Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix heap buffer overflow in nc_def_var of openfast-cpp #2443

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

marchdf
Copy link

@marchdf marchdf commented Sep 27, 2024

Feature or improvement description
Fixes a heap-buffer-overflow error. nc_def_var size should take the value of the size of the dim array. The size of ptRefDataDims is 1 so the nc_def_var should take a 1. Feels like all of these nc_def_var should really be using *Dims.size() But that would lead to a larger diff.

Diagnosis

(lldb) bt
* thread #1, name = 'naluX', stop reason = Heap buffer overflow
  * frame #0: 0x00005555563e2dc0 naluX`::AsanDie() at asan_rtl.cpp:44
    frame #1: 0x00005555563fc79c naluX`__sanitizer::Die() at sanitizer_termination.cpp:55:7
    frame #2: 0x00005555563dda6f naluX`::~ScopedInErrorReport() at asan_report.cpp:192:7
    frame #3: 0x00005555563e0abd naluX`::ReportGenericError() at asan_report.cpp:497:1
    frame #4: 0x00005555563d7df2 naluX`::___interceptor_memcpy() at sanitizer_common_interceptors_memintrinsics.inc:115:5
    frame #5: 0x00007ffff7c61903 libnetcdf.so.19`new_NC_var + 259
    frame #6: 0x00007ffff7c61746 libnetcdf.so.19`NC3_def_var + 214
    frame #7: 0x00007ffff7c12657 libnetcdf.so.19`nc_def_var + 71
    frame #8: 0x00007ffff4bdf089 libopenfastcpplib.so`fast::OpenFAST::prepareOutputFile(this=0x000052000000d650, iTurbLoc=0) at OpenFAST.cpp:455:16
    frame #9: 0x00007ffff4beca22 libopenfastcpplib.so`fast::OpenFAST::solution0(this=0x000052000000d650, writeFiles=true) at OpenFAST.cpp:954:17
    frame #10: 0x0000555557cde9e6 naluX`sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0::operator()(this=0x00007fffe796dea0) const at ActuatorBulkFAST.C:271:44
    frame #11: 0x0000555557cde995 naluX`void std::__invoke_impl<void, sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0&>((null)=__invoke_other @ 0x00007fffffff237f, __f=0x00007fffe796dea0) at invoke.h:61:14
    frame #12: 0x0000555557cde945 naluX`std::enable_if<is_invocable_r_v<void, sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0&>, void>::type std::__invoke_r<void, sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0&>(__fn=0x00007fffe796dea0) at invoke.h:111:2
    frame #13: 0x0000555557cde80d naluX`std::_Function_handler<void (), sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast()::$_0>::_M_invoke(__functor=0x00007fffe796dea0) at std_function.h:290:9
    frame #14: 0x0000555557ce95a3 naluX`std::function<void ()>::operator()(this=0x00007fffe796dea0) const at std_function.h:591:9
    frame #15: 0x0000555557ce0c9b naluX`sierra::nalu::squash_fast_output(func=function<void ()> @ 0x00007fffe796dea0) at ActuatorBulkFAST.h:82:3
    frame #16: 0x0000555557cdbe20 naluX`sierra::nalu::ActuatorBulkFAST::interpolate_velocities_to_fast(this=0x000052000000d080) at ActuatorBulkFAST.C:271:7
    frame #17: 0x0000555557d1788e naluX`sierra::nalu::ActuatorLineFastNGP::operator()(this=0x00005070000833b0) at ActuatorExecutorsFASTNgp.C:45:12
    frame #18: 0x0000555557bf9f6a naluX`sierra::nalu::ActuatorModel::execute(this=0x00005070000608f0, timer=0x000051c000003c90) at ActuatorModel.C:169:13
    frame #19: 0x0000555557bf6347 naluX`sierra::nalu::AeroContainer::execute(this=0x00005070000608f0, actTimer=0x000051c000003c90) at AeroContainer.C:118:20
    frame #20: 0x0000555556c02794 naluX`sierra::nalu::Realm::advance_time_step(this=0x000051c000003880) at Realm.C:1955:18
    frame #21: 0x000055555644d280 naluX`sierra::nalu::TimeIntegrator::integrate_realm(this=0x000050f000017bf0) at TimeIntegrator.C:389:16
    frame #22: 0x000055555644596f naluX`sierra::nalu::Simulation::run(this=0x00007fffe7f00fa0) at Simulation.C:216:20
    frame #23: 0x000055555641ae23 naluX`main(argc=5, argv=0x00007fffffff3688) at nalu.C:198:9
    frame #24: 0x00007fffeca2e7e5 libc.so.6`__libc_start_main + 229
    frame #25: 0x000055555633c92e naluX`_start + 46
(lldb) frame s 8
frame #8: 0x00007ffff4bdf089 libopenfastcpplib.so`fast::OpenFAST::prepareOutputFile(this=0x000052000000d650, iTurbLoc=0) at OpenFAST.cpp:455:16
   452          ncOutVarIDs_["bld_ld"] = tmpVarID;
   453          ierr = nc_def_var(ncid, "bld_ld_loc", NC_DOUBLE, 4, bldDataDims.data(), &tmpVarID);
   454          ncOutVarIDs_["bld_ld_loc"] = tmpVarID;
-> 455          ierr = nc_def_var(ncid, "hub_ref_pos", NC_DOUBLE, 2, ptRefDataDims.data(), &tmpVarID);
   456          ncOutVarIDs_["hub_ref_pos"] = tmpVarID;
   457          ierr = nc_def_var(ncid, "hub_disp", NC_DOUBLE, 2, ptDataDims.data(), &tmpVarID);
   458          ncOutVarIDs_["hub_disp"] = tmpVarID;

Related issue, if one exists

Impacted areas of the software

openfast-cpp

@marchdf
Copy link
Author

marchdf commented Sep 27, 2024

It should be noted that the turbineData[iTurbLoc].sType == EXTLOADS pathway had the right sizes for those vars. So it was only failing for turbineData[iTurbLoc].sType == EXTINFLOW path.

@andrew-platt
Copy link
Collaborator

At first glance, there appears to be some inconsistencies in this section of code. I would excpect hub_disp (line 457), hub_vel (line 459), and hubrotvel (line 461) will also need this change. Similarly for the nacelle section below.

@marchdf
Copy link
Author

marchdf commented Sep 30, 2024

I am not sure why the test is failing...

@andrew-platt
Copy link
Collaborator

There is a segmentation fault with the 5MW_Land_DLL_WTurb_cpp case.

Screenshot 2024-10-01 at 10 01 06 AM

@andrew-platt andrew-platt added this to the v4.0.0 milestone Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants