View Issue Details

Related ChangesetsJump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0030981Open CASCADEOCCT:Foundation Classespublic2019-09-19 08:342019-09-29 12:36
ReporterabvAssigned Tobugmaster  
PrioritynormalSeverityminor 
Status closedResolutionfixed 
Product Version6.7.0 
Target Version7.4.0Fixed in Version7.4.0 
Summary0030981: Foundation Classes - heap-buffer-overflow reported by Clang address sanitizer in TCollection_ExtendedString
DescriptionWhen running OCCT built on Linux with Clang with option -fsanitize=address, error heap-buffer-overflow is reported on many test cases, e.g. bugs fclasses bug11758:

OCC11758
=================================================================
==31451==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200026b514 at pc 0x0000004b52e5 bp 0x7fff80a08ea0 sp 0x7fff80a08650

READ of size 6 at 0x60200026b514 thread T0
    # 0 0x4b52e4 in __interceptor_memcmp.part.77 (/home/abv/tmp/occt-clang/lin64/clang/bini/DRAWEXE-7.4.0+0x4b52e4)
    # 1 0x7f3490aaa41e in TCollection_ExtendedString::IsLess(char16_t const*) const /home/abv/occt/src/TCollection/TCollection_ExtendedString.cxx:501:12
    # 2 0x7f3482649ae1 in OCC11758(Draw_Interpretor&, int, char const**) /home/abv/occt/src/QABugs/QABugs_19.cxx:1080:5
    # 3 0x7f34950f4349 in Draw_Interpretor::CallBackDataFunc::Invoke(Draw_Interpretor&, int, char const**) /home/abv/occt/src/Draw/Draw_Interpretor.hxx:81:31
    # 4 0x7f3495101b7d in CommandCmd(void*, Tcl_Interp*, int, char const**) /home/abv/occt/src/Draw/Draw_Interpretor.cxx:154:40
    # 5 0x7f348f4b6b95 in TclInvokeStringCommand (/usr/lib/x86_64-linux-gnu/libtcl8.6.so+0x38b95)
    # 6 0x7f348f4b8fa6 in TclNRRunCallbacks (/usr/lib/x86_64-linux-gnu/libtcl8.6.so+0x3afa6)
    # 7 0x7f348f55787a in Tcl_RecordAndEvalObj (/usr/lib/x86_64-linux-gnu/libtcl8.6.so+0xd987a)
    # 8 0x7f348f557756 in Tcl_RecordAndEval (/usr/lib/x86_64-linux-gnu/libtcl8.6.so+0xd9756)
    # 9 0x7f34951030bf in Draw_Interpretor::RecordAndEval(char const*, int) /home/abv/occt/src/Draw/Draw_Interpretor.cxx:496:10
    # 10 0x7f34950e9dad in Draw_Interprete(char const*) /home/abv/occt/src/Draw/Draw.cxx:608:19
    # 11 0x7f34950eab90 in interpreteTclCommand(TCollection_AsciiString const&) /home/abv/occt/src/Draw/Draw.cxx:110:5
    # 12 0x7f34950e837b in ReadInitFile(TCollection_AsciiString const&) /home/abv/occt/src/Draw/Draw.cxx:121:3
    # 13 0x7f34950e7973 in Draw_Appli(int, char**, void (*)(Draw_Interpretor&)) /home/abv/occt/src/Draw/Draw.cxx:497:5
    # 14 0x7f3495104328 in Draw_Main(int, char**, void (*)(Draw_Interpretor&)) /home/abv/occt/src/Draw/Draw_Main.cxx:113:3
    # 15 0x51aaef in main /home/abv/occt/src/DRAWEXE/DRAWEXE.cxx:33:1
    # 16 0x7f348dee282f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    # 17 0x41aac8 in _start (/home/abv/tmp/occt-clang/lin64/clang/bini/DRAWEXE-7.4.0+0x41aac8)

0x60200026b514 is located 0 bytes to the right of 4-byte region [0x60200026b510,0x60200026b514)
allocated by thread T0 here:
    # 0 0x4df140 in realloc (/home/abv/tmp/occt-clang/lin64/clang/bini/DRAWEXE-7.4.0+0x4df140)
    # 1 0x7f3490a7bff9 in Standard_MMgrRaw::Reallocate(void*, unsigned long) /home/abv/occt/src/Standard/Standard_MMgrRaw.cxx:69:51
    # 2 0x7f3490a739a3 in Standard::Reallocate(void*, unsigned long) /home/abv/occt/src/Standard/Standard.cxx:261:43
    # 3 0x7f3490aa81cf in (anonymous namespace)::reallocateExtChars(void*, unsigned long) /home/abv/occt/src/TCollection/TCollection_ExtendedString.cxx:42:37
    # 4 0x7f3490aa7c2b in TCollection_ExtendedString::TCollection_ExtendedString(char const*, bool) /home/abv/occt/src/TCollection/TCollection_ExtendedString.cxx:127:14
    # 5 0x7f348264990b in OCC11758(Draw_Interpretor&, int, char const**) /home/abv/occt/src/QABugs/QABugs_19.cxx:1068:38
    # 6 0x7f34950f4349 in Draw_Interpretor::CallBackDataFunc::Invoke(Draw_Interpretor&, int, char const**) /home/abv/occt/src/Draw/Draw_Interpretor.hxx:81:31
    # 7 0x7f3495101b7d in CommandCmd(void*, Tcl_Interp*, int, char const**) /home/abv/occt/src/Draw/Draw_Interpretor.cxx:154:40
    # 8 0x7f348f4b6b95 in TclInvokeStringCommand (/usr/lib/x86_64-linux-gnu/libtcl8.6.so+0x38b95)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/abv/tmp/occt-clang/lin64/clang/bini/DRAWEXE-7.4.0+0x4b52e4) in __interceptor_memcmp.part.77
Shadow bytes around the buggy address:
  0x0c0480045650: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c0480045660: fa fa 04 fa fa fa fd fa fa fa 04 fa fa fa 04 fa
  0x0c0480045670: fa fa 04 fa fa fa 04 fa fa fa 04 fa fa fa fd fa
  0x0c0480045680: fa fa 04 fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480045690: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c04800456a0: fa fa[04]fa fa fa 04 fa fa fa 00 fa fa fa 04 fa
  0x0c04800456b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800456c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800456d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800456e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800456f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
==31451==ABORTING
Steps To ReproduceBuild on Linux with CLang with -fsanitize=address, then run test bugs fclasses bug11758
TagsNo tags attached.
Test case numberNot required

Relationships

child of 0030557 newdpasukhi Open CASCADE Coding - eliminate errors reported by -fsanitize 

Activities

git

2019-09-19 08:37

administrator   ~0087289

Branch CR30981 has been created by abv.

SHA-1: 5cbc2444bfb380576dc2702a2fce7aff9a9616ea


Detailed log of new commits:

Author: abv
Date: Thu Sep 19 08:33:31 2019 +0300

    0030981: Foundation Classes - heap-buffer-overflow reported by Clang address sanitizer in TCollection_ExtendedString
    
    Avoid using memcmp on null-terminated extended (16-bit) strings.
    Plain zero is used instead of one-byte null char literal for 16-bit chars.

git

2019-09-19 13:04

administrator   ~0087299

Branch CR30981 has been updated forcibly by abv.

SHA-1: 26587b102d74398ba7e1342708491c069c6218bc

abv

2019-09-19 16:15

manager   ~0087312

Fix pushed tp CR30981 and tested - see Jenkins job CR30981-abv; please review

bugmaster

2019-09-20 07:52

administrator   ~0087337

Combination -
OCCT branch : WEEK-38
master SHA - 3561f506c83b672cc3e06b77029aafca8d91d5d9
5f5b1aed1c6e139bbd34314eca77ae7abcd8895c
Products branch : WEEK-38 SHA - 408582119deba96d291df52766ca720a3059ce71
was compiled on Linux, MacOS and Windows platforms and tested in optimize mode.

Number of compiler warnings:
No new/fixed warnings

Regressions/Differences/Improvements:
No regressions/differences

CPU differences:
Debian80-64:
OCCT
Total CPU difference: 16813.57000000016 / 16822.810000000067 [-0.05%]
Products
Total CPU difference: 10542.720000000027 / 10555.120000000048 [-0.12%]
Windows-64-VC14:
OCCT
Total CPU difference: 18271.390625 / 18222.765625 [+0.27%]
Products
Total CPU difference: 12493.84375 / 12438.984375 [+0.44%]


Image differences :
No differences that require special attention

Memory differences :
No differences that require special attention

git

2019-09-29 12:36

administrator   ~0087624

Branch CR30981 has been deleted by inv.

SHA-1: 26587b102d74398ba7e1342708491c069c6218bc

Related Changesets

occt: master 1e0a1fc9

2019-09-19 05:33:31

abv


Committer: bugmaster Details Diff		 0030981: Foundation Classes - heap-buffer-overflow reported by Clang address sanitizer in TCollection_ExtendedString

Avoid using memcmp on null-terminated extended (16-bit) strings.
Plain zero is used instead of one-byte null char literal for 16-bit chars.		 Affected Issues
0030981
mod - src/TCollection/TCollection_ExtendedString.cxx Diff File

Issue History

Date Modified Username Field Change
2019-09-19 08:34 abv New Issue
2019-09-19 08:34 abv Assigned To => abv
2019-09-19 08:34 abv Relationship added child of 0030557
2019-09-19 08:37 git Note Added: 0087289
2019-09-19 13:04 git Note Added: 0087299
2019-09-19 14:47 abv Description Updated
2019-09-19 16:15 abv Note Added: 0087312
2019-09-19 16:15 abv Assigned To abv => kgv
2019-09-19 16:15 abv Status new => resolved
2019-09-19 16:15 abv Steps to Reproduce Updated
2019-09-19 16:32 kgv Assigned To kgv => bugmaster
2019-09-19 16:32 kgv Status resolved => reviewed
2019-09-19 16:34 kgv Product Version => 6.7.0
2019-09-20 07:52 bugmaster Test case number => Not required
2019-09-20 07:52 bugmaster Note Added: 0087337
2019-09-20 07:52 bugmaster Status reviewed => tested
2019-09-21 18:13 bugmaster Changeset attached => occt master 1e0a1fc9
2019-09-21 18:13 bugmaster Status tested => verified
2019-09-21 18:13 bugmaster Resolution open => fixed
2019-09-29 12:36 git Note Added: 0087624