DynamoRIO / DynamoRIO/dynamorio
Question about code in the drwrap_after_callee_func()
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
Hello! I found out some strange code and I have a question about it:
```
static void
drwrap_after_callee_func(void *drcontext, per_thread_t *pt, dr_mcontext_t *mc,
int level, app_pc retaddr,
bool unwind, bool only_requested_unwind)
{
wrap_entry_t *wrap, *next;
uint idx;
drwrap_context_t wrapcxt;
drvector_t toflush = {0,};
bool do_flush = false;
bool unwound_all = true;
app_pc pc = pt->last_wrap_func[level]; // <<<<<<<<<<<
ASSERT(pc != NULL, "drwrap_after_callee: pc is NULL!"); // <<<<<<<<<<<
ASSERT(pt != NULL, "drwrap_after_callee: pt is NULL!");
ASSERT(!only_requested_unwind || unwind, "only_requested_unwind implies unwind");
NOTIFY(2, "%s: level %d function "PFX"%s\n", __FUNCTION__, level, pc,
unwind ? " abnormal" : "");
drwrap_context_init(drcontext, &wrapcxt, pc, mc, DRWRAP_WHERE_POST_FUNC, retaddr); // <<<<<<<<<<<
if (level >= MAX_WRAP_NESTING) {
if (level == pt->wrap_level)
pt->wrap_level--;
return; /* we skipped the wrap */ // <<<<<<<<<<<
}
...
```
As you see there is possible out of bound access on `app_pc pc = pt->last_wrap_func[level];` initialization if `level >= MAX_WRAP_NESTING`. After `app_pc pc` can be != NULL therefore ASSERT will not trigger and `wrapcxt` would be with this value.
Level is checked only after this initializing code. Is this situation possible and has some impact on further code?
Contributor guide
Assessment
This issue has not been assessed yet.