DynamoRIO / DynamoRIO/drmemory

CRASH in fuzz_buffer.mutator.random_seed test

Open
#1,787 1 comment 0 reactions 0 assignees View on GitHub
Bug-ToolCrash Component-DrFuzz OpSys-Linux OpSys-x64
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

This happened once. I could not reproduce it:

```
17/29 Testing: fuzz_buffer.mutator.random_seed
17/29 Test: fuzz_buffer.mutator.random_seed
Command: "/usr/bin/cmake" "-D" "cmd:STRING=../bin64/drmemory@-dr@{DRMEMORY_CTEST_DR_DIR}/..@-batch@-dr_ops@-dumpcore_mask@@0@-callstack_style@0x27@-no_results_to_stderr@-fuzz_target@!repeatme|2|0|1|10@-fuzz_mutator@r|n||0|0x123456789abcdef0@--@./fuzz_buffer@initialize" "-D" "TOOL_DR_HEAPSTAT:BOOL=OFF" "-D" "outpat:STRING={DRMEMORY_CTEST_SRC_DIR}/fuzz_buffer.mutator.random_seed.out" "-D" "respat:STRING={DRMEMORY_CTEST_SRC_DIR}/fuzz_buffer.mutator.random_seed.res" "-D" "nudge:STRING=../bin64/drmemory@-dr@{DRMEMORY_CTEST_DR_DIR}/..@-batch" "-D" "VMKERNEL:BOOL=OFF" "-D" "USE_DRSYMS:BOOL=ON" "-D" "X64:BOOL=ON" "-D" "toolbindir:STRING={DRMEMORY_CTEST_DR_DIR}/../bin64" "-D" "DRMEMORY_CTEST_SRC_DIR:STRING=/work/drmemory/git/src/tests" "-D" "DRMEMORY_CTEST_DR_DIR:STRING=/work/drmemory/build_suite/build_drmemory-rel-64/dynamorio/cmake" "-D" "CMAKE_SYSTEM_VERSION:STRING=4.1.8-200.fc22.x86_64" "-D" "exit_code:STRING=0" "-D" "path_append:STRING=" "-D" "postcmd:STRING=" "-P" "./runtest.cmake"
Directory: /work/drmemory/build_suite/build_drmemory-rel-64/tests
"fuzz_buffer.mutator.random_seed" start time: Oct 06 13:01 EDT
Output:
----------------------------------------------------------
STDOUT:
STDERR: WARNING: 64-bit non-pattern modes are experimental
~~Dr.M~~ WARNING: 64-bit non-pattern modes are experimental
~~Dr.M~~ Dr. Memory version 1.9.16714
!repeatme|2|0|1|10` `-fuzz_mutator` `r
0x000005bf799c0000 0x0000000000000000>
```

symquery doesn't seem to be working (will file separately):

```
> build_drmemory-rel-64/bin64/symquery -e build_drmemory-rel-64/dynamorio/lib64/release/libdynamorio.so -f -a 0x`echo 'obase=16;ibase=16;0000559B6FDA750C-0000559B6FC79000' | bc`
end+0xffd63114
/work/drmemory/git/src/dynamorio/core/lib/dr_helper.c:44+0xffff927a
```

This seems correct:

```
> addr2line -e build_drmemory-rel-64/dynamorio/lib64/release/libdynamorio.so -j .text -f `echo 'obase=16;ibase=16;12E50C-2C540'|bc`
memcache_lock
/work/drmemory/git/src/dynamorio/core/unix/memcache.c:130
```

Confirmed here:

```
(gdb) x/5i 0x55f9dd31f000 + 0x12e50c
0x55f9dd44d50c : callq 0x55f9dd39aa50
0x55f9dd44d511 : test %al,%al
0x55f9dd44d513 : je 0x55f9dd44d5b0
0x55f9dd44d519 :
addl $0x1,0x275fa8(%rip) # 0x55f9dd6c34c8
0x55f9dd44d520 : callq 0x55f9dd3b9600
(gdb) info line *0x55f9dd44d50c
Line 130 of "/work/drmemory/git/src/dynamorio/core/unix/memcache.c"
starts at address 0x55f9dd44d508 and ends at 0x55f9dd44d519 .
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.