llvm dev - Apr 2016 - Possible UB in reading coverage mapping with compressed function names

Hi David, Vedant,

It looks like we might have UB somewhere connected with reading coverage 
mapping serialized in v2 format (with compressed function names).

I committed my patch, r266436, using the current format for .covmapping 
file, and then buildbots complained about it:
* 
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/builds/11935/steps/check-llvm%20ubsan/logs/stdio
* 
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-bootstrap/builds/11460/steps/check-llvm%20ubsan/logs/stdio

I tried to reproduce the issue locally, but didn't succeed. Anyway, I've
reapplied my patch (r266620) using the old format
for .covmapping, and buildbots are happy now.

Could you take a look on that? Do you have any idea what might cause the 
problem?

Best regards,
Igor Kudrin

I will try to take a look at it some time this week.

David

On Mon, Apr 18, 2016 at 8:12 PM, Igor Kudrin <ikudrin.dev at gmail.com>
wrote:
> Hi David, Vedant,
>
> It looks like we might have UB somewhere connected with reading coverage
> mapping serialized in v2 format (with compressed function names).
>
> I committed my patch, r266436, using the current format for .covmapping
> file, and then buildbots complained about it:
> *
>
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/builds/11935/steps/check-llvm%20ubsan/logs/stdio
> *
>
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-bootstrap/builds/11460/steps/check-llvm%20ubsan/logs/stdio
>
> I tried to reproduce the issue locally, but didn't succeed. Anyway,
I've
> reapplied my patch (r266620) using the old format
> for .covmapping, and buildbots are happy now.
>
> Could you take a look on that? Do you have any idea what might cause the
> problem?
>
> Best regards,
> Igor Kudrin
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20160418/81bb61c5/attachment.html>

If `Ptr = nullptr`, then ISTM that this would crash consistently unless `Size =
0`.

vedant
> On Apr 18, 2016, at 8:40 PM, Xinliang David Li <davidxl at
google.com> wrote:
> 
> I will try to take a look at it some time this week.
> 
> David
> 
> On Mon, Apr 18, 2016 at 8:12 PM, Igor Kudrin <ikudrin.dev at
gmail.com> wrote:
> Hi David, Vedant,
> 
> It looks like we might have UB somewhere connected with reading coverage
mapping serialized in v2 format (with compressed function names).
> 
> I committed my patch, r266436, using the current format for .covmapping
file, and then buildbots complained about it:
> *
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/builds/11935/steps/check-llvm%20ubsan/logs/stdio
> *
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-bootstrap/builds/11460/steps/check-llvm%20ubsan/logs/stdio
> 
> I tried to reproduce the issue locally, but didn't succeed. Anyway,
I've reapplied my patch (r266620) using the old format
> for .covmapping, and buildbots are happy now.
> 
> Could you take a look on that? Do you have any idea what might cause the
problem?
> 
> Best regards,
> Igor Kudrin
>