Stack underflow
Description
Building mira with the Address Sanitizer reports a stack underflow
and a test build for Cheri reports the same thing.
Repeat by
make CFLAGS=-fsanitize=address
echo output | ./mira -heap 1000000 ex/parafs.m
Results
==4743==ERROR: AddressSanitizer: stack-buffer-underflow on address 0xf5f00518 at pc 0x5665bbb2 bp 0xff831d48 sp 0xff831d3c
READ of size 4 at 0xf5f00518 thread T0
#0 0x5665bbb1 in bases /home/martin/miranda/data.c:223
#1 0x5665b75d in gc /home/martin/miranda/data.c:178
#2 0x5665afdf in make /home/martin/miranda/data.c:130
#3 0x566b304a in reduce /home/martin/miranda/reduce.c:1800
[...]
#85 0x5668c288 in reduce /home/martin/miranda/reduce.c:553
#86 0x566823b9 in print /home/martin/miranda/reduce.c:231
#87 0x56680d80 in output /home/martin/miranda/reduce.c:184
#88 0x56634d8f in evaluate /home/martin/miranda/rules.y:127
#89 0x5663baa3 in yyparse /home/martin/miranda/rules.y:370
#90 0x566c9b81 in commandloop /home/martin/miranda/steer.c:671
#91 0x566c6aa9 in main /home/martin/miranda/steer.c:395
#92 0xf75ef2d4 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#93 0xf75ef397 in __libc_start_main_impl ../csu/libc-start.c:360
#94 0x56634676 in _start (/home/martin/miranda/mira+0xc676)
Address 0xf5f00518 is located in stack of thread T0 at offset 24 in frame
#0 0x5665b945 in bases /home/martin/miranda/data.c:194
This frame has 1 object(s):
[32, 36) 'p' (line 194) <== Memory access at offset 24 underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
Analysis
The offending line is
while(--p!=cstack)mark(*p);/* for machines with stack growing upwards */
which looks OK, so it may be that bases() is underflowing the stack
of that function, not the global stack.
# Stack underflow
## Description
Building `mira` with the Address Sanitizer reports a stack underflow
and a test build for Cheri reports the same thing.
## Repeat by
```
make CFLAGS=-fsanitize=address
echo output | ./mira -heap 1000000 ex/parafs.m
```
## Results
```
==4743==ERROR: AddressSanitizer: stack-buffer-underflow on address 0xf5f00518 at pc 0x5665bbb2 bp 0xff831d48 sp 0xff831d3c
READ of size 4 at 0xf5f00518 thread T0
#0 0x5665bbb1 in bases /home/martin/miranda/data.c:223
#1 0x5665b75d in gc /home/martin/miranda/data.c:178
#2 0x5665afdf in make /home/martin/miranda/data.c:130
#3 0x566b304a in reduce /home/martin/miranda/reduce.c:1800
[...]
#85 0x5668c288 in reduce /home/martin/miranda/reduce.c:553
#86 0x566823b9 in print /home/martin/miranda/reduce.c:231
#87 0x56680d80 in output /home/martin/miranda/reduce.c:184
#88 0x56634d8f in evaluate /home/martin/miranda/rules.y:127
#89 0x5663baa3 in yyparse /home/martin/miranda/rules.y:370
#90 0x566c9b81 in commandloop /home/martin/miranda/steer.c:671
#91 0x566c6aa9 in main /home/martin/miranda/steer.c:395
#92 0xf75ef2d4 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#93 0xf75ef397 in __libc_start_main_impl ../csu/libc-start.c:360
#94 0x56634676 in _start (/home/martin/miranda/mira+0xc676)
Address 0xf5f00518 is located in stack of thread T0 at offset 24 in frame
#0 0x5665b945 in bases /home/martin/miranda/data.c:194
This frame has 1 object(s):
[32, 36) 'p' (line 194) <== Memory access at offset 24 underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
```
## Analysis
The offending line is
```
while(--p!=cstack)mark(*p);/* for machines with stack growing upwards */
```
which looks OK, so it may be that `bases()` is underflowing the stack
of that function, not the global stack.