C源代码如下:
#include<stdlib.h>
#include<stdio.h>
#include "demo_c.h"
void func(data_pair* pair) {
printf("func called");
pair->len=4;
pair->data = (char*)malloc(pair->len + 1);
memset(pair->data, 0, pair->len + 1);
memcpy(pair->data, "test", 4);
return;
}
gcc -fpic -c demo_c.c -fno-omit-frame-pointer -fsanitize=address -fsanitize-recover=address
gcc --share demo_c.o -o libdemo_c.so然后我用python导入这个库,如下所示:
from ctypes import *
demo_c = CDLL('/xxx/libdemo_c.so', RTLD_GLOBAL)
libc = CDLL('libc.so.6')
libc.free.argtypes = [c_void_p]
class entry(Structure):
_fields_ = [('len',c_int),
('data', c_void_p)]
v = entry()
demo_c.func.argtypes = [c_void_p]
demo_c.func(byref(v))
libc.free(v.data)
然后我运行:
LD_PRELOAD=/lib64/libasan.so.5 python demo.py输出为:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==432489==ERROR: AddressSanitizer: BUS on unknown address 0x000000000000 (pc 0x7f281c9c90fe bp 0x200000000000003 sp 0x7ffe0c369b20 T0)
#0 0x7f281c9c90fd in _int_free (/lib64/libc.so.6+0x810fd)
#1 0x7f281356cdcb in ffi_call_unix64 (/lib64/libffi.so.6+0x5dcb)
#2 0x7f281356c6f4 in ffi_call (/lib64/libffi.so.6+0x56f4)
#3 0x7f281377fc6a in _ctypes_callproc (/usr/lib64/python2.7/lib-dynload/_ctypes.so+0x10c6a)
#4 0x7f2813779a64 (/usr/lib64/python2.7/lib-dynload/_ctypes.so+0xaa64)
#5 0x7f281d687072 in PyObject_Call (/lib64/libpython2.7.so.1.0+0x4c072)
#6 0x7f281d71b845 in PyEval_EvalFrameEx (/lib64/libpython2.7.so.1.0+0xe0845)
#7 0x7f281d72264c in PyEval_EvalCodeEx (/lib64/libpython2.7.so.1.0+0xe764c)
#8 0x7f281d722751 in PyEval_EvalCode (/lib64/libpython2.7.so.1.0+0xe7751)
#9 0x7f281d73bb8e (/lib64/libpython2.7.so.1.0+0x100b8e)
#10 0x7f281d73cd5d in PyRun_FileExFlags (/lib64/libpython2.7.so.1.0+0x101d5d)
#11 0x7f281d73dfe8 in PyRun_SimpleFileExFlags (/lib64/libpython2.7.so.1.0+0x102fe8)
#12 0x7f281d74f19e in Py_Main (/lib64/libpython2.7.so.1.0+0x11419e)
#13 0x7f281c96a554 in __libc_start_main (/lib64/libc.so.6+0x22554)
#14 0x40068d (/usr/bin/python2.7+0x40068d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS (/lib64/libc.so.6+0x810fd) in _int_free
==432489==ABORTING
但是,如果我将libc.so的免费代码包装在demo_c.c中并调用它,而不是直接在python代码中直接调用它,它会工作得很好。
发布于 2021-07-02 12:19:33
问题是您使用Asan的malloc分配内存,然后尝试使用libc的free释放它。这是行不通的,因为不同的分配器通常是不兼容的。
https://stackoverflow.com/questions/68219204
复制相似问题