sanitizer_common: fix crashes in parsing of memory profiles

[dvyukov]

Summary

ParseUnixMemoryProfile assumes well-formed input with \n at the end, etc.
It can over-read the input and crash on basically every line
in the case of malformed input.
ReadFileToBuffer has cap the max file size (64MB) and returns
truncated contents if the file is larger. Thus even if kernel behaves,
ParseUnixMemoryProfile crashes on too large /proc/self/smaps.
Fix input over-reading in ParseUnixMemoryProfile.

Depends on D112792.

[melver]

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cpp

163–174

why is the (char*) cast needed? smaps is already a char*.

171

s/well-format/well-formed/ ?

compiler-rt/lib/sanitizer_common/tests/sanitizer_procmaps_test.cpp

124

Just normal lambda function instead

[dvyukov]

adderessed comments

[jansvoboda11]

I suspect this broke the Mac build bot: https://green.lab.llvm.org/green/job/clang-stage1-RA/25101/console

Can you please take a look and revert if the fix would take a while?

[dvyukov]

Hi Jan,

I am looking into this. Thanks for the report.

[dvyukov]

I've sent https://reviews.llvm.org/D112815

compiler-rt/lib/sanitizer_common/sanitizer_common.h

 };
 
 typedef void (*fill_profile_f)(uptr start, uptr rss, bool file,
                                /*out*/ uptr *stats);
 
 // Parse the contents of /proc/self/smaps and generate a memory profile.
 // |cb| is a tool-specific callback that fills the |stats| array.
 void GetMemoryProfile(fill_profile_f cb, uptr *stats);
-void ParseUnixMemoryProfile(fill_profile_f cb, uptr *stats, const char *smaps,
+void ParseUnixMemoryProfile(fill_profile_f cb, uptr *stats, char *smaps,
                             uptr smaps_len);
 
 // Simple low-level (mmap-based) allocator for internal use. Doesn't have
 // constructor, so all instances of LowLevelAllocator should be
 // linker initialized.
 class LowLevelAllocator {
  public:
   // Requires an external lock.

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cpp

void GetMemoryProfile(fill_profile_f cb, uptr *stats) {
   uptr smaps_cap = 0;
   uptr smaps_len = 0;
   if (!ReadFileToBuffer("/proc/self/smaps", &smaps, &smaps_cap, &smaps_len))
     return;
   ParseUnixMemoryProfile(cb, stats, smaps, smaps_len);
   UnmapOrDie(smaps, smaps_cap);
 }
 
-void ParseUnixMemoryProfile(fill_profile_f cb, uptr *stats, const char *smaps,
+void ParseUnixMemoryProfile(fill_profile_f cb, uptr *stats, char *smaps,
                             uptr smaps_len) {
   uptr start = 0;
   bool file = false;
   const char *pos = smaps;
-  while (pos < smaps + smaps_len) {
+  char *end = smaps + smaps_len;
+  if (smaps_len < 2)
+    return;
+  // The following parsing can crash on almost every line
+  // in the case of malformed/truncated input.
+  // Fixing that is hard b/c e.g. ParseDecimal does not
+  // even accept end of the buffer and assumes well-formed input.
+  // So instead we patch end of the input a bit,
+  // it does not affect well-formed complete inputs.
+  *--end = 0;
+  *--end = '\n';
+  while (pos < end) {
     if (IsHex(pos[0])) {
       start = ParseHex(&pos);
       for (; *pos != '/' && *pos > '\n'; pos++) {}
       file = *pos == '/';
     } else if (internal_strncmp(pos, "Rss:", 4) == 0) {
-      while (!IsDecimal(*pos)) pos++;
+      while (pos < end && !IsDecimal(*pos)) pos++;
       uptr rss = ParseDecimal(&pos) * 1024;
       cb(start, rss, file, stats);
     }
     while (*pos++ != '\n') {}
   }
 }
 
 } // namespace __sanitizer
 
 #endif

compiler-rt/lib/sanitizer_common/tests/sanitizer_procmaps_test.cpp

for (uptr i = 0; i < modules.size(); ++i) {
       }
       const u8 *uuid = modules[i].uuid();
       u8 null_uuid[kModuleUUIDSize] = {0};
       EXPECT_NE(memcmp(null_uuid, uuid, kModuleUUIDSize), 0);
     }
   }
 }
 
-TEST(MemoryMapping, ParseUnixMemoryProfile) {
-  struct entry {
-    uptr p;
-    uptr rss;
-    bool file;
-  };
-  typedef std::vector<entry> entries_t;
-  const char *input = R"(
+const char *const parse_unix_input = R"(
 7fb9862f1000-7fb9862f3000 rw-p 00000000 00:00 0 
 Size:                  8 kB
 Rss:                   4 kB
 7fb9864ae000-7fb9864b1000 r--p 001ba000 fd:01 22413919                   /lib/x86_64-linux-gnu/libc-2.32.so
 Size:                 12 kB
 Rss:                  12 kB
 )";
+
+TEST(MemoryMapping, ParseUnixMemoryProfile) {
+  struct entry {
+    uptr p;
+    uptr rss;
+    bool file;
+  };
+  typedef std::vector<entry> entries_t;
   entries_t entries;
+  std::vector<char> input(parse_unix_input,
+                          parse_unix_input + strlen(parse_unix_input));
   ParseUnixMemoryProfile(
       [](uptr p, uptr rss, bool file, uptr *mem) {
         reinterpret_cast<entries_t *>(mem)->push_back({p, rss, file});
       },
-      reinterpret_cast<uptr *>(&entries), input, strlen(input));
+      reinterpret_cast<uptr *>(&entries), &input[0], input.size());
   EXPECT_EQ(entries.size(), 2ul);
   EXPECT_EQ(entries[0].p, 0x7fb9862f1000ul);
   EXPECT_EQ(entries[0].rss, 4ul << 10);
   EXPECT_EQ(entries[0].file, false);
   EXPECT_EQ(entries[1].p, 0x7fb9864ae000ul);
   EXPECT_EQ(entries[1].rss, 12ul << 10);
   EXPECT_EQ(entries[1].file, true);
 }
 
+TEST(MemoryMapping, ParseUnixMemoryProfileTruncated) {
+  // ParseUnixMemoryProfile used to crash on truncated inputs.
+  // This test allocates 2 pages, protects the second one
+  // and places the input at the very end of the first page
+  // to test for over-reads.
+  uptr page = GetPageSizeCached();
+  char *mem = static_cast<char *>(
+      MmapOrDie(2 * page, "ParseUnixMemoryProfileTruncated"));
+  EXPECT_TRUE(MprotectNoAccess(reinterpret_cast<uptr>(mem + page), page));
+  const uptr len = strlen(parse_unix_input);
+  for (uptr i = 0; i < len; i++) {
+    char *smaps = mem + page - len + i;
+    memcpy(smaps, parse_unix_input, len - i);
+    ParseUnixMemoryProfile([](uptr p, uptr rss, bool file, uptr *mem) {},
+                           nullptr, smaps, len - i);
+  }
+  UnmapOrDie(mem, 2 * page);
+}
+
 }  // namespace __sanitizer
 #endif  // !defined(_WIN32)