记一个AddressSanitizer(ASAN)linux下的内存分析神器的问题

2020-08-04 11:11:57 浏览数 (1)

感谢万能的互联网,我向google提出的issue很快就得到了工程师回复,解决了我的问题。

我的问题是这样的:

AddressSanitizer can't detect some global buffer overflow!  #1285

Closed

yangyongzhen opened this issue yesterday · 1 comment

yangyongzhen commented yesterday

what a pity! AddressSanitizer can't detect some global buffer overflow! Even if the mistake or code bugs is so obvious。 for example,this code bellow, guess what you will get, ...... U08 IP[10]; U08 IP1[10]; int main() { memset(IP1,0x3A,10); memcpy(IP,"123456789021111111111",17); IP[15] = 12; printf("IP1[0]:%dn",IP1[0]); printf("IP1[1]:%dn",IP1[1]); printf("IP1[2]:%dn",IP1[2]); printf("IP[10]:%dn",IP[10]); printf("IP[11]:%dn",IP[11]); printf("IP[15]:%dn",IP[15]); printf("IP1[0]:%dn",IP1[0]); printf("IP1[1]:%dn",IP1[1]); printf("IP1[2]:%dn",IP1[2]); } 。。。。。。 use cflags= -std=gnu99 -Wall -fno-stack-protector -fno-omit-frame-pointer -fvar-tracking -g2 -fno-inline -fsanitize=address -fexceptions but AddressSanitizer can't detect this!!! if you add "static" before the global vars,like this: static U08 IP[10]; then AddressSanitizer can detect mistakes,, why?

melver commented 23 hours ago

Add -fno-common for C code. Globals that are placed in the common section (default for C) won't be separated by redzones, and therefore the OOB accesses in your example simply access IP1's memory.

0 人点赞