refactor: Avoid UB in util/asmap (advance a dereferenceable iterator outside its valid range) #21802

maflcko · 2021-04-29T06:56:18Z

Can be reproduced on current master with D_GLIBCXX_DEBUG:

/usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/debug/safe_iterator.h:883:
In function:
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1, 
    std::random_access_iterator_tag>::_Self __gnu_debug::operator+(const 
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1, 
    std::random_access_iterator_tag>::_Self &, 
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1, 
    std::random_access_iterator_tag>::difference_type)

Error: attempt to advance a dereferenceable iterator 369 steps, which falls 
outside its valid range.

Objects involved in the operation:
    iterator @ 0x0x7ffd3d613138 {
      type = std::__cxx1998::_Bit_const_iterator (constant iterator);
      state = dereferenceable;
      references sequence with type 'std::__debug::vector<bool, std::allocator<bool> >' @ 0x0x7ffd3d663590
    }
==65050== ERROR: libFuzzer: deadly signal
    #0 0x559ab9787690 in __sanitizer_print_stack_trace (/bitcoin/src/test/fuzz/fuzz+0x5a1690)
    #1 0x559ab9733998 in fuzzer::PrintStackTrace() (/bitcoin/src/test/fuzz/fuzz+0x54d998)
    #2 0x559ab9718ae3 in fuzzer::Fuzzer::CrashCallback() (/bitcoin/src/test/fuzz/fuzz+0x532ae3)
    #3 0x7f70a0e723bf  (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf)
    #4 0x7f70a0b3418a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4618a)
    #5 0x7f70a0b13858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25858)
    #6 0x7f70a0f21148  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xa1148)
    #7 0x559ab9f60a96 in __gnu_debug::operator+(__gnu_debug::_Safe_iterator<std::__cxx1998::_Bit_const_iterator, std::__debug::vector<bool, std::allocator<bool> >, std::random_access_iterator_tag> const&, long) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/debug/safe_iterator.h:881:2
    #8 0x559ab9f61062 in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&, int) util/asmap.cpp:159:21
    #9 0x559ab9e4fdfa in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&) netaddress.cpp:1242:12
    #10 0x559ab9793fcb in addrman_fuzz_target(Span<unsigned char const>) test/fuzz/addrman.cpp:43:14
    #11 0x559ab978a03c in std::_Function_handler<void (Span<unsigned char const>), void (*)(Span<unsigned char const>)>::_M_invoke(std::_Any_data const&, Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
    #12 0x559aba2692c7 in std::function<void (Span<unsigned char const>)>::operator()(Span<unsigned char const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
    #13 0x559aba269132 in LLVMFuzzerTestOneInput test/fuzz/fuzz.cpp:63:5
    #14 0x559ab971a1a1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/bitcoin/src/test/fuzz/fuzz+0x5341a1)
    #15 0x559ab97198e5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/bitcoin/src/test/fuzz/fuzz+0x5338e5)
    #16 0x559ab971bb87 in fuzzer::Fuzzer::MutateAndTestOne() (/bitcoin/src/test/fuzz/fuzz+0x535b87)
    #17 0x559ab971c885 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/bitcoin/src/test/fuzz/fuzz+0x536885)
    #18 0x559ab970b23e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/bitcoin/src/test/fuzz/fuzz+0x52523e)
    #19 0x559ab9734082 in main (/bitcoin/src/test/fuzz/fuzz+0x54e082)
    #20 0x7f70a0b150b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #21 0x559ab96dffdd in _start (/bitcoin/src/test/fuzz/fuzz+0x4f9fdd)

vasild

ACK fabe592

Maybe squash the two commits into one because the first one leaves the tree with a compiler warning which may be a problem during git bisect with -Werror. The changes are not so big or unrelated to warrant separate commits.

This reverts commit eac6a30 ("refactor: Rework asmap Interpret to avoid ptrdiff_t"), because it is UB to form a past-the-end iterator, even if it is never dereferenced. Then fix the compiler warning in a different way: Instead of comparing an uint32_t against a signed ptrdiff_t, just promote both to a type that can represent both types. Even though in this case the ptrdiff_t should never hold a negative value, the overhead from promotion should be negligible.

maflcko · 2021-04-29T09:43:14Z

Thanks, squashed

vasild

ACK fa09871

adamjonas · 2021-04-29T16:02:46Z

Reproduced on master with D_GLIBCXX_DEBUG via running the fuzzer over asmap and asmap direct

asmap output

INFO: Loaded 1 modules   (811800 inline 8-bit counters): 811800 [0x56282d063a10, 0x56282d129d28),
INFO: Loaded 1 PC tables (811800 PCs): 811800 [0x56282d129d28,0x56282dd8cea8),
INFO:     1070 files found in qa-assets/fuzz_seed_corpus/asmap/
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 292568 bytes
INFO: seed corpus: files: 1070 min: 1b max: 292568b total: 5871094b rss: 161Mb
/usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/debug/safe_iterator.h:908:
In function:
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
    std::random_access_iterator_tag>::_Self __gnu_debug::operator+(const
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
    std::random_access_iterator_tag>::_Self &,
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
    std::random_access_iterator_tag>::difference_type)

Error: attempt to advance a dereferenceable iterator 8167 steps, which falls
outside its valid range.

Objects involved in the operation:
    iterator @ 0x0x7ffc4397d7f0 {
      type = std::__cxx1998::_Bit_const_iterator (constant iterator);
      state = dereferenceable;
      references sequence with type 'std::__debug::vector<bool, std::allocator<bool> >' @ 0x0x7ffc4397dac0
    }
==135635== ERROR: libFuzzer: deadly signal
    #0 0x562826cc6fd1 in __sanitizer_print_stack_trace (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3afefd1)
    #1 0x562826c12128 in fuzzer::PrintStackTrace() (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a4a128)
    #2 0x562826bf7273 in fuzzer::Fuzzer::CrashCallback() (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a2f273)
    #3 0x7fa76a77241f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1541f)
    #4 0x7fa76a3b618a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4618a)
    #5 0x7fa76a395858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25858)
    #6 0x7fa76a821148  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xa1148)
    #7 0x562828748e40 in __gnu_debug::operator+(__gnu_debug::_Safe_iterator<std::__cxx1998::_Bit_const_iterator, std::__debug::vector<bool, std::allocator<bool> >, std::random_access_iterator_tag> const&, long) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/debug/safe_iterator.h:906:2
    #8 0x56282874a24c in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&, int) /home/jonas/bitcoin/src/util/asmap.cpp:159:21
    #9 0x5628283ea928 in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&) /home/jonas/bitcoin/src/netaddress.cpp:1242:12
    #10 0x562826d80b92 in asmap_fuzz_target(Span<unsigned char const>) /home/jonas/bitcoin/src/test/fuzz/asmap.cpp:45:10
    #11 0x562826cf3acd in void std::__invoke_impl<void, void (*&)(Span<unsigned char const>), Span<unsigned char const> >(std::__invoke_other, void (*&)(Span<unsigned char const>), Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
    #12 0x562826cf37a0 in std::enable_if<is_invocable_r_v<void, void (*&)(Span<unsigned char const>), Span<unsigned char const> >, void>::type std::__invoke_r<void, void (*&)(Span<unsigned char const>), Span<unsigned char const> >(void (*&)(Span<unsigned char const>), Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:110:2
    #13 0x562826cf307e in std::_Function_handler<void (Span<unsigned char const>), void (*)(Span<unsigned char const>)>::_M_invoke(std::_Any_data const&, Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:291:9
    #14 0x56282909c437 in std::function<void (Span<unsigned char const>)>::operator()(Span<unsigned char const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
    #15 0x56282909c0e5 in LLVMFuzzerTestOneInput /home/jonas/bitcoin/src/test/fuzz/fuzz.cpp:63:5
    #16 0x562826bf8931 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a30931)
    #17 0x562826bf8075 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a30075)
    #18 0x562826bfa997 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a32997)
    #19 0x562826bfacf9 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a32cf9)
    #20 0x562826be99ce in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a219ce)
    #21 0x562826c12812 in main (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a4a812)
    #22 0x7fa76a3970b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #23 0x562826bbe76d in _start (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x39f676d)

asmap_direct output

INFO: Loaded 1 modules   (811800 inline 8-bit counters): 811800 [0x55a86b9d7a10, 0x55a86ba9dd28),
INFO: Loaded 1 PC tables (811800 PCs): 811800 [0x55a86ba9dd28,0x55a86c700ea8),
INFO:      638 files found in qa-assets/fuzz_seed_corpus/asmap_direct/
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: seed corpus: files: 638 min: 1b max: 4096b total: 163116b rss: 160Mb
/usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/debug/safe_iterator.h:908:
In function:
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
    std::random_access_iterator_tag>::_Self __gnu_debug::operator+(const
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
    std::random_access_iterator_tag>::_Self &,
    __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1,
    std::random_access_iterator_tag>::difference_type)

Error: attempt to advance a past-the-end iterator 18 steps, which falls
outside its valid range.

Objects involved in the operation:
    iterator @ 0x0x7ffcd1b577b0 {
      type = std::__cxx1998::_Bit_const_iterator (constant iterator);
      state = past-the-end;
      references sequence with type 'std::__debug::vector<bool, std::allocator<bool> >' @ 0x0x7ffcd1b57ac0
    }
==135577== ERROR: libFuzzer: deadly signal
    #0 0x55a86563afd1 in __sanitizer_print_stack_trace (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3afefd1)
    #1 0x55a865586128 in fuzzer::PrintStackTrace() (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a4a128)
    #2 0x55a86556b273 in fuzzer::Fuzzer::CrashCallback() (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a2f273)
    #3 0x7fdcb293241f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1541f)
    #4 0x7fdcb257618a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4618a)
    #5 0x7fdcb2555858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25858)
    #6 0x7fdcb29e1148  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xa1148)
    #7 0x55a8670bce40 in __gnu_debug::operator+(__gnu_debug::_Safe_iterator<std::__cxx1998::_Bit_const_iterator, std::__debug::vector<bool, std::allocator<bool> >, std::random_access_iterator_tag> const&, long) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/debug/safe_iterator.h:906:2
    #8 0x55a8670be24c in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&, int) /home/jonas/bitcoin/src/util/asmap.cpp:159:21
    #9 0x55a865702c33 in asmap_direct_fuzz_target(Span<unsigned char const>) /home/jonas/bitcoin/src/test/fuzz/asmap_direct.cpp:35:9
    #10 0x55a865667acd in void std::__invoke_impl<void, void (*&)(Span<unsigned char const>), Span<unsigned char const> >(std::__invoke_other, void (*&)(Span<unsigned char const>), Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
    #11 0x55a8656677a0 in std::enable_if<is_invocable_r_v<void, void (*&)(Span<unsigned char const>), Span<unsigned char const> >, void>::type std::__invoke_r<void, void (*&)(Span<unsigned char const>), Span<unsigned char const> >(void (*&)(Span<unsigned char const>), Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:110:2
    #12 0x55a86566707e in std::_Function_handler<void (Span<unsigned char const>), void (*)(Span<unsigned char const>)>::_M_invoke(std::_Any_data const&, Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:291:9
    #13 0x55a867a10437 in std::function<void (Span<unsigned char const>)>::operator()(Span<unsigned char const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
    #14 0x55a867a100e5 in LLVMFuzzerTestOneInput /home/jonas/bitcoin/src/test/fuzz/fuzz.cpp:63:5
    #15 0x55a86556c931 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a30931)
    #16 0x55a86556c075 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a30075)
    #17 0x55a86556e997 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a32997)
    #18 0x55a86556ecf9 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a32cf9)
    #19 0x55a86555d9ce in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a219ce)
    #20 0x55a865586812 in main (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x3a4a812)
    #21 0x7fdcb25570b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #22 0x55a86553276d in _start (/home/jonas/bitcoin/src/test/fuzz/fuzz+0x39f676d)

Ran fa09871 and can confirmed that 100000 runs over asmap and asmap_direct yielded no crashes.

sipa · 2021-04-29T16:51:53Z

Concept ACK

I vaguely remember we used to have a CI build that used glibc in debug mode. Don't we have that anymore?

practicalswift · 2021-04-29T18:11:56Z

I vaguely remember we used to have a CI build that used glibc in debug mode. Don't we have that anymore?

The only mention of -D_GLIBCXX_DEBUG in the repo history is f397304 (2014).

There has been some -D_GLIBCXX_DEBUG mentions here on GitHub in the past: see #14624 (comment) (2018) and the recent thread #21781 (comment).

maflcko · 2021-05-05T06:22:23Z

Please don't merge this just yet

maflcko · 2021-05-06T08:06:25Z

(ready for review/merge again)

sipa · 2021-05-07T03:11:26Z

utACK fa09871

…ferenceable iterator outside its valid range) fa09871 refactor: Avoid sign-compare compiler warning in util/asmap (MarcoFalke) Pull request description: Can be reproduced on current master with `D_GLIBCXX_DEBUG`: ``` /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/debug/safe_iterator.h:883: In function: __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1, std::random_access_iterator_tag>::_Self __gnu_debug::operator+(const __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1, std::random_access_iterator_tag>::_Self &, __gnu_debug::_Safe_iterator<type-parameter-0-0, type-parameter-0-1, std::random_access_iterator_tag>::difference_type) Error: attempt to advance a dereferenceable iterator 369 steps, which falls outside its valid range. Objects involved in the operation: iterator @ 0x0x7ffd3d613138 { type = std::__cxx1998::_Bit_const_iterator (constant iterator); state = dereferenceable; references sequence with type 'std::__debug::vector<bool, std::allocator<bool> >' @ 0x0x7ffd3d663590 } ==65050== ERROR: libFuzzer: deadly signal #0 0x559ab9787690 in __sanitizer_print_stack_trace (/bitcoin/src/test/fuzz/fuzz+0x5a1690) #1 0x559ab9733998 in fuzzer::PrintStackTrace() (/bitcoin/src/test/fuzz/fuzz+0x54d998) #2 0x559ab9718ae3 in fuzzer::Fuzzer::CrashCallback() (/bitcoin/src/test/fuzz/fuzz+0x532ae3) #3 0x7f70a0e723bf (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf) #4 0x7f70a0b3418a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4618a) #5 0x7f70a0b13858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25858) #6 0x7f70a0f21148 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xa1148) #7 0x559ab9f60a96 in __gnu_debug::operator+(__gnu_debug::_Safe_iterator<std::__cxx1998::_Bit_const_iterator, std::__debug::vector<bool, std::allocator<bool> >, std::random_access_iterator_tag> const&, long) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/debug/safe_iterator.h:881:2 #8 0x559ab9f61062 in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&, int) util/asmap.cpp:159:21 #9 0x559ab9e4fdfa in SanityCheckASMap(std::__debug::vector<bool, std::allocator<bool> > const&) netaddress.cpp:1242:12 #10 0x559ab9793fcb in addrman_fuzz_target(Span<unsigned char const>) test/fuzz/addrman.cpp:43:14 #11 0x559ab978a03c in std::_Function_handler<void (Span<unsigned char const>), void (*)(Span<unsigned char const>)>::_M_invoke(std::_Any_data const&, Span<unsigned char const>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2 #12 0x559aba2692c7 in std::function<void (Span<unsigned char const>)>::operator()(Span<unsigned char const>) const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14 #13 0x559aba269132 in LLVMFuzzerTestOneInput test/fuzz/fuzz.cpp:63:5 #14 0x559ab971a1a1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/bitcoin/src/test/fuzz/fuzz+0x5341a1) #15 0x559ab97198e5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/bitcoin/src/test/fuzz/fuzz+0x5338e5) #16 0x559ab971bb87 in fuzzer::Fuzzer::MutateAndTestOne() (/bitcoin/src/test/fuzz/fuzz+0x535b87) #17 0x559ab971c885 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/bitcoin/src/test/fuzz/fuzz+0x536885) #18 0x559ab970b23e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/bitcoin/src/test/fuzz/fuzz+0x52523e) #19 0x559ab9734082 in main (/bitcoin/src/test/fuzz/fuzz+0x54e082) #20 0x7f70a0b150b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) #21 0x559ab96dffdd in _start (/bitcoin/src/test/fuzz/fuzz+0x4f9fdd) ACKs for top commit: sipa: utACK fa09871 vasild: ACK fa09871 Tree-SHA512: 802fda33bda40fe2521f1e3be075ceddc5fd9ba185bd494286e50019931dfd688da7a6513601138b1dc7bb8e80ae47c8572902406eb59f68990619ddb2656748

maflcko force-pushed the 2104-asmapRefactor branch from fa95bf3 to fabe592 Compare April 29, 2021 06:56

maflcko mentioned this pull request Apr 29, 2021

test, build: Enable -Werror=sign-compare #18216

Merged

DrahtBot added Refactoring Utils/log/libs labels Apr 29, 2021

vasild approved these changes Apr 29, 2021

View reviewed changes

maflcko mentioned this pull request Apr 29, 2021

Security enhancements to ChaCha20::SetKey and CSignatureCache::ComputeEntryECDSA #21781

Closed

maflcko force-pushed the 2104-asmapRefactor branch from fabe592 to fa09871 Compare April 29, 2021 09:42

vasild approved these changes Apr 29, 2021

View reviewed changes

maflcko marked this pull request as draft May 5, 2021 06:21

maflcko mentioned this pull request May 5, 2021

oss-fuzz doesn't find known issues google/oss-fuzz#5713

Closed

maflcko marked this pull request as ready for review May 6, 2021 08:06

maflcko merged commit eb9a1fe into bitcoin:master May 7, 2021

maflcko deleted the 2104-asmapRefactor branch May 7, 2021 08:29

gwillen pushed a commit to ElementsProject/elements that referenced this pull request Jun 1, 2022

Merge eb9a1fe into merged_master (Bitcoin PR bitcoin/bitcoin#21802)

21558d6

bitcoin locked as resolved and limited conversation to collaborators Aug 16, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor: Avoid UB in util/asmap (advance a dereferenceable iterator outside its valid range) #21802

refactor: Avoid UB in util/asmap (advance a dereferenceable iterator outside its valid range) #21802

Uh oh!

maflcko commented Apr 29, 2021

Uh oh!

vasild left a comment

Uh oh!

maflcko commented Apr 29, 2021

Uh oh!

vasild left a comment

Uh oh!

adamjonas commented Apr 29, 2021

Uh oh!

sipa commented Apr 29, 2021

Uh oh!

practicalswift commented Apr 29, 2021

Uh oh!

maflcko commented May 5, 2021

Uh oh!

maflcko commented May 6, 2021

Uh oh!

sipa commented May 7, 2021

Uh oh!

Uh oh!

refactor: Avoid UB in util/asmap (advance a dereferenceable iterator outside its valid range) #21802

refactor: Avoid UB in util/asmap (advance a dereferenceable iterator outside its valid range) #21802

Uh oh!

Conversation

maflcko commented Apr 29, 2021

Uh oh!

vasild left a comment

Choose a reason for hiding this comment

Uh oh!

maflcko commented Apr 29, 2021

Uh oh!

vasild left a comment

Choose a reason for hiding this comment

Uh oh!

adamjonas commented Apr 29, 2021

Uh oh!

sipa commented Apr 29, 2021

Uh oh!

practicalswift commented Apr 29, 2021

Uh oh!

maflcko commented May 5, 2021

Uh oh!

maflcko commented May 6, 2021

Uh oh!

sipa commented May 7, 2021

Uh oh!

Uh oh!