Heap overflow in get_clear_value()

[encryptogroup]

Heap overflow in get_clear_value()

[dd23]

Thanks for reporting this.

I think the intuition of using template T in this case was, that there are 8, 16, 32, and 64-bit elements in arithmetic sharing and in the smaller 3 cases you don't want to allocate 64 bit for every element.

So I guess, what it should look like is similar to BoolSharing::InstantiateGate(GATE* gate)
i.e., we ceil-divide nvals by sizeof(T). We have to verify and test this though.

[dd23]

I have pushed f59161c that should fix this.
Previously the amount of data read from the gate was indeed too large in some cases (always UGATE_T, which is 64 bit).
Now the amount of data that is read matches the type you pass to get_clear_value() as template.

This is still not the end of the whole story, as sometimes other tests do fail for various reasons, but it should fix this particular problem.

[lenerd]

It breaks during a2y operations (test cases 24 and 25) in yaoserversharing.cpp:275 and yaoclientsharing.cpp:427 (see below).

The ArithSharing<T>::InstantiateGate method should be modified anyway since the UGATE_T* points to a buffer too small for a UGATE_T.

---

ASan output of the server side:

$ ./test-aby.exe -r 0 -t 24
Running test no. 0 on operation a2y                       
=================================================================
==11796==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000043850 at pc 0x55d2529a03d3 bp 0x7ffd75304ef0 sp 0x7ffd75304ee0
READ of size 8 at 0x602000043850 thread T0
    #0 0x55d2529a03d2 in YaoServerSharing::SendConversionValues(unsigned int) ../../abycore/sharing/yaoserversharing.cpp:275
    #1 0x55d25299fc46 in YaoServerSharing::EvaluateInteractiveOperations(unsigned int) ../../abycore/sharing/yaoserversharing.cpp:241
    #2 0x55d252a60ea2 in ABYParty::EvaluateCircuit() ../../abycore/aby/abyparty.cpp:361
    #3 0x55d252a5f13a in ABYParty::ExecCircuit() ../../abycore/aby/abyparty.cpp:248
    #4 0x55d252ab1458 in test_standard_ops(aby_ops_t*, ABYParty*, unsigned int, unsigned int, unsigned int, e_role, bool) /home/lennart/git/ABY/src/test/abytest.cpp:256
    #5 0x55d252aaf8e4 in run_tests(e_role, char*, unsigned short, SECURITYLEVELS, unsigned int, unsigned int, unsigned int, e_mt_gen_alg, int, unsigned int, bool, bool) /home/lennart/git/ABY/src/test/abytest.cpp:126
    #6 0x55d252aaf2b5 in main /home/lennart/git/ABY/src/test/abytest.cpp:45
    #7 0x7fe4b8c4bf49 in __libc_start_main (/usr/lib/libc.so.6+0x20f49)
    #8 0x55d2528964d9 in _start (/home/lennart/git/ABY/bin/test-aby.exe+0x824d9)

0x602000043854 is located 0 bytes to the right of 4-byte region [0x602000043850,0x602000043854)
allocated by thread T0 here:
    #0 0x7fe4ba953ce1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:70
    #1 0x55d2528fc032 in ArithSharing<unsigned int>::InstantiateGate(GATE*) src/abycore/sharing/arithsharing.cpp:866
    #2 0x55d2528fa98b in ArithSharing<unsigned int>::EvaluateMULGate() src/abycore/sharing/arithsharing.cpp:560
    #3 0x55d2528fa374 in ArithSharing<unsigned int>::FinishCircuitLayer(unsigned int) src/abycore/sharing/arithsharing.cpp:513
    #4 0x55d252a60f8b in ABYParty::EvaluateCircuit() ../../abycore/aby/abyparty.cpp:386
    #5 0x55d252a5f13a in ABYParty::ExecCircuit() ../../abycore/aby/abyparty.cpp:248
    #6 0x55d252ab1458 in test_standard_ops(aby_ops_t*, ABYParty*, unsigned int, unsigned int, unsigned int, e_role, bool) /home/lennart/git/ABY/src/test/abytest.cpp:256
    #7 0x55d252aaf8e4 in run_tests(e_role, char*, unsigned short, SECURITYLEVELS, unsigned int, unsigned int, unsigned int, e_mt_gen_alg, int, unsigned int, bool, bool) /home/lennart/git/ABY/src/test/abytest.cpp:126
    #8 0x55d252aaf2b5 in main /home/lennart/git/ABY/src/test/abytest.cpp:45
    #9 0x7fe4b8c4bf49 in __libc_start_main (/usr/lib/libc.so.6+0x20f49)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../abycore/sharing/yaoserversharing.cpp:275 in YaoServerSharing::SendConversionValues(unsigned int)

ASan output of the client side:

$ ./test-aby.exe -r 1 -t 24                          [0:17:15]
Running test no. 0 on operation a2y
=================================================================
==11801==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003b530 at pc 0x560e461e2c17 bp 0x7ffce99adec0 sp 0x7ffce99adeb0
READ of size 8 at 0x60200003b530 thread T0
    #0 0x560e461e2c16 in YaoClientSharing::EvaluateConversionGate(unsigned int) ../../abycore/sharing/yaoclientsharing.cpp:427
    #1 0x560e461e0ef6 in YaoClientSharing::EvaluateInteractiveOperations(unsigned int) ../../abycore/sharing/yaoclientsharing.cpp:234
    #2 0x560e462b2ea2 in ABYParty::EvaluateCircuit() ../../abycore/aby/abyparty.cpp:361
    #3 0x560e462b113a in ABYParty::ExecCircuit() ../../abycore/aby/abyparty.cpp:248
    #4 0x560e46303458 in test_standard_ops(aby_ops_t*, ABYParty*, unsigned int, unsigned int, unsigned int, e_role, bool) /home/lennart/git/ABY/src/test/abytest.cpp:256
    #5 0x560e463018e4 in run_tests(e_role, char*, unsigned short, SECURITYLEVELS, unsigned int, unsigned int, unsigned int, e_mt_gen_alg, int, unsigned int, bool, bool) /home/lennart/git/ABY/src/test/abytest.cpp:126
    #6 0x560e463012b5 in main /home/lennart/git/ABY/src/test/abytest.cpp:45
    #7 0x7f58003b8f49 in __libc_start_main (/usr/lib/libc.so.6+0x20f49)
    #8 0x560e460e84d9 in _start (/home/lennart/git/ABY/bin/test-aby.exe+0x824d9)

0x60200003b534 is located 0 bytes to the right of 4-byte region [0x60200003b530,0x60200003b534)
allocated by thread T0 here:
    #0 0x7f58020c0ce1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:70
    #1 0x560e4614e032 in ArithSharing<unsigned int>::InstantiateGate(GATE*) src/abycore/sharing/arithsharing.cpp:866
    #2 0x560e4614c98b in ArithSharing<unsigned int>::EvaluateMULGate() src/abycore/sharing/arithsharing.cpp:560
    #3 0x560e4614c374 in ArithSharing<unsigned int>::FinishCircuitLayer(unsigned int) src/abycore/sharing/arithsharing.cpp:513
    #4 0x560e462b2f8b in ABYParty::EvaluateCircuit() ../../abycore/aby/abyparty.cpp:386
    #5 0x560e462b113a in ABYParty::ExecCircuit() ../../abycore/aby/abyparty.cpp:248
    #6 0x560e46303458 in test_standard_ops(aby_ops_t*, ABYParty*, unsigned int, unsigned int, unsigned int, e_role, bool) /home/lennart/git/ABY/src/test/abytest.cpp:256
    #7 0x560e463018e4 in run_tests(e_role, char*, unsigned short, SECURITYLEVELS, unsigned int, unsigned int, unsigned int, e_mt_gen_alg, int, unsigned int, bool, bool) /home/lennart/git/ABY/src/test/abytest.cpp:126
    #8 0x560e463012b5 in main /home/lennart/git/ABY/src/test/abytest.cpp:45
    #9 0x7f58003b8f49 in __libc_start_main (/usr/lib/libc.so.6+0x20f49)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../abycore/sharing/yaoclientsharing.cpp:427 in YaoClientSharing::EvaluateConversionGate(unsigned int)