DynamoRIO / DynamoRIO/drmemory

Potential dangling string pointer to stack in syscall_aux

Open
#888 0 comments 0 reactions 0 assignees View on GitHub
Migrated Priority-Medium
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on May 15, 2012 11:43:21_

We store packed_callstack_t's in our error_table, and we just copy the syscall_aux string pointer when we clone. This assumes that these are all pointers to string literals, which is the case most of the time. However, there are a few instances in our code base where we violate this invariant.

On syscall_linux.c:699, we have a stack temporary idmsg[32] that we snprintf to and use that. When I looked, there was one on Windows as well, but I'd have to search to find it.

These typically don't manifest in any way, because we don't ever try to print or symbolize stacks stored in our error_table. However, they are considered when doing error de-duplication since the syscall_aux pointer value is used in the hash (I think?) and in the equality comparison, where it is likely to always differ.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=888_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.