Re: [dev] [sbase] grep: global-buffer-overflow

From: Carlos Torres <vlaadbrain_AT_gmail.com>
Date: Mon, 3 Nov 2025 10:53:54 -0500

for the benefit of the thread, here is the ASAN backtrace and memory
dump with 'grep -xsf A'

=================================================================
==114090==ERROR: AddressSanitizer: global-buffer-overflow on address
0x55555555a022 at pc 0x5555555574a1 bp 0x7fffffffd9f0 sp
0x7fffffffd9e0
READ of size 1 at 0x55555555a022 thread T0
    #0 0x5555555574a0 in addpattern /home/cjt/src/sbase/grep.c:60
    #1 0x555555557846 in addpatternfile /home/cjt/src/sbase/grep.c:96
    #2 0x55555555834a in main /home/cjt/src/sbase/grep.c:213
    #3 0x7ffff7427674 (/usr/lib/libc.so.6+0x27674) (BuildId:
4fe011c94a88e8aeb6f2201b9eb369f42b4a1e9e)
    #4 0x7ffff7427728 in __libc_start_main
(/usr/lib/libc.so.6+0x27728) (BuildId:
4fe011c94a88e8aeb6f2201b9eb369f42b4a1e9e)
    #5 0x5555555572e4 in _start (/home/cjt/src/sbase/grep+0x32e4)
(BuildId: dcb36777af50b79d8f264dfbe66653d14e5aafe5)

0x55555555a022 is located 0 bytes after global variable '*.LC0'
defined in 'grep.c' (0x55555555a020) of size 2
  '*.LC0' is ascii string '^'
0x55555555a022 is located 62 bytes before global variable '*.LC1'
defined in 'grep.c' (0x55555555a060) of size 1
  '*.LC1' is ascii string ''
SUMMARY: AddressSanitizer: global-buffer-overflow
/home/cjt/src/sbase/grep.c:60 in addpattern
Shadow bytes around the buggy address:
  0x555555559d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x555555559e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x555555559e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x555555559f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x555555559f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x55555555a000: 00 00 00 00[02]f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
  0x55555555a080: f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
  0x55555555a100: f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
  0x55555555a180: f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
  0x55555555a200: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 04 f9 f9
  0x55555555a280: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
==114090==ABORTING
[Inferior 1 (process 114090) exited with code 01]
(gdb)
Received on Mon Nov 03 2025 - 16:53:54 CET