4 ms·

> You can never detect a read overflow otherwise: it will just access data outside your structure, but inside mapped memory, so the bug would be totally harmles

> You can never detect a read overflow otherwise: it will just access data outside your structure, but inside mapped memory, so the bug would be totally harmless and silent, with the exception of doing the same operations at the end of the mapped region. Unless you use one of the sanitizers while fuzzing, right? If not ASan then I would wager MSan could detect this.

grajaganDev 9y ago
Yes - ASan or Valgrind detect invalid reads. You could either use them during the fuzz run (and take a performance hit) or after the run on the generated corpus of test cases.
antirez 9y ago
Definitely, but I was using Valgrind and ASAN against the already patched version... So definitely no luck :-D I could see the issue only when it happened in the wild, and it only happened in this very odd conditions.
- wyldfire 9y ago
  Ok, thanks for clarifying. Incidentally, something's a little funny with this article. Missing spaces between words in a few places. E.g. "replacement formalloc()"
  - antirez 9y ago
    Sorry, wrote in medium and cut and pasted in my blog. I've too much trust in web technologies.
gumby 9y ago
>> so the bug would be totally harmless and silent, with the exception of doing the same operations at the end of the mapped region. “Harmless” only in a sense that the read won’t crash, but likely harmful if the result of the read is input to computation.