection-test.c:435:15' (0x1028ba400) of size 13 '<string literal>' is ascii string '_TtPs5Error_' SUMMARY: AddressSanitizer: global-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib+0x42a1e) in wrap_memmove
1 parent 02f3298 commit d82ad03

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

tools/swift-reflection-test/swift-reflection-test.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -421,18 +421,21 @@ int doDumpHeapInstance(const char *BinaryFilename) {
421421
return EXIT_SUCCESS;
422422
break;
423423
case Existential: {
424+
static const char Name[] = "_TtP_";
424425
swift_typeref_t AnyTR
425-
= swift_reflection_typeRefForMangledTypeName(RC, "_TtP_", 5);
426+
= swift_reflection_typeRefForMangledTypeName(RC,
427+
Name, sizeof(Name)-1);
426428

427429
printf("Reflecting an existential.\n");
428430
if (!reflectExistential(RC, Pipe, AnyTR))
429431
return EXIT_SUCCESS;
430432
break;
431433
}
432434
case ErrorExistential: {
435+
static const char ErrorName[] = "_TtPs5Error_";
433436
swift_typeref_t ErrorTR
434437
= swift_reflection_typeRefForMangledTypeName(RC,
435-
"_TtPs5Error_", 21);
438+
ErrorName, sizeof(ErrorName)-1);
436439
printf("Reflecting an error existential.\n");
437440
if (!reflectExistential(RC, Pipe, ErrorTR))
438441
return EXIT_SUCCESS;

0 commit comments

Comments
 (0)