DynamoRIO / DynamoRIO/dynamorio

Question about code in the drwrap_after_callee_func()

Open
#2,813 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Hello! I found out some strange code and I have a question about it:
```
static void
drwrap_after_callee_func(void *drcontext, per_thread_t *pt, dr_mcontext_t *mc,
int level, app_pc retaddr,
bool unwind, bool only_requested_unwind)
{
wrap_entry_t *wrap, *next;
uint idx;
drwrap_context_t wrapcxt;
drvector_t toflush = {0,};
bool do_flush = false;
bool unwound_all = true;
app_pc pc = pt->last_wrap_func[level]; // <<<<<<<<<<<
ASSERT(pc != NULL, "drwrap_after_callee: pc is NULL!"); // <<<<<<<<<<<
ASSERT(pt != NULL, "drwrap_after_callee: pt is NULL!");
ASSERT(!only_requested_unwind || unwind, "only_requested_unwind implies unwind");

NOTIFY(2, "%s: level %d function "PFX"%s\n", __FUNCTION__, level, pc,
unwind ? " abnormal" : "");

drwrap_context_init(drcontext, &wrapcxt, pc, mc, DRWRAP_WHERE_POST_FUNC, retaddr); // <<<<<<<<<<<

if (level >= MAX_WRAP_NESTING) {
if (level == pt->wrap_level)
pt->wrap_level--;
return; /* we skipped the wrap */ // <<<<<<<<<<<
}
...
```
As you see there is possible out of bound access on `app_pc pc = pt->last_wrap_func[level];` initialization if `level >= MAX_WRAP_NESTING`. After `app_pc pc` can be != NULL therefore ASSERT will not trigger and `wrapcxt` would be with this value.
Level is checked only after this initializing code. Is this situation possible and has some impact on further code?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.