Running testsuite with -fsanitize=address fails on 1.5.0

[Dirk Mueller]

It looks like there is an underflow when running the test suite:

==3809==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000067c564 at pc 0x00000040a4bb bp 0x7ffc6ede6120 sp 0x7ffc6ede6118
READ of size 4 at 0x00000067c564 thread T0
    #0 0x40a4ba in fragments_needed_three_data /data/dmueller/src/tmp/liberasurecode/src/builtin/xor_codes/xor_hd_code.c:159
    #1 0x40a4ba in xor_hd_fragments_needed /data/dmueller/src/tmp/liberasurecode/src/builtin/xor_codes/xor_hd_code.c:275
    #2 0x402438 in test_hd_code builtin/xor_codes/test_xor_hd_code.c:156
    #3 0x40472a in run_test builtin/xor_codes/test_xor_hd_code.c:264
    #4 0x401348 in main builtin/xor_codes/test_xor_hd_code.c:377
    #5 0x7fdb35a95f49 in __libc_start_main (/lib64/libc.so.6+0x20f49)
    #6 0x401449 in _start (/data/dmueller/src/tmp/liberasurecode/test/test_xor_hd_code+0x401449)

0x00000067c564 is located 28 bytes to the left of global variable 'g_6_6_4_hd_code_parity_bms' defined in '../../../include/xor_codes/xor_hd_code_defs.h:63:14' (0x67c580) of size 24
0x00000067c564 is located 12 bytes to the right of global variable 'g_6_6_4_hd_code_data_bms' defined in '../../../include/xor_codes/xor_hd_code_defs.h:64:14' (0x67c540) of size 24
SUMMARY: AddressSanitizer: global-buffer-overflow /data/dmueller/src/tmp/liberasurecode/src/builtin/xor_codes/xor_hd_code.c:159 in fragments_needed_three_data
Shadow bytes around the buggy address:
  0x0000800c7850: 00 04 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x0000800c7860: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9
  0x0000800c7870: f9 f9 f9 f9 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c7880: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
  0x0000800c7890: 00 00 00 f9 f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9
=>0x0000800c78a0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 f9[f9]f9 f9 f9
  0x0000800c78b0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 04
  0x0000800c78c0: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800c78d0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x0000800c78e0: 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 00 00 00 f9
  0x0000800c78f0: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
==3809==ABORTING
make: *** [Makefile:965: test] Error 1

[Tim Burke (1-tim-z)]

OK, finally got around to repro'ing! For anyone not familiar with -fsanitize=address (I wasn't), you'll need to install libasan and run something like

 CFLAGS=-fsanitize=address ./configure

when configuring. When running tests, I got

 ERROR: AddressSanitizer: odr-violation (0x7fcbcae09020):
   [1] size=8 'ilog_table_begin' builtin/rs_vand/rs_galois.c:46:6
   [2] size=8 'ilog_table_begin' rs_galois.c:46:6
 These globals were registered at these points:
   ...

but taking the hint and running with something like

 ASAN_OPTIONS=detect_odr_violation=0 make test

I could repro the reported issue. It took me a bit to make sense of what it was telling me -- when running the decode benchmark with k=6, m=6, hd=4 the array indexing at https://opendev.org/openstack/liberasurecode/src/branch/master/src/builtin/xor_codes/xor_hd_code.c#L159 could leave the bounds of g_6_6_4_hd_code_parity_bms. Specifically, you could have parity_index == -1, leading to the code trying to index with [-7] (which with 4-byte ints gets us the 28-byte offset mentioned).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/liberasurecode/+/794137

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/liberasurecode/+/794137
Committed: https://opendev.org/openstack/liberasurecode/commit/a7e1ddf685af09c9ad99dc2641067a846d8c88e8
Submitter: "Zuul (22348)"
Branch: master

commit a7e1ddf685af09c9ad99dc2641067a846d8c88e8
Author: Tim Burke <email address hidden>
Date: Tue Jun 1 23:08:11 2021 -0700

    Fix underflow in flat_xor_hd code

    Change-Id: I9102f9883e979862557bd33958b2d116795b3169
    Closes-Bug: #1726816