{"action":"opened","issue":{"url":"https://api.github.com/repos/golang/go/issues/11577","labels_url":"https://api.github.com/repos/golang/go/issues/11577/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/11577/comments","events_url":"https://api.github.com/repos/golang/go/issues/11577/events","html_url":"https://github.com/golang/go/issues/11577","id":92917254,"number":11577,"title":"gccgo: heap-buffer-overflow in Lex::skip_cpp_comment","user":{"login":"dvyukov","id":1095328,"avatar_url":"https://avatars.githubusercontent.com/u/1095328?v=3","gravatar_id":"","url":"https://api.github.com/users/dvyukov","html_url":"https://github.com/dvyukov","followers_url":"https://api.github.com/users/dvyukov/followers","following_url":"https://api.github.com/users/dvyukov/following{/other_user}","gists_url":"https://api.github.com/users/dvyukov/gists{/gist_id}","starred_url":"https://api.github.com/users/dvyukov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dvyukov/subscriptions","organizations_url":"https://api.github.com/users/dvyukov/orgs","repos_url":"https://api.github.com/users/dvyukov/repos","events_url":"https://api.github.com/users/dvyukov/events{/privacy}","received_events_url":"https://api.github.com/users/dvyukov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"ianlancetaylor","id":3194333,"avatar_url":"https://avatars.githubusercontent.com/u/3194333?v=3","gravatar_id":"","url":"https://api.github.com/users/ianlancetaylor","html_url":"https://github.com/ianlancetaylor","followers_url":"https://api.github.com/users/ianlancetaylor/followers","following_url":"https://api.github.com/users/ianlancetaylor/following{/other_user}","gists_url":"https://api.github.com/users/ianlancetaylor/gists{/gist_id}","starred_url":"https://api.github.com/users/ianlancetaylor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ianlancetaylor/subscriptions","organizations_url":"https://api.github.com/users/ianlancetaylor/orgs","repos_url":"https://api.github.com/users/ianlancetaylor/repos","events_url":"https://api.github.com/users/ianlancetaylor/events{/privacy}","received_events_url":"https://api.github.com/users/ianlancetaylor/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-07-03T18:02:59Z","updated_at":"2015-07-03T18:02:59Z","closed_at":null,"body":"gccgo built with asan crashes on the following input (quoted form):\r\n\t\"package\\rG\\n//line \\u205f\" +\r\n\t\"\\u205f\\u205f\\u205f\\u205f\\u205f\\u205f\\xe2\\x81\" +\r\n\t\"\\x9f\\u205f\\u205f\\u205f\\u205f\\u205f\\u205f\\xe2\" +\r\n\t\"\\x81\\x9f\\u205f\\u205f\\u205f\\u205f\\u205f\\u205f\" +\r\n\t\"\\u205f\\u205f\\u205f\\u205f\\u205f\\u205f\\xe2\\x81\" +\r\n\t\"\\x9f\\u205f\\u205f\\u205f\\u205f\\u205f:1\"\r\n```\r\n```\r\n==100579==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000bab8 at pc 0x000000681676 bp 0x7fff65a42dc0 sp 0x7fff65a42570\r\nREAD of size 14 at 0x60c00000bab8 thread T0\r\n    #0 0x681675 in __interceptor_memcmp ../../../../libsanitizer/asan/asan_interceptors.cc:332\r\n    #1 0x7e489e in Lex::skip_cpp_comment() ../../gcc/go/gofrontend/lex.cc:1731\r\n    #2 0x7e6dda in Lex::next_token() ../../gcc/go/gofrontend/lex.cc:593\r\n    #3 0x7e80a4 in Parse::advance_token() ../../gcc/go/gofrontend/parse.cc:80\r\n    #4 0x8141d2 in Parse::program() ../../gcc/go/gofrontend/parse.cc:5648\r\n    #5 0x78966f in go_parse_input_files(char const**, unsigned int, bool, bool) ../../gcc/go/gofrontend/go.cc:73\r\n    #6 0x77c961 in go_langhook_parse_file ../../gcc/go/go-lang.c:304\r\n    #7 0x14ae7f2 in compile_file ../../gcc/toplev.c:551\r\n    #8 0x61fe29 in do_compile ../../gcc/toplev.c:2061\r\n    #9 0x61fe29 in toplev::main(int, char**) ../../gcc/toplev.c:2162\r\n    #10 0x629457 in main ../../gcc/main.c:39\r\n    #11 0x7f00dcfd4ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n    #12 0x62a292  (/usr/local/google/home/dvyukov/src/gcc/build_asan/gcc/go1+0x62a292)\r\n\r\n0x60c00000bab8 is located 0 bytes to the right of 120-byte region [0x60c00000ba40,0x60c00000bab8)\r\nallocated by thread T0 here:\r\n    #0 0x6a1eca in operator new[](unsigned long) ../../../../libsanitizer/asan/asan_new_delete.cc:62\r\n    #1 0x7df932 in Lex::Lex(char const*, _IO_FILE*, Linemap*) ../../gcc/go/gofrontend/lex.cc:448\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../libsanitizer/asan/asan_interceptors.cc:332 __interceptor_memcmp\r\nShadow bytes around the buggy address:\r\n  0x0c187fff9700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c187fff9710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c187fff9720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c187fff9730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c187fff9740: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\r\n=>0x0c187fff9750: 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa\r\n  0x0c187fff9760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0c187fff9770: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\r\n  0x0c187fff9780: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa\r\n  0x0c187fff9790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff97a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n```\r\ngcc version 6.0.0 20150702 (experimental) (GCC)"}}