DynamoRIO / DynamoRIO/dynamorio

drsym_enumerate_lines pass corrupted data to callbacks

Open
#1,130 0 comments 0 reactions 0 assignees View on GitHub
Migrated Priority-Medium
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

_From [zhao...@google.com](https://code.google.com/u/106321947286816917100/) on March 22, 2013 13:45:25_

What steps will reproduce the problem? 1. run calc in dynamorio with bbcov client
2. pass logfile to processed by bbcov2lcov

bbcov2lcov report incorrect line_addr.

Some logging:

lookup 0x000c7802 in bb table 0x016a4b08
skip: o:\w7rtm.obj.x86fre\com\rpc\ndrole\ndrole\objfre\i386\registry.obj, d:\w7rtm\com\rpc\ndrole\registry.cxx, 204, 0x000c7802
Found in line table 0x0124ff28 212, 211
lookup 0x000c780e in bb table 0x016a4b08
skip: o:\w7rtm.obj.x86fre\com\rpc\ndrole\ndrole\objfre\i386\registry.obj, d:\w7rtm\com\rpc\ndrole\registry.cxx, 212, 0x000c780e
Found in line table 0x0124ff28 216, 215
lookup 0xef000000 in bb table 0x016a4b08

The line_addr changes from 0xc780e to 0xef000000.

stack value:
0:000> dds 00a9c9a4
00a9c9a4 00a9fd98
00a9c9a8 592f3878 drsyms!enum_lines_cb+0x78 [d:\src\cygwin\home\zhaoqin\workspace\dynamorio\dynamorio.git\ext\drsyms\drsyms_windows.c @ 796]
00a9c9ac 00a9c9b8 <== drsym_line_info_t *info
00a9c9b0 016a4b08
00a9c9b4 00a9fdd8
00a9c9b8 00a9ca04
00a9c9bc 00a9cb09

0:000> dt (drsym_line_info_t)00a9c9b8
+0x000 cu_name : 0x00a9ca04 "o:\w7rtm.obj.x86fre\com\rpc\ndrole\ndrole\objfre\i386\registry.obj"
+0x004 file : 0x00a9cb09 "d:\w7rtm\com\rpc\ndrole\registry.cxx"
+0x008 line : 0xd8
+0x010 line_addr : 0xef000000

The code looks fine, the problem seems come from its caller:

00a9c9d4 704d55dc dbghelp!DoEnumCallback+0x224
00a9c9d8 00a9c9f4 <== struct _SRCCODEINFO \* in
00a9c9dc 00a9fdd8
00a9c9e0 010a0724
00a9c9e4 0109b4a0

typedef struct _SRCCODEINFO {
DWORD SizeOfStruct;
PVOID Key;
DWORD64 ModBase;
TCHAR Obj[MAX_PATH+1];
TCHAR FileName[MAX_PATH+1];
DWORD LineNumber;
DWORD64 Address;
} SRCCODEINFO, *PSRCCODEINFO;

00a9c9f4 00000228 00000000 11000000 00000000 (...............
00a9ca04 775c3a6f 6d747237 6a626f2e 3638782e o:\w7rtm.obj.x86
00a9ca14 5c657266 5c6d6f63 5c637072 6f72646e fre\com\rpc\ndro
00a9ca24 6e5c656c 6c6f7264 626f5c65 6572666a le\ndrole\objfre
00a9ca34 3833695c 65725c36 74736967 6f2e7972 \i386\registry.o
00a9ca44 00006a62 00000000 00000000 00000000 bj..............
...
00a9cb04 00000000 5c3a6400 74723777 6f635c6d .....d:\w7rtm\co
00a9cb14 70725c6d 646e5c63 656c6f72 6765725c m\rpc\ndrole\reg
00a9cb24 72747369 78632e79 00000078 00000000 istry.cxx.......
...
00a9cc14 00000000 00000000 00fc0000 00fc2fd8 ............./..
00a9cc24 00fc2fd8 00000000 00fc2fd8 00fc0000 ./......./......

So the base is 0x11000000, but the Address is 0x00000000.
That's why we got 0xef000000 instead.

Need more investigation why the data is corrupted.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1130_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.