[Bug sanitizer/80166] SANITIZER_INTERCEPT_GETGROUPS modifies list when size is 0 Out-of-bounds write
marxin at gcc dot gnu.org
gcc-bugzilla@gcc.gnu.org
Fri Mar 24 12:18:00 GMT 2017
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80166
--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Another problem is that for a negative number, returned value is -1 (error).
And thus libsanitizer crashes:
==7910==ERROR: AddressSanitizer: negative-size-param: (size=-4)
#0 0x7ff25bcd6a00 in __interceptor_getgroups
(/usr/lib64/libasan.so.3+0x50a00)
#1 0x4009fb in main /home/marxin/Programming/testcases/pr80166.c:9
#2 0x7ff25b901540 in __libc_start_main (/lib64/libc.so.6+0x20540)
#3 0x400899 in _start
(/home/marxin/Programming/testcases/get_group+0x400899)
More information about the Gcc-bugs
mailing list