DynamoRIO / DynamoRIO/drmemory

fail to detect unaddressable error in -light mode with > 4-byte memref in 471.omnetpp

Open
#901 3 comments 0 reactions 0 assignees View on GitHub
Migrated Priority-Medium
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

_From [zhao...@google.com](https://code.google.com/u/106321947286816917100/) on May 25, 2012 22:47:18_

call stack:

#0 0x55b5dd83 in ?? () // code for __strspn_sse42
#1 0x08096ac0 in cPar::setFromText(char const*, char) ()
#2 0x08093dcf in cPar::read() ()
#3 0x08052ba3 in EtherHost::doBuildInside() ()
#4 0x0809e6b0 in cModule::buildInside() ()
#5 0x08080df2 in TwoHosts::doBuildInside() ()
#6 0x0809e6b0 in cModule::buildInside() ()
#7 0x0807a4e0 in twoHosts::setupNetwork() ()

code in code cache:
=> 0x55b5dd83: and $0xfffffff0,%eax
0x55b5dd86: mov %eax,0x8(%esp)
0x55b5dd8a: mov %edx,%fs:0x6c
0x55b5dd91: mov %ecx,%fs:0x68
0x55b5dd98: lea (%eax),%ecx
0x55b5dd9a: mov %ecx,%edx
0x55b5dd9c: shr $0x10,%edx
0x55b5dd9f: shr $0x2,%ecx
0x55b5dda2: add 0x73952720(,%edx,4),%ecx
0x55b5dda9: cmpl $0x1,(%ecx)
0x55b5ddac: jne 0x55b5ddb0
0x55b5ddae: ud2
0x55b5ddb0: movdqa (%eax),%xmm0

corresponding app code:
0xf7228bb0 <__strspn_sse42+80>: and $0xfffffff0,%eax
0xf7228bb3 <__strspn_sse42+83>: mov %eax,0x8(%esp)
0xf7228bb7 <__strspn_sse42+87>: movdqa (%eax),%xmm0

mcontext:
(gdb) p/x $eax
$42 = 0x83794e8

In global.txt:
malloc-post 0x083794e8-0x083794fc = 0x14 (really 0x083794d8-0x0837950c 0x34)
malloc-post changing from 0x083794d8 to 0x083794e8
MALLOC 0x083794e8-0x083794fc
set range 0x083794e8-0x083794fc => 0x3
leaving alloc routine 0x08089520 _Znwj rec=2 adj=0
recursive post-alloc routine 0x08089520 _Znwj: no adjustments; eax=0x083794e8
leaving alloc routine 0xf73740a0 _Znaj rec=1 adj=0
in event_basic_block(tag=0xf7228bb0)

Tracing the execution:

Breakpoint 17, 0x55b5dda9 in ?? ()
(gdb) x/20i 0x55b5dd83
0x55b5dd83: and $0xfffffff0,%eax
0x55b5dd86: mov %eax,0x8(%esp)
0x55b5dd8a: mov %edx,%fs:0x6c
0x55b5dd91: mov %ecx,%fs:0x68
0x55b5dd98: lea (%eax),%ecx
0x55b5dd9a: mov %ecx,%edx
0x55b5dd9c: shr $0x10,%edx
0x55b5dd9f: shr $0x2,%ecx
0x55b5dda2: add 0x73952720(,%edx,4),%ecx
=> 0x55b5dda9: cmpl $0x1,(%ecx)
0x55b5ddac: jne 0x55b5ddb0
0x55b5ddae: ud2
0x55b5ddb0: movdqa (%eax),%xmm0

(gdb) p/x $eax
$43 = 0x83794e0
(gdb) p/x *(int *)($ecx)
$44 = 0x3030101

The movdqa is accessing (%eax = 0x83794e0), which is unaddressable (in the redzone), but DrMemory fail to report it.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=901_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.