DynamoRIO / DynamoRIO/dynamorio
CRASH (java): memcpy overlap in copy_frame_to_stack
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on December 27, 2012 20:21:50_
We crash on java when returning from what looks like a real app NULL pointer deref. I put a watch point on xsp in master_signal_handler_C and it gets clobbered inside memcpy.
(gdb) frame 0
#0 0xf72951d6 in copy_frame_to_stack (dcontext=0x53d15140, sig=11, frame=0xf75962ac, sp=0xf759629c "M\005%\367\v") at ../../core/linux/signal.c:2945
2945 memcpy(sp, frame, frame_size);
(gdb) bt
#0 0xf72951d6 in copy_frame_to_stack (dcontext=0x53d15140, sig=11, frame=0xf75962ac, sp=0xf759629c "M\005%\367\v") at ../../core/linux/signal.c:2945
#1 0xf7299dd8 in execute_handler_from_cache (dcontext=0x53d15140, sig=11, our_frame=0xf75962ac, sc_orig=0xf7596164, f=0x554b8e84, access_address=0x4
#2 0xf72975c6 in record_pending_signal (dcontext=0x53d15140, sig=11, ucxt=0xf759633c, frame=0xf75962ac, forged=false, access_address=0x4 ) at ../../core/linux/signal.c:3553
#3 0xf729985d in master_signal_handler_C (xsp=0xf759633c "") at ../../core/linux/signal.c:4272
(gdb) p sp
$16 = (byte *) 0xf759629c "M\005%\367\v"
(gdb) p frame
$17 = (sigframe_rt_t *) 0xf75962ac
(gdb) p frame_size
$18 = 268
I'm not sure where sp comes from yet and why it's pointing at the dstack. The SP from ucxt looks like it points at the app stack.
_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1042_
Contributor guide
Assessment
This issue has not been assessed yet.