Skip to content

Commit b7cc17f

Browse files
committed
fix memory leak of %rep mmacro
When running with -fsanitize=leak enabled nasm prints this error: Direct leak of 960 byte(s) in 5 object(s) allocated from: #0 0x7f52b6464a37 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 netwide-assembler#1 0x55cf36676c46 in nasm_calloc nasmlib/alloc.c:72 netwide-assembler#2 0x55cf36676cd1 in nasm_zalloc nasmlib/alloc.c:87 netwide-assembler#3 0x55cf366e3980 in do_directive asm/preproc.c:4754 netwide-assembler#4 0x55cf366fec97 in pp_tokline asm/preproc.c:7773 netwide-assembler#5 0x55cf366ff84a in pp_getline asm/preproc.c:7837 netwide-assembler#6 0x55cf3667263c in assemble_file asm/nasm.c:1722 netwide-assembler#7 0x55cf3666b4e4 in main asm/nasm.c:719 netwide-assembler#8 0x7f52b5b7cd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 netwide-assembler#9 0x7f52b5b7ce3f in __libc_start_main_impl ../csu/libc-start.c:392 netwide-assembler#10 0x55cf36666e04 in _start (/home/ivan/d/nasm/nasm+0x2e2e04) This error is reproducible on lnxlinux.asm test or on this small snippet: %rep 8 nop nop nop %endrep The original call to free_mmacro was commented out in 91e7240 as it caused use-after-free. https://bugzilla.nasm.us/show_bug.cgi?id=3392414 After adding free_mmacro I tested nasm with -fsanitize=address on all four reproducers attached to the issue and none of them causes use-after-free now. Also this commit passes all tests without causing use-after-free. Signed-off-by: Ivan Sorokin <vanyacpp@gmail.com>
1 parent a916e41 commit b7cc17f

File tree

1 file changed

+4
-9
lines changed

1 file changed

+4
-9
lines changed

asm/preproc.c

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7594,6 +7594,7 @@ static Token *pp_tokline(void)
75947594
break;
75957595
} else {
75967596
MMacro *m = istk->mstk.mstk;
7597+
bool should_free_mmacro = false;
75977598

75987599
/*
75997600
* Check whether a `%rep' was started and not ended
@@ -7648,6 +7649,8 @@ static Token *pp_tokline(void)
76487649
m->paramlen = NULL;
76497650
}
76507651
}
7652+
else
7653+
should_free_mmacro = true;
76517654

76527655
if (fm->nolist & NL_LINE) {
76537656
istk->noline--;
@@ -7667,16 +7670,8 @@ static Token *pp_tokline(void)
76677670

76687671
istk->where = l->where;
76697672

7670-
/*
7671-
* FIXME It is incorrect to always free_mmacro here.
7672-
* It leads to usage-after-free.
7673-
*
7674-
* https://bugzilla.nasm.us/show_bug.cgi?id=3392414
7675-
*/
7676-
#if 0
7677-
else
7673+
if (should_free_mmacro)
76787674
free_mmacro(m);
7679-
#endif
76807675
}
76817676
istk->expansion = l->next;
76827677
nasm_free(l);

0 commit comments

Comments
 (0)