Skip to content

MSan's timer_create() interceptor uses incorrect type for tv_nsec member #156475

@chrisburel

Description

@chrisburel

In this code:

struct __sanitizer_timespec {
__sanitizer_time_t tv_sec; /* seconds */
u64 tv_nsec; /* nanoseconds */
};
__sanitizer_timespec.tv_nsec is declared to be the fixed-size type u64. This does not match the standard, which specifies that the type be:

  • long for <C23
  • some implementation-defined signed integer type that can represent integers in [​0​, 999999999], for >=C23

This causes false positives when mixing libraries that are instrumented with libraries that are not, on 32-bit platforms. Calling timer_create() -> timer_settime() -> timer_gettime() will cause an incorrect report of a stack-buffer-overflow with WRITE of size 32.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions