AFLplusplus / AFLplusplus/qemu-libafl-bridge
linux-usermode: container_of(interval_tree_iter_first) returns NULL value
- Langage dominant
- C
- Étoiles
- 95
- Forks
- 51
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
During my work for Issue #122 I stumbled upon a MAPERR-segfault which tries to access 0x48 as address space. The offending code path is [here](https://github.com/AFLplusplus/qemu-libafl-bridge/blob/c9c6db9127509e1eeaf10daad8fa6bc12cc54f56/linux-user/syscall.c#L14220):
```c
// Should we check for NULL? Not sure, but if an inteval is in pageflags, then it should be in proc_maps too
proc_map_interval_node = interval_tree_iter_first(proc_maps_root, min, min);
e = container_of(proc_map_interval_node, MapInfo, itree);
int libafl_flags = 0;
if (flags & PAGE_READ) libafl_flags |= PROT_READ;
if (flags & PAGE_WRITE_ORG) libafl_flags |= PROT_WRITE;
if (flags & PAGE_EXEC) libafl_flags |= PROT_EXEC;
ret->is_valid = true;
ret->start = (uint64_t) h2g_nocheck(min);
ret->end = (uint64_t) max;
ret->offset = (uint64_t) e->offset; // segfault here!
ret->path = e->path;
ret->flags = libafl_flags;
ret->is_priv = e->is_priv;
```
`interval_tree_iter_first` returns NULL, which is then assigned to `proc_map_interval_node` and concludingly, to `e`. The access to `e->offset` then leads to a segfault, and explains the access to 0x48 because that is the offset position inside the struct. Therefore, the answer to the first comment inside this code appears to be yes :smile:.
Again, the question is how to handle it, which requires further research.
Guide de contribution
Aucun guide de contribution indexé pour ce dépôt
Évaluation
Cette issue n'a pas encore été évaluée.