Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

load from misaligned address ? #517

Open
comicfans opened this issue Oct 15, 2024 · 0 comments
Open

load from misaligned address ? #517

comicfans opened this issue Oct 15, 2024 · 0 comments

Comments

@comicfans
Copy link

Bug report

Required Info:

  • Operating System:
    ubuntu 22.04
  • Installation type:
    build from source code
  • Version or commit hash:
    6.1.1
  • DDS implementation:
    don't know
  • Client library (if applicable):
    rclcpp

Steps to reproduce issue

we have a rclcpp test, hit by undefined behavior sanitizer

external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/serdes.hpp:135:3: runtime error: load of misaligned address 0x559c69c0324c for type 'const int64_t' (aka 'const long'), which requires 8
 byte alignment
0x559c69c0324c: note: pointer points here
  00 04 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 09 00 00 00  76 6f 6c 61 74 69 6c 65
              ^ 
    #0 0x7ff6a9ef24e9 in cycdeser::deserialize(long&) external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/serdes.hpp:135:3
    #1 0x7ff6a9ef34a6 in rmw_cyclonedds_cpp::TypeSupport<rosidl_typesupport_introspection_cpp::MessageMembers_s>::deserializeROSmessage(cycdeser&, rosidl_typesupport_introspection_cpp::Mes
sageMembers_s const*, void*) external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/TypeSupport_impl.hpp:304:9
    #2 0x7ff6a9ef35d1 in rmw_cyclonedds_cpp::TypeSupport<rosidl_typesupport_introspection_cpp::MessageMembers_s>::deserializeROSmessage(cycdeser&, rosidl_typesupport_introspection_cpp::Mes
sageMembers_s const*, void*) external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/TypeSupport_impl.hpp:319:13
    #3 0x7ff6a9ef3acc in rmw_cyclonedds_cpp::TypeSupport<rosidl_typesupport_introspection_cpp::MessageMembers_s>::deserializeROSmessage(cycdeser&, rosidl_typesupport_introspection_cpp::Mes
sageMembers_s const*, void*) external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/TypeSupport_impl.hpp:335:15
    #4 0x7ff6a9eb4078 in rmw_cyclonedds_cpp::TypeSupport<rosidl_typesupport_introspection_cpp::MessageMembers_s>::deserializeROSmessage(cycdeser&, void*, std::function<void (cycdeser&)>) e
xternal/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/TypeSupport_impl.hpp:461:18
    #5 0x7ff6a9f05b7c in serdata_rmw_to_sample(ddsi_serdata const*, void*, void**, void*) external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/serdata.cpp:363:35
    #6 0x7ff6aa0e955d in take_w_qminv_inst /dev/shm/bazel-sandbox.f5d247b3d0aac6a9bab1822957167ae53f3615d1812459da976b85a2f17e8620/linux-sandbox/4706/execroot/_main/external/cyclonedds/src
/core/ddsc/src/dds_rhc_default.c:2140:9
    #7 0x7ff6aa0e89fc in take_w_qminv /dev/shm/bazel-sandbox.f5d247b3d0aac6a9bab1822957167ae53f3615d1812459da976b85a2f17e8620/linux-sandbox/4706/execroot/_main/external/cyclonedds/src/core
/ddsc/src/dds_rhc_default.c:2275:12
    #8 0x7ff6aa0d813f in dds_rhc_take_w_qminv /dev/shm/bazel-sandbox.f5d247b3d0aac6a9bab1822957167ae53f3615d1812459da976b85a2f17e8620/linux-sandbox/4706/execroot/_main/external/cyclonedds/
src/core/ddsc/src/dds_rhc_default.c:2299:10
    #9 0x7ff6aa0d813f in dds_rhc_default_take /dev/shm/bazel-sandbox.f5d247b3d0aac6a9bab1822957167ae53f3615d1812459da976b85a2f17e8620/linux-sandbox/4706/execroot/_main/external/cyclonedds/
src/core/ddsc/src/dds_rhc_default.c:2708:10
    #10 0x7ff6aa1974ba in dds_read_impl /dev/shm/bazel-sandbox.f5d247b3d0aac6a9bab1822957167ae53f3615d1812459da976b85a2f17e8620/linux-sandbox/4706/execroot/_main/external/cyclonedds/src/co
re/ddsc/src/dds_read.c
    #11 0x7ff6aa199504 in dds_take /dev/shm/bazel-sandbox.f5d247b3d0aac6a9bab1822957167ae53f3615d1812459da976b85a2f17e8620/linux-sandbox/4706/execroot/_main/external/cyclonedds/src/core/dd
sc/src/dds_read.c:369:10
    #12 0x7ff6a9e967dd in rmw_take_int(rmw_subscription_s const*, void*, bool*, rmw_message_info_s*) external/ros2_rmw_cyclonedds/rmw_cyclonedds_cpp/src/rmw_node.cpp:3183:10
    #13 0x559c6744aaa6 in rcl_take external/ros2_rcl/rcl/src/rcl/subscription.c:517:19
    #14 0x559c673a540f in rclcpp::SubscriptionBase::take_type_erased(void*, rclcpp::MessageInfo&) external/ros2_rclcpp/rclcpp/src/rclcpp/subscription_base.cpp:152:19
    #15 0x559c672a37b2 in std::function<bool ()>::operator()() const external/ubuntu_jammy_amd64_sysroot/usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:
9
    #16 0x559c672a37b2 in take_and_do_error_handling(char const*, char const*, std::function<bool ()>, std::function<void ()>) external/ros2_rclcpp/rclcpp/src/rclcpp/executor.cpp:558:13
    #17 0x559c672a1c65 in rclcpp::Executor::execute_subscription(std::shared_ptr<rclcpp::SubscriptionBase>) external/ros2_rclcpp/rclcpp/src/rclcpp/executor.cpp:644:5
    #18 0x559c6729fd7d in rclcpp::Executor::execute_any_executable(rclcpp::AnyExecutable&) external/ros2_rclcpp/rclcpp/src/rclcpp/executor.cpp:524:5
    #19 0x559c6729d8b8 in rclcpp::Executor::spin_some_impl(std::chrono::duration<long, std::ratio<1l, 1000000000l>>, bool) external/ros2_rclcpp/rclcpp/src/rclcpp/executor.cpp:456:7
    #20 0x559c6729d01a in rclcpp::Executor::spin_node_some(std::shared_ptr<rclcpp::node_interfaces::NodeBaseInterface>) external/ros2_rclcpp/rclcpp/src/rclcpp/executor.cpp:406:3
    #21 0x559c672944bd in rclcpp::spin_some(std::shared_ptr<rclcpp::node_interfaces::NodeBaseInterface>) external/ros2_rclcpp/rclcpp/src/rclcpp/executors.cpp:21:8

Expected behavior

Actual behavior

Additional information

while checking source code

#define DESER8(T) DESER(T, )
#define DESER(T, fn_swap) inline void deserialize(T & x) { \
    align(sizeof(x)); \
    validate_size(1, sizeof(x)); \
    x = *reinterpret_cast<const T *>(data + pos); \
    if (swap_bytes) {x = fn_swap(x);} \
    pos += sizeof(x); \
}
  DESER8(char);
  DESER8(int8_t);
  DESER8(uint8_t);
  DESER(int16_t, bswap2);
  DESER(uint16_t, bswap2u);
  DESER(int32_t, bswap4);
  DESER(uint32_t, bswap4u);
  DESER(int64_t, bswap8);
  DESER(uint64_t, bswap8u);
#undef DESER

and align here

source code

inline void align(size_t a)
  {
    if ((pos % a) != 0) {
      pos += a - (pos % a);
      if (pos > lim) {
        throw DeserializationException("invalid data size");
      }
    }
  }

seems that align trying to find a size aligned offset , but use data + offset as address to load value. if data is not LCM of all data type, then this code may loading from misaligned address

Feature request

Feature description

Implementation considerations

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant