Uploaded image for project: 'MariaDB MaxScale'
  1. MariaDB MaxScale
  2. MXS-1304

Invalid write in gw_str_xor

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: 2.1.3
    • Fix Version/s: 2.1.4
    • Component/s: Core
    • Labels:
      None

      Description

      ==31899==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd556a96a4 at pc 0x7f92af9d29cd bp 0x7ffd556a9540 sp 0x7ffd556a9530
      WRITE of size 1 at 0x7ffd556a96a4 thread T0
          #0 0x7f92af9d29cc in gw_str_xor /home/markusjm/MaxScale/server/core/utils.c:227
          #1 0x7f92a5456313 in load_hashed_password /home/markusjm/MaxScale/server/modules/protocol/MySQL/mysql_common.c:1231
          #2 0x7f92a5457030 in gw_send_backend_auth /home/markusjm/MaxScale/server/modules/protocol/MySQL/mysql_common.c:1393
          #3 0x7f92a4803948 in gw_read_backend_event /home/markusjm/MaxScale/server/modules/protocol/MySQL/MySQLBackend/mysql_backend.c:485
          #4 0x7f92af9b4f01 in process_pollq /home/markusjm/MaxScale/server/core/poll.c:999
          #5 0x7f92af9b3cd6 in poll_waitevents /home/markusjm/MaxScale/server/core/poll.c:777
          #6 0x40a66c in main /home/markusjm/MaxScale/server/core/gateway.cc:2035
          #7 0x7f92ad8cc400 in __libc_start_main (/lib64/libc.so.6+0x20400)
          #8 0x404469 in _start (/home/markusjm/build/bin/maxscale+0x404469)
       
      Address 0x7ffd556a96a4 is located in stack of thread T0 at offset 244 in frame
          #0 0x7f92a54560ee in load_hashed_password /home/markusjm/MaxScale/server/modules/protocol/MySQL/mysql_common.c:1215
       
        This frame has 4 object(s):
          [32, 52) 'hash1'
          [96, 116) 'hash2'
          [160, 180) 'new_sha'
          [224, 244) 'client_scramble' <== Memory access at offset 244 overflows this variable
      HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
            (longjmp and C++ exceptions *are* supported)
      SUMMARY: AddressSanitizer: stack-buffer-overflow /home/markusjm/MaxScale/server/core/utils.c:227 in gw_str_xor
      Shadow bytes around the buggy address:
        0x10002aacd280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x10002aacd290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x10002aacd2a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x10002aacd2b0: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 04 f4 f2 f2
        0x10002aacd2c0: f2 f2 00 00 04 f4 f2 f2 f2 f2 00 00 04 f4 f2 f2
      =>0x10002aacd2d0: f2 f2 00 00[04]f4 00 00 00 00 00 00 00 00 00 00
        0x10002aacd2e0: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f4
        0x10002aacd2f0: f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
        0x10002aacd300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x10002aacd310: 00 00 00 00 00 00 00 00 00 00 00 00 f4 f4 00 00
        0x10002aacd320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==31899==ABORTING
      

        Attachments

          Activity

            People

            Assignee:
            markus makela markus makela
            Reporter:
            markus makela markus makela
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: