Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LIB: fix invalid access to past last element #24

Closed
wants to merge 1 commit into from

Conversation

hfiguiere
Copy link

  • Accessing a vector element past the last (idx >= size) is UB and will trigger an assertion when built with assertions

The plugin was aborting on load when built as a flatpak.
(default CXX flags have C++ assertions enabled)

- Accessing a vector element past the last (idx >= size) is UB
and will trigger an assertion when built with assertions

Signed-off-by: Hubert Figuière <[email protected]>
@swesterfeld
Copy link
Owner

Yes, I agree this is UB and needs to be fixed. From a quick look at the source code, this is not the only place where &foo[foo.size()] is used. I'll try to find the other spots as well and fix it everywhere. Also I think that &foo[0] is also a problem because it will cause out-of-bounds errors if the vector is empty, so this probably also needs fixing by using the data() function of std::vector instead, which can also be used for empty vectors.

Interestingly the address sanitizer and UB sanitizer don't really find this bug, but I can reproduce your "crash" by compiling with -D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC.

@hfiguiere
Copy link
Author

Also I think that &foo[0] is also a problem because it will cause out-of-bounds errors if the vector is empty

That one too.

Maybe MMapIn::open_mem could take iterators that return the proper type.

swesterfeld added a commit that referenced this pull request Nov 25, 2023
swesterfeld added a commit that referenced this pull request Nov 25, 2023
swesterfeld added a commit that referenced this pull request Nov 25, 2023
swesterfeld added a commit that referenced this pull request Nov 25, 2023
* fix-out-of-bounds-ub:
  VST: avoid using &foo[0] on std::vector, can cause UB
  TOOLS: avoid using &foo[0] on std::vector, can cause UB
  SRC: smtool: avoid using &foo[0] on std::vector, can cause UB
  TESTS: avoid using &foo[0] on std::vector, can cause UB
  JACK: avoid using &foo[0] on std::vector, can cause UB
  INSPECTOR: avoid using &foo[0] on std::vector, can cause UB
  LIB: avoid using &foo[0] on std::vector, can cause UB
  LIB: add override/final for GenericIn / GenericOut classes
  VST: use MMapIn::open_vector to fix UB access past last vector element
	As reported in PR #24.
  TOOLS: use MMapIn::open_vector to fix UB access past last vector element
	As reported in PR #24.
  LIB: use MMapIn::open_vector to fix UB access past last vector element
	As reported in PR #24.
  LIB: MMapIn: support open_vector function to read data from vector

Signed-off-by: Stefan Westerfeld <[email protected]>
@swesterfeld
Copy link
Owner

I ended up with adding a method MMapIn::open_vector which does the right thing. The code is merged now (d945467), I hope I found every spot in the code that needed fixing. At least a bit of testing worked for me.

@hfiguiere
Copy link
Author

BTW -Wp,-D_GLIBCXX_ASSERTIONS in CXXFLAGS is enough to trigger it. And UB sanitizer doesn't know about the C++ library. This is the semantincs of the [] operator.

Thanks !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants