Search code examples
cmemorymallocbuffer-overflow

buffer overflow in C with function to alloc double array

I made to allocate an array of string easily it worked fine so far but not i am getting a buffer overflow on one of my program using this function.

Code :

/*
\fn char **clean_double_alloc(int y, int x)
\brief allocate array of string in desirated size.
\param y : the number of string
\param x : the lenght of each string
\return a new array of string(char **).
*/

char **clean_double_alloc(int y, int x)
{
    char **double_buffer = NULL;

    double_buffer = malloc(sizeof(char *) * (y + 1));
    if (double_buffer == NULL) {
        put_error("allocation error !\n");
        return (NULL);
    }
    for (int i = 0; i < y; i++) {
        double_buffer[i] = NULL;
        double_buffer[i] = clean_alloc(x);
        if (double_buffer[i] == NULL) {
            put_error("allocation error !\n");
            return (NULL);
        }
    }
    double_buffer[y + 1] = NULL;
    return (double_buffer);
}

Note : my clean_alloc and take as parameter the number of character it can hold not the size in bytes, it then fill the allocated space with '\0'.

clean_alloc code here :

char *clean_alloc(int size)
{
    char *str = NULL;

    str = malloc(size * sizeof(char));
    if (str == NULL) {
        my_putstr("allocation error !");
        return (NULL);
    }
    for (int i = 0; i < size; i++)
        str[i] = '\0';
    return (str);
}

I compiled with -fsanitize=address and got the following trace :

==8342==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000040 at pc 0x000000405176 bp 0x7ffc8d494ff0 sp 0x7ffc8d494fe0
WRITE of size 8 at 0x604000000040 thread T0
    #0 0x405175 in clean_double_alloc warlock/string/initialize_more.c:35
    #1 0x4015cc in prepare_maze src/main.c:55
    #2 0x4013f7 in main src/main.c:38
    #3 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
    #4 0x40119d in _start (/home/mlg/Programming/github repo/Dante-s-Star/generator/generator+0x40119d)

0x604000000040 is located 0 bytes to the right of 48-byte region [0x604000000010,0x604000000040)
allocated by thread T0 here:
    #0 0x7f8f29663c58 in __interceptor_malloc (/lib64/libasan.so.5+0x10dc58)
    #1 0x405038 in clean_double_alloc warlock/string/initialize_more.c:22
    #2 0x4015cc in prepare_maze src/main.c:55
    #3 0x4013f7 in main src/main.c:38
    #4 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)

SUMMARY: AddressSanitizer: heap-buffer-overflow warlock/string/initialize_more.c:35 in clean_double_alloc
Shadow bytes around the buggy address:
  0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c087fff8000: fa fa 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c087fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
Solution

  • You're malloc'd an array that's y + 1 pointers long, but you have this call:

    double_buffer[y + 1] = NULL;

    That looks to be an off by one error and instead should be:

    double_buffer[y] = NULL;

    This highlights the issue:

    int buffer[3 + 1] = {1, 2, 3, 4};
printf("Correct: %d\nIncorrect: %d\n", buffer[3], buffer[3 + 1]);