1938288f 3 net.c:306:mg_mgr_init MG_IO_SIZE: 16384, TLS: none 1938288f 3 net.c:223:mg_listen 1 4 udp://224.0.0.251:5353 [*] mDNS server ready on UDP/5353 1938307c 3 sock.c:360:read_conn 1 4 0:0:0 34 err 0 1938307c 3 dns.c:438:handle_mdns_query PTR request for _http._tcp [+] Got mDNS request! Type=12 [+] PTR request for _http._tcp [VULN] Setting 300-byte TXT record ================================================================= ==5894==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xf34ef370033a at pc 0xf34ef5855124 bp 0xfffff8043ed0 sp 0xfffff80436b0 WRITE of size 300 at 0xf34ef370033a thread T0 #0 0xf34ef5855120 in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 #1 0xc43522a011f4 in build_txt_record src/dns.c:390 #2 0xc43522a028d4 in handle_mdns_query src/dns.c:496 #3 0xc43522a03b68 in handle_mdns_record src/dns.c:575 #4 0xc43522a03c38 in mdns_cb src/dns.c:584 #5 0xc43522a03f58 in mg_call src/event.c:21 #6 0xc43522a39438 in iolog src/sock.c:133 #7 0xc43522a3b74c in read_conn src/sock.c:362 #8 0xc43522a40774 in mg_mgr_poll src/sock.c:783 #9 0xc43522a4cda0 in main /data/pruva/runs/17a15ce6-4969-4882-9c55-0a227b0d8ef1/coding/tmp_verify/mdns_verify_harness.c:45 #10 0xf34ef55d84c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: d6c205bda1b6e91815f8fef45bdf56bc2239c37e) #11 0xf34ef55d8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: d6c205bda1b6e91815f8fef45bdf56bc2239c37e) #12 0xc435229fb26c in _start (/data/pruva/runs/17a15ce6-4969-4882-9c55-0a227b0d8ef1/coding/tmp_verify/mdns_verify+0xb26c) (BuildId: a1ed437f16d42fa2a18f6f3236cf78ae84dde799) Address 0xf34ef370033a is located in stack of thread T0 at offset 826 in frame #0 0xc43522a01290 in handle_mdns_query src/dns.c:396 This frame has 7 object(s): [32, 34) 'offset' (line 480) [48, 50) 'offset' (line 506) [64, 72) 'rr' (line 398) [96, 112) 'defname' (line 411) [128, 192) 'req' (line 413) [224, 480) 'name' (line 408) [544, 826) 'buf' (line 405) <== Memory access at offset 826 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy Shadow bytes around the buggy address: 0xf34ef3700080: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00 0xf34ef3700100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0xf34ef3700180: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 0xf34ef3700200: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 0xf34ef3700280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0xf34ef3700300: 00 00 00 00 00 00 00[02]f3 f3 f3 f3 f3 f3 f3 f3 0xf34ef3700380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0xf34ef3700400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0xf34ef3700480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0xf34ef3700500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0xf34ef3700580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==5894==ABORTING