Skip to content

[CRASH] ASSERTION FAILED and stack-buffer-overflow in networking.c:1026 #10076

@zyingp

Description

@zyingp

Crash report

13886:C 08 Jan 2022 07:29:07.000 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
13886:C 08 Jan 2022 07:29:07.000 # Redis version=255.255.255, bits=64, commit=00000000, modified=0, pid=13886, just started
13886:C 08 Jan 2022 07:29:07.001 # Warning: no config file specified, using the default config. In order to specify a config file use ./redis-server-2022-1-2-ASAN /path/to/redis.conf
13886:M 08 Jan 2022 07:29:07.002 * Increased maximum number of open files to 10032 (it was originally set to 1024).
13886:M 08 Jan 2022 07:29:07.003 * monotonic clock: POSIX clock_gettime
                _._
           _.-``__ ''-._
      _.-``    `.  `_.  ''-._           Redis 255.255.255 (00000000/0) 64 bit
  .-`` .-```.  ```\/    _.,_ ''-._
 (    '      ,       .-`  | `,    )     Running in standalone mode
 |`-._`-...-` __...-.``-._|'` _.-'|     Port: 6379
 |    `-._   `._    /     _.-'    |     PID: 13886
  `-._    `-._  `-./  _.-'    _.-'
 |`-._`-._    `-.__.-'    _.-'_.-'|
 |    `-._`-._        _.-'_.-'    |           https://redis.io
  `-._    `-._`-.__.-'_.-'    _.-'
 |`-._`-._    `-.__.-'    _.-'_.-'|
 |    `-._`-._        _.-'_.-'    |
  `-._    `-._`-.__.-'_.-'    _.-'
      `-._    `-.__.-'    _.-'
          `-._        _.-'
              `-.__.-'

13886:M 08 Jan 2022 07:29:07.009 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.
13886:M 08 Jan 2022 07:29:07.009 # Server initialized
13886:M 08 Jan 2022 07:29:07.010 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
13886:M 08 Jan 2022 07:29:07.013 * Loading RDB produced by version 255.255.255
13886:M 08 Jan 2022 07:29:07.013 * RDB age 224269 seconds
13886:M 08 Jan 2022 07:29:07.014 * RDB memory usage when created 0.82 Mb
13886:M 08 Jan 2022 07:29:07.014 * Done loading RDB, keys loaded: 60, keys expired: 0.
13886:M 08 Jan 2022 07:29:07.014 * DB loaded from disk: 0.002 seconds
13886:M 08 Jan 2022 07:29:07.014 * Ready to accept connections
13886:M 08 Jan 2022 07:30:11.606 * Replica 127.0.0.1:<unknown-replica-port> asks for synchronization
13886:M 08 Jan 2022 07:30:11.607 * Partial resynchronization not accepted: Replication ID mismatch (Replica asked for 'replicationid', my replication IDs are 'ba3f222f42df34fbf727ff0424d362fddbac19c4' and '304487fdad84b21fb9cded15b081113116e71d4a')
13886:M 08 Jan 2022 07:30:11.608 * Starting BGSAVE for SYNC with target: disk
13886:M 08 Jan 2022 07:30:12.124 * Background saving started by pid 13898


=== REDIS BUG REPORT START: Cut & paste starting from here ===
13886:M 08 Jan 2022 07:30:12.126 # === ASSERTION FAILED ===
13886:M 08 Jan 2022 07:30:12.127 # ==> networking.c:1026 'c->bufpos == 0 && listLength(c->reply) == 0' is not true

------ STACK TRACE ------

Backtrace:
./redis-server-2022-1-2-ASAN *:6379(_serverAssert+0x83)[0x7fb36b62c1b3]
./redis-server-2022-1-2-ASAN *:6379(clientHasPendingReplies+0x1ed)[0x7fb36b56cf5d]
./redis-server-2022-1-2-ASAN *:6379(prepareClientToWrite+0x6a)[0x7fb36b56d01a]
./redis-server-2022-1-2-ASAN *:6379(addReply+0x93)[0x7fb36b575613]
./redis-server-2022-1-2-ASAN *:6379(addReplyLongLongWithPrefix+0x1a7)[0x7fb36b57a967]
./redis-server-2022-1-2-ASAN *:6379(slowlogCommand+0x41e)[0x7fb36b65f10e]
./redis-server-2022-1-2-ASAN *:6379(call+0x11b)[0x7fb36b52cedb]
./redis-server-2022-1-2-ASAN *:6379(processCommand+0xb4f)[0x7fb36b530c1f]
./redis-server-2022-1-2-ASAN *:6379(processCommandAndResetClient+0x3e)[0x7fb36b57196e]
./redis-server-2022-1-2-ASAN *:6379(processInputBuffer+0x24e)[0x7fb36b579d7e]
./redis-server-2022-1-2-ASAN *:6379(readQueryFromClient+0x9b8)[0x7fb36b581888]
./redis-server-2022-1-2-ASAN *:6379(+0x330597)[0x7fb36b730597]
./redis-server-2022-1-2-ASAN *:6379(aeProcessEvents+0x4ec)[0x7fb36b51a44c]
./redis-server-2022-1-2-ASAN *:6379(aeMain+0x4d)[0x7fb36b51b30d]
./redis-server-2022-1-2-ASAN *:6379(main+0x442)[0x7fb36b50e3d2]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7)[0x7fb369491b97]
./redis-server-2022-1-2-ASAN *:6379(_start+0x2a)[0x7fb36b50fe3a]

------ INFO OUTPUT ------
13898:C 08 Jan 2022 07:30:12.142 * DB saved on disk
# Server
redis_version:255.255.255
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:41175f004c38f34d
redis_mode:standalone
os:Linux 4.4.0-19041-Microsoft x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:c11-builtin
gcc_version:7.5.0
process_id:13886
process_supervised:no
run_id:93e5ce2ba2afb2adb037d8b22ba1a98c7b056cdd
tcp_port:6379
server_time_usec:1641598212124840
uptime_in_seconds:65
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:14208259
executable:/mnt/d/zyp/fuzzer/memdbFuzz/visualstudio/afl-vs-raw/afl-vs-raw/bin/x64/Debug/./redis-server-2022-1-2-ASAN
config_file:
io_threads_active:0

# Clients
connected_clients:0
cluster_connections:0
maxclients:10000
client_recent_max_input_buffer:0
client_recent_max_output_buffer:0
blocked_clients:0
tracking_clients:0
clients_in_timeout_table:0

# Memory
used_memory:902984
used_memory_human:881.82K
used_memory_rss:17035264
used_memory_rss_human:16.25M
used_memory_peak:902984
used_memory_peak_human:881.82K
used_memory_peak_perc:100.20%
used_memory_overhead:851076
used_memory_startup:847960
used_memory_dataset:51908
used_memory_dataset_perc:94.34%
allocator_allocated:1013328
allocator_active:1212416
allocator_resident:4624384
total_system_memory:8359202816
total_system_memory_human:7.79G
used_memory_lua:37888
used_memory_vm_eval:37888
used_memory_lua_human:37.00K
used_memory_scripts_eval:0
number_of_cached_scripts:0
number_of_functions:0
used_memory_vm_functions:35840
used_memory_vm_total:73728
used_memory_vm_total_human:72.00K
used_memory_functions:168
used_memory_scripts:168
used_memory_scripts_human:168B
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.20
allocator_frag_bytes:199088
allocator_rss_ratio:3.81
allocator_rss_bytes:3411968
rss_overhead_ratio:3.68
rss_overhead_bytes:12410880
mem_fragmentation_ratio:19.82
mem_fragmentation_bytes:16175864
mem_not_counted_for_evict:0
mem_replication_backlog:4
mem_total_replication_buffers:0
mem_clients_slaves:0
mem_clients_normal:0
mem_cluster_links:0
mem_aof_buffer:0
mem_allocator:jemalloc-5.2.1
active_defrag_running:0
lazyfree_pending_objects:0
lazyfreed_objects:0

# Persistence
loading:0
async_loading:0
current_cow_peak:0
current_cow_size:0
current_cow_size_age:0
current_fork_perc:0.00
current_save_keys_processed:0
current_save_keys_total:60
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:1
rdb_last_save_time:1641598147
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:-1
rdb_current_bgsave_time_sec:0
rdb_last_cow_size:0
rdb_last_load_keys_expired:0
rdb_last_load_keys_loaded:60
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0
module_fork_in_progress:0
module_fork_last_cow_size:0

# Stats
total_connections_received:1
total_commands_processed:1
instantaneous_ops_per_sec:0
total_net_input_bytes:58
total_net_output_bytes:0
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:1
sync_partial_ok:0
sync_partial_err:1
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
expire_cycle_cpu_milliseconds:2
evicted_keys:0
evicted_clients:0
total_eviction_exceeded_time:0
current_eviction_exceeded_time:0
keyspace_hits:0
keyspace_misses:0
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:514741
total_forks:1
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
total_active_defrag_time:0
current_active_defrag_time:0
tracking_total_keys:0
tracking_total_items:0
tracking_total_prefixes:0
unexpected_error_replies:0
total_error_replies:0
dump_payload_sanitizations:0
total_reads_processed:1
total_writes_processed:0
io_threaded_reads_processed:0
io_threaded_writes_processed:0

# Replication
role:master
connected_slaves:1
slave0:ip=127.0.013898:C 08 Jan 2022 07:30:12.149 * Fork CoW for RDB: current 0 MB, peak 0 MB, average 0 MB
.1,port=0,state=wait_bgsave,offset=0,lag=0
master_failover_state:no-failover
master_replid:ba3f222f42df34fbf727ff0424d362fddbac19c4
master_replid2:304487fdad84b21fb9cded15b081113116e71d4a
master_repl_offset:28
second_repl_offset:29
repl_backlog_active:1
repl_backlog_size:1048576
repl_backlog_first_byte_offset:29
repl_backlog_histlen:0

# CPU
used_cpu_sys:0.031250
used_cpu_user:0.015625
used_cpu_sys_children:0.000000
used_cpu_user_children:0.000000
used_cpu_sys_main_thread:0.031250
used_cpu_user_main_thread:0.015625

# Modules

# Commandstats
cmdstat_psync:calls=1,usec=519279,usec_per_call=519279.00,rejected_calls=0,failed_calls=0

# Errorstats

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=60,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------
id=4 addr=127.0.0.1:11428 laddr=127.0.0.1:6379 fd=8 name= age=1 idle=1 flags=S db=0 sub=0 psub=0 multi=-1 qbuf=58 qbuf-free=20416 argv-mem=11 multi-mem=0 obl=0 oll=1 omem=0 tot-mem=40995 events=r cmd=slowlog|get user=default redir=-1 resp=2

------ CURRENT CLIENT INFO ------
id=4 addr=127.0.0.1:11428 laddr=127.0.0.1:6379 fd=8 name= age=1 idle=1 flags=S db=0 sub=0 psub=0 multi=-1 qbuf=58 qbuf-free=20416 argv-mem=11 multi-mem=0 obl=0 oll=1 omem=0 tot-mem=40995 events=r cmd=slowlog|get user=default redir=-1 resp=2
argv[0]: 'SLOWLOG'
argv[1]: 'GET'
argv[2]: '3'

------ MODULES INFO OUTPUT ------

------ CONFIG DEBUG OUTPUT ------
io-threads-do-reads no
lazyfree-lazy-eviction no
lazyfree-lazy-expire no
lazyfree-lazy-server-del no
lazyfree-lazy-user-del no
lazyfree-lazy-user-flush no
repl-diskless-sync no
replica-read-only yes
activedefrag no
repl-diskless-load disabled
sanitize-dump-payload no
io-threads 1
list-compress-depth 0
proto-max-bulk-len 512mb
client-query-buffer-limit 1gb

------ FAST MEMORY TEST ------
13886:M 08 Jan 2022 07:30:12.176 # Bio thread for job type #0 terminated
13886:M 08 Jan 2022 07:30:12.176 # Bio thread for job type #1 terminated
13886:M 08 Jan 2022 07:30:12.176 # Bio thread for job type #2 terminated
*** Preparing to test memory region 7fff7000 (268435456 bytes)
*** Preparing to test memory region 2008fff7000 (15392894357504 bytes)
*** Preparing to test memory region 602000000000 (65536 bytes)
*** Preparing to test memory region 602e00000000 (65536 bytes)
*** Preparing to test memory region 603000000000 (65536 bytes)
*** Preparing to test memory region 603e00000000 (65536 bytes)
*** Preparing to test memory region 604000000000 (65536 bytes)
*** Preparing to test memory region 604e00000000 (65536 bytes)
*** Preparing to test memory region 606000000000 (65536 bytes)
*** Preparing to test memory region 606e00000000 (65536 bytes)
*** Preparing to test memory region 607000000000 (65536 bytes)
*** Preparing to test memory region 607e00000000 (65536 bytes)
*** Preparing to test memory region 608000000000 (65536 bytes)
*** Preparing to test memory region 608e00000000 (65536 bytes)
*** Preparing to test memory region 60b000000000 (65536 bytes)
*** Preparing to test memory region 60be00000000 (65536 bytes)
*** Preparing to test memory region 60c000000000 (65536 bytes)
*** Preparing to test memory region 60ce00000000 (65536 bytes)
*** Preparing to test memory region 60d000000000 (65536 bytes)
*** Preparing to test memory region 60de00000000 (65536 bytes)
*** Preparing to test memory region 60e000000000 (65536 bytes)
*** Preparing to test memory region 60ee00000000 (65536 bytes)
*** Preparing to test memory region 60f000000000 (65536 bytes)
*** Preparing to test memory region 60fe00000000 (65536 bytes)
*** Preparing to test memory region 610000000000 (65536 bytes)
*** Preparing to test memory region 610e00000000 (65536 bytes)
*** Preparing to test memory region 611000000000 (65536 bytes)
*** Preparing to test memory region 611e00000000 (65536 bytes)
*** Preparing to test memory region 612000000000 (65536 bytes)
*** Preparing to test memory region 612e00000000 (65536 bytes)
*** Preparing to test memory region 613000000000 (65536 bytes)
*** Preparing to test memory region 613e00000000 (65536 bytes)
*** Preparing to test memory region 615000000000 (65536 bytes)
*** Preparing to test memory region 615e00000000 (65536 bytes)
*** Preparing to test memory region 616000000000 (65536 bytes)
*** Preparing to test memory region 616e00000000 (65536 bytes)
*** Preparing to test memory region 617000000000 (65536 bytes)
*** Preparing to test memory region 617e00000000 (65536 bytes)
*** Preparing to test memory region 619000000000 (65536 bytes)
*** Preparing to test memory region 619e00000000 (65536 bytes)
*** Preparing to test memory region 61a000000000 (65536 bytes)
*** Preparing to test memory region 61ae00000000 (65536 bytes)
*** Preparing to test memory region 61b000000000 (65536 bytes)
*** Preparing to test memory region 61be00000000 (65536 bytes)
*** Preparing to test memory region 61d000000000 (65536 bytes)
*** Preparing to test memory region 61de00000000 (65536 bytes)
*** Preparing to test memory region 61e000000000 (65536 bytes)
*** Preparing to test memory region 61ee00000000 (65536 bytes)
*** Preparing to test memory region 621000000000 (65536 bytes)
*** Preparing to test memory region 621e00000000 (65536 bytes)
*** Preparing to test memory region 624000000000 (327680 bytes)
*** Preparing to test memory region 624e00000000 (65536 bytes)
*** Preparing to test memory region 640000000000 (12288 bytes)
*** Preparing to test memory region 7fb3638c1000 (8388608 bytes)
*** Preparing to test memory region 7fb3640d1000 (8388608 bytes)
*** Preparing to test memory region 7fb3648e1000 (8388608 bytes)
*** Preparing to test memory region 7fb3650f1000 (8388608 bytes)
*** Preparing to test memory region 7fb365c00000 (8388608 bytes)
*** Preparing to test memory region 7fb366500000 (1048576 bytes)
*** Preparing to test memory region 7fb366700000 (1048576 bytes)
*** Preparing to test memory region 7fb366890000 (32768 bytes)
*** Preparing to test memory region 7fb3668a0000 (57344 bytes)
*** Preparing to test memory region 7fb366900000 (1048576 bytes)
*** Preparing to test memory region 7fb366a10000 (69632 bytes)
*** Preparing to test memory region 7fb366a30000 (4096 bytes)
*** Preparing to test memory region 7fb366a40000 (4096 bytes)
*** Preparing to test memory region 7fb366a50000 (4096 bytes)
*** Preparing to test memory region 7fb366a60000 (4096 bytes)
*** Preparing to test memory region 7fb366a70000 (4096 bytes)
*** Preparing to test memory region 7fb366a80000 (4096 bytes)
*** Preparing to test memory region 7fb366a90000 (4096 bytes)
*** Preparing to test memory region 7fb366aa0000 (4096 bytes)
*** Preparing to test memory region 7fb366ab0000 (4096 bytes)
*** Preparing to test memory region 7fb366ac0000 (4096 bytes)
*** Preparing to test memory region 7fb366ad0000 (4096 bytes)
*** Preparing to test memory region 7fb366ae0000 (4096 bytes)
*** Preparing to test memory region 7fb366af0000 (4096 bytes)
*** Preparing to test memory region 7fb366b00000 (1052672 bytes)
*** Preparing to test memory region 7fb366c10000 (4096 bytes)
*** Preparing to test memory region 7fb366c20000 (4096 bytes)
*** Preparing to test memory region 7fb366c30000 (4096 bytes)
*** Preparing to test memory region 7fb366c40000 (4096 bytes)
*** Preparing to test memory region 7fb366c50000 (4096 bytes)
*** Preparing to test memory region 7fb366c60000 (4096 bytes)
*** Preparing to test memory region 7fb366c70000 (4096 bytes)
*** Preparing to test memory region 7fb366c80000 (4096 bytes)
*** Preparing to test memory region 7fb366c90000 (4096 bytes)
*** Preparing to test memory region 7fb366ca0000 (4096 bytes)
*** Preparing to test memory region 7fb366cb0000 (4096 bytes)
*** Preparing to test memory region 7fb366cc0000 (4096 bytes)
*** Preparing to test memory region 7fb366cd0000 (4096 bytes)
*** Preparing to test memory region 7fb366ce0000 (37036032 bytes)
*** Preparing to test memory region 7fb369257000 (4096 bytes)
*** Preparing to test memory region 7fb369467000 (4096 bytes)
*** Preparing to test memory region 7fb36985b000 (8192 bytes)
*** Preparing to test memory region 7fb36985d000 (16384 bytes)
*** Preparing to test memory region 7fb369a8a000 (4096 bytes)
*** Preparing to test memory region 7fb369a8b000 (16384 bytes)
*** Preparing to test memory region 7fb369c93000 (4096 bytes)
*** Preparing to test memory region 7fb36a03d000 (4096 bytes)
*** Preparing to test memory region 7fb36a393000 (12288 bytes)
*** Preparing to test memory region 7fb36a396000 (12996608 bytes)
*** Preparing to test memory region 7fb36b030000 (4096 bytes)
*** Preparing to test memory region 7fb36b040000 (659456 bytes)
*** Preparing to test memory region 7fb36b0f0000 (4096 bytes)
*** Preparing to test memory region 7fb36b100000 (4096 bytes)
*** Preparing to test memory region 7fb36b110000 (4096 bytes)
*** Preparing to test memory region 7fb36b120000 (4096 bytes)
*** Preparing to test memory region 7fb36b130000 (4096 bytes)
*** Preparing to test memory region 7fb36b140000 (4096 bytes)
*** Preparing to test memory region 7fb36b150000 (73728 bytes)
*** Preparing to test memory region 7fb36b170000 (4096 bytes)
*** Preparing to test memory region 7fb36b180000 (4096 bytes)
*** Preparing to test memory region 7fb36b190000 (4096 bytes)
*** Preparing to test memory region 7fb36b1a0000 (16384 bytes)
*** Preparing to test memory region 7fb36b1b0000 (4096 bytes)
*** Preparing to test memory region 7fb36b1c0000 (4096 bytes)
*** Preparing to test memory region 7fb36b1d0000 (57344 bytes)
*** Preparing to test memory region 7fb36b1e0000 (4096 bytes)
*** Preparing to test memory region 7fb36b1f0000 (32768 bytes)
*** Preparing to test memory region 7fb36b200000 (4096 bytes)
*** Preparing to test memory region 7fb36b210000 (8192 bytes)
*** Preparing to test memory region 7fb36b220000 (4096 bytes)
*** Preparing to test memory region 7fb36b228000 (4096 bytes)
*** Preparing to test memory region 7fb36b229000 (4096 bytes)
*** Preparing to test memory region 7fb36b230000 (8192 bytes)
*** Preparing to test memory region 7fb36b240000 (16384 bytes)
*** Preparing to test memory region 7fb36b250000 (8192 bytes)
=================================================================
==13886==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffff2710b10 at pc 0x7fb36b62b960 bp 0x7ffff27106a0 sp 0x7ffff2710690
WRITE of size 8 at 0x7ffff2710b10 thread T0
    #0 0x7fb36b62b95f in memtest_test_linux_anonymous_maps /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/debug.c:1787
    #1 0x7fb36b62ba14 in doFastMemoryTest /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/debug.c:1841
    #2 0x7fb36b62c1b7 in _serverAssert /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/debug.c:976
    #3 0x7fb36b56cf5c in clientHasPendingReplies /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:1026
    #4 0x7fb36b56d019 in prepareClientToWrite /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:288
    #5 0x7fb36b575612 in addReply /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:382
    #6 0x7fb36b57a966 in addReplyLongLongWithPrefix /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:773
    #7 0x7fb36b65f10d in slowlogCommand /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/slowlog.c:190
    #8 0x7fb36b52ceda in call /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/server.c:3029
    #9 0x7fb36b530c1e in processCommand /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/server.c:3606
    #10 0x7fb36b57196d in processCommandAndResetClient /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:2171
    #11 0x7fb36b579d7d in processInputBuffer /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:2266
    #12 0x7fb36b581887 in readQueryFromClient /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/networking.c:2378
    #13 0x7fb36b730596 in callHandler /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/connhelpers.h:79
    #14 0x7fb36b730596 in connSocketEventHandler /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/connection.c:295
    #15 0x7fb36b51a44b in aeProcessEvents /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/ae.c:428
    #16 0x7fb36b51b30c in aeMain /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/ae.c:488
    #17 0x7fb36b50e3d1 in main /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/server.c:6541
    #18 0x7fb369491b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #19 0x7fb36b50fe39 in _start (/mnt/d/zyp/fuzzer/memdbFuzz/visualstudio/afl-vs-raw/afl-vs-raw/bin/x64/Debug/redis-server-2022-1-2-ASAN+0x10fe39)

Address 0x7ffff2710b10 is located in stack of thread T0 at offset 1056 in frame
    #0 0x7fb36b62b3cf in memtest_test_linux_anonymous_maps /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/debug.c:1752

  This frame has 4 object(s):
    [32, 1056) 'start_vect' <== Memory access at offset 1056 overflows this variable
    [1088, 2112) 'size_vect'
    [2144, 3168) 'line'
    [3200, 4224) 'logbuf'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /mnt/d/zyp/fuzzer/fuzzed_projects/redis/redis-latest/redis-unstable/src/debug.c:1787 in memtest_test_linux_anonymous_maps
Shadow bytes around the buggy address:
  0x10007e4da110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007e4da160: 00 00[f2]f2 f2 f2 00 00 00 00 00 00 00 00 00 00
  0x10007e4da170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e4da1b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==13886==ABORTING


Additional information

  1. OS distribution and version
    OS: Window WSL v1.
    Redis version: the unstable branch, commit #5460c10 (2022-1-3)

  2. Steps to reproduce (if any)
    (a) Build redis code with ASAN
    CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer " LDFLAGS="-g -O0 -fsanitize=address " make
    (b) Download the PoC input file from https://raw.githubusercontent.com/zyingp/temp/master/redis/crash_StackOverFlow_prepareClientToWrite
    (c) Start the redis server in one console.
    ./redis-server
    (d) Open another console and run nc with the input file like:
    nc 127.0.0.1 6379 < "./crash_StackOverFlow_prepareClientToWrite"
    (e) The server crashes.

    I found the crash by fuzzing.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions