New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 901848 link

Starred by 1 user

Issue metadata

Status: Untriaged
Owner: ----
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

ASAN should point out when it crashes on an address that looks like unitialized memory

Project Member Reported by metzman@chromium.org, Nov 5

Issue description

As requested by brucedawson@ in crbug.com/897872#c34

The meaning of 0xBEBEBEBE... should be front-and-center. That is, if crbug.com/901847 is addressed so that we know the actual address then asan could actually say, in its summary "This address looks like uninitialized memory", or "unfreed memory", or whatever other magic types there are. Looking it up in the documentation doesn't scale well.

 
Description: Show this description
Labels: Pri-2
Cc: r...@chromium.org brucedaw...@chromium.org mascasa@google.com
rnk@ do you think this is worth doing and what do you think of doing this in ASAN? Or do you think it is something that should be done in ClusterFuzz
Cc: metzman@chromium.org
Status: Available (was: Untriaged)
One significant complicating factor is that for 64-bit processes the address will not be available. On Windows it will be reported as 2^64-1 and (apparently) on Linux it will be reported as zero. In order to figure out the address you (seriously) need to decode the instruction and look at the registers. This has been done, but it's not trivial:

https://twitter.com/TedMielczarek/status/1058526486414721025

The second best thing which is much simpler is to go:

  if (ex->ExceptionAddress == 0xFFFFFFFFFFFFFFFF)
    printf("p was possibly -1, but ¯\_(ツ)_/¯\n");
  else
    printf("p was 0x%p\n", ex->ExceptionAddress);
https://twitter.com/BruceDawson0xB/status/1058503844462649344

That is, encode the fact that 0xFFFFFFFFFFFFFFFF doesn't mean that address was involved. It just means a non-canonical address was involved.

Cc: kcc@chromium.org euge...@chromium.org
This seems like it would be a cross-platform improvement, so I'll redirect the suggestion to Kostya and Evgenii.
Other options would be for asan to handle this. That is, if asan is instrumenting every memory access then it could detect when addresses are >= 2^47 and handle them differently, some how.
Status: Untriaged (was: Available)
Available, but no owner or component? Please find a component, as no one will ever find this without one.

Sign in to add a comment