Potential false negative: misuse-of-free

[evintila]

Dear EffectiveSan authors,

We have noticed that EffectiveSan, under certain conditions, does not detect misuses of free (CWE-761), and are wondering if this is expected behavior.

The misuse in the following example is not detected:

#include <stdlib.h>

int main()
{
  char *p = malloc(16);
  free(p + 8);
  return 0;
}

Compiler versions used:

clang version 4.0.1 (tags/RELEASE_401/final)
Target: x86_64-unknown-linux-gn

git commit d4604a286f7d303c4cc50f9a43eda2b66f679514

Flags used: -fsanitize=effective -O2

[GJDuck]

This one is real. The current implementation of effective_free(p) allows p to point anywhere in the object, and not restricted to just the base pointer.

This is not an inherent limitation of EffectiveSan, just a quirk of the current implementation. It should be easy to fix, so I will keep the issue open.