1
1
# Answer
2
2
3
+
3
4
Name: 楊杰峰
4
5
ID: 510558017
5
6
7
+ Name:
8
+ ID:
9
+
10
+
6
11
## Test Valgrind and ASan
7
12
### Result
8
13
| | Valgrind | Asan |
9
14
| -------------------- | -------- | ---- |
15
+
10
16
| Heap out-of-bounds | Yes | Yes |
11
17
| Stack out-of-bounds | Yes | Yes |
12
18
| Global out-of-bounds | Yes | Yes |
13
19
| Use-after-free | Yes | Yes |
14
20
| Use-after-return | Yes | Yes |
15
21
22
+ | Heap out-of-bounds | | |
23
+ | Stack out-of-bounds | | |
24
+ | Global out-of-bounds | | |
25
+ | Use-after-free | | |
26
+ | Use-after-return | | |
27
+
28
+
16
29
### Heap out-of-bounds
17
30
#### Source code
18
31
```
32
+
19
33
#include <stdio.h>
20
34
#include <stdlib.h>
21
35
@@ -31,6 +45,7 @@ int main() {
31
45
return 0;
32
46
}
33
47
48
+
34
49
```
35
50
#### Valgrind Report
36
51
```
@@ -52,7 +67,6 @@ int main() {
52
67
```
53
68
### ASan Report
54
69
```
55
- =================================================================
56
70
==10519==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000024 at pc 0x56433e0122a2 bp 0x7ffcb47c35e0 sp 0x7ffcb47c35d0
57
71
WRITE of size 4 at 0x603000000024 thread T0
58
72
#0 0x56433e0122a1 in heap_out_of_bounds (/home/jf/510558017/510558017/lab5/heap_out_of_bounds+0x12a1)
@@ -101,6 +115,12 @@ Shadow byte legend (one shadow byte represents 8 application bytes):
101
115
Right alloca redzone: cb
102
116
Shadow gap: cc
103
117
==10519==ABORTING
118
+
119
+ ```
120
+ ### ASan Report
121
+ ```
122
+
123
+
104
124
```
105
125
106
126
### Stack out-of-bounds
@@ -119,6 +139,7 @@ int main() {
119
139
return 0;
120
140
}
121
141
142
+
122
143
```
123
144
#### Valgrind Report
124
145
```
@@ -140,7 +161,6 @@ valgrind: ./stack_out_of_bounds: No such file or directory==10523== Memcheck, a
140
161
```
141
162
### ASan Report
142
163
```
143
- =================================================================
144
164
==10522==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe0476bb84 at pc 0x563a4ff0a31c bp 0x7ffe0476bb40 sp 0x7ffe0476bb30
145
165
WRITE of size 4 at 0x7ffe0476bb84 thread T0
146
166
#0 0x563a4ff0a31b in stack_out_of_bounds (/home/jf/510558017/510558017/lab5/stack_out_of_bounds+0x131b)
@@ -189,6 +209,12 @@ Shadow byte legend (one shadow byte represents 8 application bytes):
189
209
Right alloca redzone: cb
190
210
Shadow gap: cc
191
211
==10522==ABORTING
212
+
213
+
214
+ ```
215
+ ### ASan Report
216
+ ```
217
+
192
218
```
193
219
194
220
### Global out-of-bounds
@@ -208,6 +234,7 @@ int main() {
208
234
return 0;
209
235
}
210
236
237
+
211
238
```
212
239
#### Valgrind Report
213
240
```
@@ -230,7 +257,6 @@ int main() {
230
257
### ASan Report
231
258
```
232
259
AddressSanitizer:DEADLYSIGNAL
233
- =================================================================
234
260
==4271==ERROR: AddressSanitizer: SEGV on unknown address 0x55f0360a2010 (pc 0x55f03609e223 bp 0x7ffccdefbd80 sp 0x7ffccdefbd80 T0)
235
261
==4271==The signal is caused by a WRITE memory access.
236
262
#0 0x55f03609e222 in global_out_of_bounds (/home/jf/510558017/510558017/lab5/global_out_of_bounds+0x1222)
@@ -241,6 +267,12 @@ AddressSanitizer:DEADLYSIGNAL
241
267
AddressSanitizer can not provide additional info.
242
268
SUMMARY: AddressSanitizer: SEGV (/home/jf/510558017/510558017/lab5/global_out_of_bounds+0x1222) in global_out_of_bounds
243
269
==4271==ABORTING
270
+
271
+
272
+ ```
273
+ ### ASan Report
274
+ ```
275
+
244
276
```
245
277
246
278
### Use-after-free
@@ -261,6 +293,7 @@ int main() {
261
293
return 0;
262
294
}
263
295
296
+
264
297
```
265
298
#### Valgrind Report
266
299
```
@@ -337,6 +370,12 @@ Shadow byte legend (one shadow byte represents 8 application bytes):
337
370
Right alloca redzone: cb
338
371
Shadow gap: cc
339
372
==11127==ABORTING: No such file or directory
373
+
374
+
375
+ ```
376
+ ### ASan Report
377
+ ```
378
+
340
379
```
341
380
342
381
### Use-after-return
@@ -359,6 +398,7 @@ int main() {
359
398
return 0;
360
399
}
361
400
401
+
362
402
```
363
403
#### Valgrind Report
364
404
```
@@ -381,7 +421,6 @@ int main() {
381
421
### ASan Report
382
422
```
383
423
AddressSanitizer:DEADLYSIGNAL
384
- =================================================================
385
424
==11129==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55c39c7c93ac bp 0x7fffe81607a0 sp 0x7fffe8160790 T0)
386
425
==11129==The signal is caused by a READ memory access.
387
426
==11129==Hint: address points to the zero page.
@@ -393,6 +432,12 @@ AddressSanitizer:DEADLYSIGNAL
393
432
AddressSanitizer can not provide additional info.
394
433
SUMMARY: AddressSanitizer: SEGV (/home/jf/510558017/510558017/lab5/use_after_return+0x13ab) in use_after_return
395
434
==11129==ABORTING
435
+
436
+
437
+ ```
438
+ ### ASan Report
439
+ ```
440
+
396
441
```
397
442
398
443
## ASan Out-of-bound Write bypass Redzone
@@ -417,3 +462,8 @@ int main() {
417
462
```
418
463
### Why
419
464
ASan 能夠偵測到剛好超出 redzone 的越界寫操作,因為它會在每個分配的內存區域前後添加 redzones,並在訪問這些區域時檢測到越界操作。
465
+
466
+
467
+ ```
468
+ ### Why
469
+
0 commit comments