Search code examples
gccsegmentation-faultgdbg++sanitizer

How to resolve this segmentation fault in my program with the following Address Sanitizer output?


This question is a sequel of my previous question and the current status is that I have obtained the output of address sanitizer -- suggested by @Employed Russian -- which is given below. This is my first time that I have used address sanitizer so I beg your pardon for being naive.

==2596== ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff89d67fd0 at pc 0x401f21 bp 0x7fff89d67d00 sp 0x7fff89d67cf8
READ of size 4 at 0x7fff89d67fd0 thread T0
    #0 0x401f20 (/home/ubuntu/tp+0x401f20)
    #1 0x405bac (/home/ubuntu/tp+0x405bac)
    #2 0x406d40 (/home/ubuntu/tp+0x406d40)
    #3 0x7fb5a7d6fec4 (/lib/x86_64-linux-gnu/libc-2.19.so+0x21ec4)
    #4 0x401278 (/home/ubuntu/tp+0x401278)
Address 0x7fff89d67fd0 is located at offset 320 in frame <TMV_multiplication> of T0's stack:
This frame has 13 object(s):
   [32, 60) 'A11_Upper_matrix'
   [96, 124) 'A_Upper_matrix'
   [160, 192) 'A11_Lower_matrix'
   [224, 256) 'A_Lower_matrix'
   [288, 320) 'VecA'
   [352, 384) 'VecB'
   [416, 448) 'VecC'
   [480, 536) 'result_A_Upper'
   [576, 632) 'result_C_Upper'
   [672, 732) 'matrix_A21'
   [768, 832) 'result_A_Lower'
   [864, 928) 'result_B'
   [960, 1024) 'result_C_Lower'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
  (longjmp and C++ exceptions *are* supported)
Shadow bytes around the buggy address:
0x1000713a4fa0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x1000713a4fb0: 00 00 f4 f4 f2 f2 f2 f2 00 00 00 04 f2 f2 f2 f2
0x1000713a4fc0: 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x1000713a4fd0: 00 00 f1 f1 f1 f1 00 00 00 04 f2 f2 f2 f2 00 00
0x1000713a4fe0: 00 04 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
=>0x1000713a4ff0: 00 00 f2 f2 f2 f2 00 00 00 00[f2]f2 f2 f2 00 00
0x1000713a5000: 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
0x1000713a5010: 00 00 00 00 00 f4 f2 f2 f2 f2 00 00 00 00 00 00
0x1000713a5020: 00 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 04 f2 f2
0x1000713a5030: f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00
0x1000713a5040: 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:     fa
   Heap righ redzone:     fb
   Freed Heap region:     fd
   Stack left redzone:    f1
   Stack mid redzone:     f2
   Stack right redzone:   f3
   Stack partial redzone: f4
   Stack after return:    f5
   Stack use after scope: f8
   Global redzone:        f9
   Global init order:     f6
   Poisoned by user:      f7
   ASan internal:         fe
==2596== ABORTING

As pointed out earlier by @Employed Russian that most probably the problem is with the stack. Now, how to resolving this stack problem? Because these are over my head.


Solution

  • I have three unsigned int arrays X[16], Y[16], Z[16] in the main...
    X[32]=Z[0]

    You can stop right here.

    The valid indices for accessing X are 0 through 15. When you access X[16] (and beyond) you are invoking undefined behavior (anything can happen).

    I think you didn't actually mean that you assign to X[32]. What you probably meant is that &X[32] is the same as &Z[0]. If that's the case, there is nothing particularly interesting about it: the arrays are laid out in memory one after the other.

    0x000000008304ed6a in ?? ()

    This usually means stack corruption (something overwrote return address, and you returned into the middle of nowhere). Assuming X is a local array, writing to it out of bounds is exceedingly likely to cause just such corruption.

    An easy way to find such stack corruption is to use Address Sanitizer (available for Clang and GCC).

    Update:

    The Address Sanitizer error is telling you that

    • In TMV_multiplication(), you have a local array VecA of 32 bytes (probably int VecA[8];) and
    • You access (read) that array out of bounds (trying to access offset 320, which is just past the end of that array).

    This error is not the cause of your crash. You should fix it, and rerun again. There are more bugs after this one. Once you fix them all, your program will stop crashing.