Buffer Overflow during precompile

[Zentrik]

Specifically, it seems to be the call to mpfr_strtofr added in 504dfdf.
See JuliaLang/julia#53898 for more info.

https://gitlab.inria.fr/mpfr/mpfr/-/blob/4.2.0/src/strtofr.c?ref_type=tags#L326 is the line where the error occurs,

pstr->alloc = (size_t) strlen (str) + 1;

Are we missing the null terminator?

[Zentrik]

Minimal reproducer: Parsers.xparse(BigFloat, Vector(codeunits("1")), 1, 1).

[Zentrik]

Seems like we should also be using Cstring instead of Ptr as the second argument type to mpfr_strtofr.

[quinnj]

Hmmmm, interesting. Yes, I've definitely been assuming that a String or Vector{UInt8} input source will have the implicit nul terminator byte already there for us. Do you happen to know if this is a new failure? Like, since the Memory changes in Base? Doe we not see a Buffer Overflow in 1.9? That would suggest that maybe something with the new Memory changes is not the same as before.

Does just changing teh ccall argument from Ptr{UInt8} to Cstring fix the ASAN warning? I believe that should ensure the NUL terminator byte is present no matter the input, so if that fixes it, then that sounds like a fine change to me.

[Zentrik]

for i in 1:10^7
    a = Vector(codeunits("123"))
    ptr = pointer(a)
    Base.unsafe_load(ptr)
    Base.unsafe_load(ptr+1)
    Base.unsafe_load(ptr+2)
    if Base.unsafe_load(ptr+3) != 0
        return i
    end
end

returns nothing on 1.10.2 whilst on 1.11-alpha2 it returns numbers below 100.
So perhaps something has changed, though I don't think it's guaranteed that a vector has a null terminator.

I'm having a little trouble with my asan build right now, but I see this on 1.11-alpha2 so I don't think just changing Ptr to Cstring is going to work.

julia> a = for i in 1:10^7
           a = Vector(codeunits("123"))
           ptr = pointer(a)
           Base.unsafe_load(ptr)
           Base.unsafe_load(ptr+1)
           Base.unsafe_load(ptr+2)
           if Base.unsafe_load(ptr+3) != 0
               return a
           end
       end
3-element Vector{UInt8}:
 0x31
 0x32
 0x33

julia> unsafe_string(Base.cconvert(Cstring, pointer(a)))
"123\xec\xff\x7f"

Oddly, there is no cconvert(Cstring, Vector) even though there is one for Cwstring.
I think a safe thing to do is to just copy into a String and then change Ptr to Cstring as well for good measure.

[vchuravy]

I gathered a backtrace for this:

parse_string at /workspace/srcdir/mpfr-4.2.1/src/strtofr.c:329 [inlined]
mpfr_strtofr at /workspace/srcdir/mpfr-4.2.1/src/strtofr.c:958
typeparser at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/floats.jl:63
#26 at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:375 [inlined]
checkforsentinel at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:239 [inlined]
stripwhitespace at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:86
findquoted at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:216
stripwhitespace at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:86
_finddelimiter at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:362 [inlined]
checkemptysentinel at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:38 [inlined]
#9 at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/components.jl:12 [inlined]
_xparse at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/Parsers.jl:407 [inlined]
xparse at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/Parsers.jl:418 [inlined]
xparse at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/Parsers.jl:412 [inlined]
xparse at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/Parsers.jl:412
unknown function (ip: 0x7f6a8666a7ae)
_jl_invoke at /home/vchuravy/src/julia-1.11/src/gf.c:2948
ijl_apply_generic at /home/vchuravy/src/julia-1.11/src/gf.c:3125
macro expansion at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/precompile.jl:15 [inlined]
macro expansion at /home/vchuravy/.julia/packages/PrecompileTools/L8A3n/src/workloads.jl:78 [inlined]
macro expansion at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/precompile.jl:10 [inlined]
macro expansion at /home/vchuravy/.julia/packages/PrecompileTools/L8A3n/src/workloads.jl:140 [inlined]
top-level scope at /home/vchuravy/.julia/packages/Parsers/6Nt9C/src/precompile.jl:139