Heap allocation size failed

[nyw0102]

Version

v0.11.14-1-gcc05721

Description

There is a heap allocation-size fail due to the unsafe "alloc" function used by 'customasm::util::bigint::BigInt::shl' function.

Current Behavior

ASAN detect heap allocation size failed due to the allocation by 'customasm::util::bigint::BigInt::shl' function exceed the maximum supported size

==1934128==ERROR: AddressSanitizer: requested allocation size 0x5659c624f518e40 (0x5659c624f519e40 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x55dfea3ce847 in malloc /home/nyw0102/s2fuzz/scripts/rust/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x55dfeadc2364 in alloc::alloc::alloc::h2068b468a191ea69 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:171:73
    #2 0x55dfeadc2364 in alloc::alloc::Global::alloc_impl::h5dbe6867d8aba98f /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:171:73
    #3 0x55dfeadf2976 in _$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Allocator$GT$::allocate::h77100fcb8636a305 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/alloc.rs:231:9
    #4 0x55dfeade06b0 in alloc::raw_vec::RawVec$LT$T$C$A$GT$::allocate_in::h6447e80696de2d61 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/raw_vec.rs:185:45
    #5 0x55dfeadb409d in alloc::raw_vec::RawVec$LT$T$C$A$GT$::with_capacity_in::hf6d7227cf2b860ef /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:483:9
    #6 0x55dfeadb409d in alloc::vec::Vec$LT$T$C$A$GT$::with_capacity_in::he9d06f458c49d1a7 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:641:20
    #7 0x55dfeadb409d in alloc::vec::Vec$LT$T$GT$::with_capacity::hd6917faaecf238e8 /home/nyw0102/s2fuzz/scripts/rust/library/alloc/src/vec/mod.rs:483:9
    #8 0x55dfea86539a in _$LT$$RF$num_bigint..biguint..BigUint$u20$as$u20$core..ops..bit..Shl$LT$usize$GT$$GT$::shl::h1878d3849cd609f0 /home/nyw0102/.cargo/registry/src/github.com-1ecc6299db9ec823/num-bigint-0.1.44/src/biguint.rs:370:9
    #9 0x55dfea85ff45 in _$LT$$RF$num_bigint..bigint..BigInt$u20$as$u20$core..ops..bit..Shl$LT$usize$GT$$GT$::shl::hc8c492dc0ba8fb89 /home/nyw0102/.cargo/registry/src/github.com-1ecc6299db9ec823/num-bigint-0.1.44/src/bigint.rs:227:41
    #10 0x55dfeab5f724 in customasm::util::bigint::BigInt::shl::h9b8a42b728f6f372 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:149:9
    #11 0x55dfeab61142 in customasm::util::bigint::BigInt::checked_shl::_$u7b$$u7b$closure$u7d$$u7d$::h7dde0a7ee5998491 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:169:41
    #12 0x55dfea5f9c2e in core::option::Option$LT$T$GT$::map::hc57c5c3bec8e6496 /home/nyw0102/s2fuzz/scripts/rust/library/core/src/option.rs:929:29
    #13 0x55dfeab60cc6 in customasm::util::bigint::BigInt::checked_shl::hffcd886eb0228fe8 /home/nyw0102/Test-Sets/customasm/src/util/bigint.rs:169:9
    #14 0x55dfeaa541f5 in customasm::expr::eval::_$LT$impl$u20$customasm..expr..expression..Expr$GT$::eval::hd50bedede7c4f298 /home/nyw0102/Test-Sets/customasm/src/expr/eval.rs:251:38
    #15 0x55dfeaa5181f in customasm::expr::eval::_$LT$impl$u20$customasm..expr..expression..Expr$GT$::eval::hd50bedede7c4f298 /home/nyw0102/Test-Sets/customasm/src/expr/eval.rs:206:16
    #16 0x55dfeaa991d5 in customasm::asm::state::State::eval_expr::hcf41250c70ade838 /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:1002:3
    #17 0x55dfeaa81627 in customasm::asm::state::State::resolve_data_invocation::h28e4be77f9705316 /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:614:18
    #18 0x55dfeab433f4 in customasm::asm::parser::data::parse_directive_data::hd8ba556143d26794 /home/nyw0102/Test-Sets/customasm/src/asm/parser/data.rs:32:24
    #19 0x55dfeaadf0f5 in customasm::asm::parser::file::parse_directive::h558beaaf9e13a01d /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:97:13
    #20 0x55dfeaadc55f in customasm::asm::parser::file::parse_line::h3a387eb6fb947b74 /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:55:9
    #21 0x55dfeaad727c in customasm::asm::parser::file::parse_file::hdc5553a5a1c95e28 /home/nyw0102/Test-Sets/customasm/src/asm/parser/file.rs:42:9
    #22 0x55dfeaa64020 in customasm::asm::state::Assembler::assemble::hbd438191f26eecbe /home/nyw0102/Test-Sets/customasm/src/asm/state.rs:122:18
    #23 0x55dfeabc8a3c in customasm::driver::drive_inner::h299b7b51dfdf0f42 /home/nyw0102/Test-Sets/customasm/src/driver.rs:192:15
    #24 0x55dfeabbf074 in customasm::driver::drive::hd5fc72f7c2e70ee6 /home/nyw0102/Test-Sets/customasm/src/driver.rs:39:15
    #25 0x55dfea40ed19 in customasm::main::h23e4f4dfa8375648 /home/nyw0102/Test-Sets/customasm/src/main.rs:10:19
    #26 0x55dfea400f4a in core::ops::function::FnOnce::call_once::ha2625528851145be /home/nyw0102/s2fuzz/scripts/rust/library/core/src/ops/function.rs:248:5
    #27 0x55dfea3fe706 in std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h5d07d37f4c07bcb6 /home/nyw0102/s2fuzz/scripts/rust/library/std/src/rt.rs:145:18
    #28 0x55dfeae9a9f4 in std::rt::lang_start_internal::h4a61547abbd425a7 (/home/nyw0102/Test-Sets/customasm/target/x86_64-unknown-linux-gnu/debug/customasm+0xbb19f4) (BuildId: d53a25b51827aa08a6935884b3184aa2cb61527c)
    #29 0x55dfea40f2ef in main (/home/nyw0102/Test-Sets/customasm/target/x86_64-unknown-linux-gnu/debug/customasm+0x1262ef) (BuildId: d53a25b51827aa08a6935884b3184aa2cb61527c)

==1934128==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big /home/nyw0102/s2fuzz/scripts/rust/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 in malloc
==1934128==ABORTING

Expected Behavior

Memory-safety code with no allocation-size failed. This might be handled by denying allocation when the size of object exceeds the maximum allocation size.

[hlorenzi]

I'm not sure what to do with this information alone. Do you have the source code that triggered this crash?

[nyw0102]

pub fn shl(&self, rhs: usize) -> BigInt
    {
        (&self.bigint << rhs).into()
    }

This code calls "Vec::with_capacity" through the code below:

pub fn biguint_shl(n: Cow<BigUint>, bits: usize) -> BigUint {
    let n_unit = bits / big_digit::BITS;
    let mut data = match n_unit {
        0 => n.into_owned().data,
        _ => {
            let len = n_unit + n.data.len() + 1;
            let mut data = Vec::with_capacity(len);
            data.extend(repeat(0).take(n_unit));
            data.extend(n.data.iter().cloned());
            data
        }
    };

So, according to these two code, if the size of file is big enough to exceed the heap size, the "Heap allocation size error" occurs.
So, I think it would be helpful to limit the size of file in "expr::eval::eval::226-256" function.

let lhs_bigint = lhs.get_bigint(); // limit this size
let rhs_bigint = rhs.get_bigint(); // limit this size

   match (lhs_bigint, rhs_bigint)
   {
	(Some(ref lhs), Some(ref rhs)) =>
	{
	match op
	{
		expr::BinaryOp::Add => Ok(expr::Value::make_integer(lhs + rhs)),
		expr::BinaryOp::Sub => Ok(expr::Value::make_integer(lhs - rhs)),
		expr::BinaryOp::Mul => Ok(expr::Value::make_integer(lhs * rhs)),
								
		expr::BinaryOp::Div => match lhs.checked_div(rhs)
		{
			Some(x) => Ok(expr::Value::make_integer(x)),
			None => Err(report.error_span("division by zero", &op_span.join(&rhs_expr.span())))
		},
								
		expr::BinaryOp::Mod => match lhs.checked_rem(rhs)
		{
			Some(x) => Ok(expr::Value::make_integer(x)),
			None => Err(report.error_span("modulo by zero", &op_span.join(&rhs_expr.span())))
		},
								
		expr::BinaryOp::Shl => match lhs.checked_shl(rhs)
		{
			Some(x) => Ok(expr::Value::make_integer(x)),
			None => Err(report.error_span("invalid shift value", &op_span.join(&rhs_expr.span())))
		},

[nyw0102]

@hlorenzi
Hi, I hope you have a great day.

Since we discussed about this issue a time ago, It might be a great pleasure for me if you take this issue into account! :)