Skip to content

fuzz: ASAN complaint on macOS with -fsanitize=fuzzer,address,undefined #19789

@Crypt-iQ

Description

@Crypt-iQ

Compiler: clang installed recently via brew install llvm
Machine: macOS v10.15.4 Catalina
configure script:

./configure --enable-fuzz --with-sanitizers=fuzzer,address,undefined --disable-asm

Error when running src/test/fuzz/process_messages harness:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==62428==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000096 (pc 0x7fff7396e98d bp 0x7ffee1ff7a70 sp 0x7ffee1ff7a70 T0)
==62428==The signal is caused by a WRITE memory access.
==62428==Hint: address points to the zero page.
    #0 0x7fff7396e98d in _platform_memmove$VARIANT$Haswell+0x8d (libsystem_platform.dylib:x86_64+0x98d)
    #1 0x112255f5c in __asan_memcpy+0x29c (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x41f5c)
    #2 0x10ea42578 in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > std::__1::operator+<char, std::__1::char_traits<char>, std::__1::allocator<char> >(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&&, char const*) string:4157
    #3 0x10ed7cf09 in BCLog::Logger::LogPrintStr(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) logging.cpp:245
    #4 0x10ddc6b3a in void LogPrintf<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >(char const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) logging.h:176
    #5 0x10ddc64d0 in InitLogging() init.cpp:885
    #6 0x10eebb369 in BasicTestingSetup::BasicTestingSetup(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::vector<char const*, std::__1::allocator<char const*> > const&) setup_common.cpp:100
    #7 0x10eebd320 in TestingSetup::TestingSetup(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::vector<char const*, std::__1::allocator<char const*> > const&) setup_common.cpp:128
    #8 0x10dc09bd8 in initialize() process_messages.cpp:23
    #9 0x10ef6c7c8 in LLVMFuzzerInitialize fuzz.cpp:52
    #10 0x10f1adf77 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) FuzzerDriver.cpp:616
    #11 0x10f1db8d2 in main FuzzerMain.cpp:19
    #12 0x7fff73778cc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

==62428==Register values:
rax = 0x0000000000000096  rbx = 0x0000000000000018  rcx = 0x0000000000000001  rdx = 0x0000000000000008  
rdi = 0x0000000000000096  rsi = 0x0000000110fae2c0  rbp = 0x00007ffee1ff7a70  rsp = 0x00007ffee1ff7a70  
 r8 = 0x0000000110fae200   r9 = 0x0000008752129480  r10 = 0x0000000000000004  r11 = 0xfffffffeef051dd6  
r12 = 0x0000000000000096  r13 = 0x0000000000000000  r14 = 0x0000000110fae2c0  r15 = 0x0000000000000096  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (libsystem_platform.dylib:x86_64+0x98d) in _platform_memmove$VARIANT$Haswell+0x8d
==62428==ABORTING
Abort trap: 6

It only occurs on my macOS with ASAN+UBSAN but not with ASAN alone. Does not occur on Ubuntu box.
Offending line:

str_prefixed.insert(0, "[" + util::ThreadGetInternalName() + "] ");

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions