stack-buffer-overflow in /matio-1.5.17/src/mat5.c:1369 ReadNextStructField
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
libmatio (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
stack-buffer-
lbb@lbb: /matio-
InflateRankDims: inflate returned data error
=======
==16263==ERROR: AddressSanitizer: stack-buffer-
READ of size 4 at 0x7ffe8f062b80 thread T0
#0 0x7ff86a7a097b in ReadNextStructField /matio-
#1 0x7ff86a79cdca in Mat_VarReadNext
#2 0x4dc498 in main /matio-
#3 0x7ff8695b582f in __libc_start_main /build/
#4 0x435b18 in _start (/matio-
Address 0x7ffe8f062b80 is located in stack of thread T0 at offset 160 in frame
#0 0x7ff86a79d60f in ReadNextStructField /matio-
This frame has 5 object(s):
[32, 40) 'nelems'
[64, 72) 'nelems_x_nfields'
[96, 160) 'uncomp_buf' <== Memory access at offset 160 overflows this variable
[192, 200) 'dims'
[224, 248) 'buf'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-
Shadow bytes around the buggy address:
0x100051e04520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100051e04530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100051e04540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100051e04550: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x100051e04560: 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 00 00 00
=>0x100051e0457
0x100051e04580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100051e04590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100051e045a0: 00 00 00 00 f1 f1 f1 f1 04 f2 04 f2 00 00 00 00
0x100051e045b0: 00 00 00 00 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 f3
0x100051e045c0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==16263==ABORTING