DynamoRIO / DynamoRIO/dynamorio

dynamorio could crash when clone syscall's newsp == 0

Open
#4,043 4 comments 0 reactions 0 assignees View on GitHub
OpSys-Linux Status-CannotReproduce Status-NeedInfo
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

when `newsp == 0`, we should save the `mc->sp` to `record->app_thread_xsp`

Bug fix

core/unix/signal.c

```
@@ -632,6 +632,13 @@ create_clone_record(dcontext_t *dcontext, reg_t *app_thread_xsp)
record = (clone_record_t *)(dstack - sizeof(clone_record_t));
ASSERT(ALIGNED(record, get_ABI_stack_alignment()));
record->app_thread_xsp = *app_thread_xsp;

/* fix bug when clone syscall's argument: newsp == 0 (for example: vfork in android libc.so)
*/
if(record->app_thread_xsp == 0)
{
record->app_thread_xsp = get_mcontext(dcontext)->sp;
}
/* asynch_target is set in d_r_dispatch() prior to calling pre_system_call(). */
record->continuation_pc = dcontext->asynch_target;
record->clone_flags = dcontext->sys_param0;
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.