Fix undefined behavior from incompatible function pointer casts in ref_count destroy callbacks#798
Open
bjosv wants to merge 1 commit intoawslabs:mainfrom
Open
Fix undefined behavior from incompatible function pointer casts in ref_count destroy callbacks#798bjosv wants to merge 1 commit intoawslabs:mainfrom
ref_count destroy callbacks#798bjosv wants to merge 1 commit intoawslabs:mainfrom
Conversation
Change destroy callbacks passed to aws_ref_count_init to match the expected aws_simple_completion_callback (void*) signature instead of casting typed function pointers. Add a wrapper for async_input_stream and fix pkcs11_tls_op_handler's destroy to accept void* directly. Signed-off-by: Björn Svensson <bjorn.a.svensson@est.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes UBSan failures caused by calling functions through incompatible pointer types.
aws_ref_count_initexpects a callback with signaturevoid (*)(void *)but we were casting typed destroy functions (e.g.,void (*)(struct aws_async_input_stream *))toaws_simple_completion_callback *.This is undefined behavior per the C standard, and UBSan rightfully flags it.
Fixes
How to reproduce
Build as described in https://github.com/awslabs/aws-c-s3?tab=readme-ov-file#building but enable UBSan via
-DCMAKE_C_FLAGS="-fsanitize=undefined -fno-sanitize-recover=all", then run S3 tests:cd build && ctest --output-on-failureUBSan will report errors like:
runtime error: call to function s_aws_custom_key_op_handler_destroy through pointer to incorrect function type 'void (*)(void *)'By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.