DynamoRIO / DynamoRIO/dynamorio
bogus modoffs in drsym_search_symbols()
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
When using drsym_search_symbols(), my callback was passed a bogus offset,
leading to a crash in my client:
```
0:000> .frame 4
04 0077b69c 00f889c8 gensysnums!search_syms_cb+0xa8 [c:\derek\drmemory\git\src\tools\gensysnums.cpp @ 403]
0:000> dv
name = 0x0077b734 "d:\rs2.obj.x86fre\minkernel\ntdll\wow6432\objfre\i386\ntdll.exp"
modoffs = 0xef000000
0:000> dt pSymInfo
dtx is unsupported for this scenario. It only recognizes dtx [] [
Local var @ 0x77b6bc Type _SYMBOL_INFO*
0x0077b6e0
+0x000 SizeOfStruct : 0x58
+0x004 TypeIndex : 0
+0x008 Reserved : [2] 0
+0x018 Index : 1
+0x01c Size : 0
+0x020 ModBase : 0x11000000
+0x028 Flags : 0
+0x030 Value : 0
+0x038 Address : 0
+0x040 Register : 0
+0x044 Scope : 0
+0x048 Tag : 2
+0x04c NameLen : 0x3f
+0x050 MaxNameLen : 0x7d1
+0x054 Name : [1] "d"
0:000> dc @@(pSymInfo)+54
0077b734 725c3a64 6f2e3273 782e6a62 72663638 d:\rs2.obj.x86fr
0077b744 696d5c65 72656b6e 5c6c656e 6c64746e e\minkernel\ntdl
0077b754 6f775c6c 33343677 626f5c32 6572666a l\wow6432\objfre
0077b764 3833695c 746e5c36 2e6c6c64 00707865 \i386\ntdll.exp.
0077b774 0000006c 008e0000 0077b980 50000062 l.........w.b..P
```
It's a symbol with a 0 address. It seems best to not pass it to the search
callback? Or else have some way of indicating a 0 address: the offset alone is
unsafe, as it may or may not be clear that it's bogus depending on the ModBase.
Contributor guide
Assessment
This issue has not been assessed yet.