DynamoRIO / DynamoRIO/dynamorio
CRASH (8.0.18523) x64: dr_insert_clean_call generates wrong encoding for (invalid) `mov r64, imm16`
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
**Describe the bug**
The [documentation of `dr_insert_clean_call`](https://dynamorio.org/dynamorio_docs/dr__ir__utils_8h.html#ae7b7bd1e750b8a24ebf401fb6a6d6d5e) currently states that:
> The routine also supports immediate integers that are smaller than the register size
Yet on x64 a `dr_insert_clean_call` with an operand of size 8 or 16 leads to a crash.
**To Reproduce**
From the root of the repository, at the currently last commit on branch master 6c638197ce9e651812f33b4f31f7710d94f0cc6d (tag: cronbuild-8.0.18523).
Modify [suite/tests/client-interface/count-bbs.dll.c](https://github.com/DynamoRIO/dynamorio/blob/6c638197ce9e651812f33b4f31f7710d94f0cc6d/suite/tests/client-interface/count-bbs.dll.c) to test `dr_insert_clean_call` with a 16 bits operand:
```diff
--- a/suite/tests/client-interface/count-bbs.dll.c
+++ b/suite/tests/client-interface/count-bbs.dll.c
@@ -38,7 +38,7 @@ static uint64 bbcnt1 = 0;
static uint64 bbcnt4 = 0;
static void
-bbcount4(reg_t r1, reg_t r2, reg_t r3, reg_t r4)
+bbcount4(reg_t r1, reg_t r2, reg_t r3, u_int16_t r4)
{
bbcnt4++;
}
@@ -74,7 +74,7 @@ bb_event(void *drcontext, void *tag, instrlist_t *bb, bool for_trace, bool trans
opnd_create_reg(REG_XAX));
dr_insert_clean_call(drcontext, bb, instr, bbcount4, false, 4,
opnd_create_reg(REG_XAX), opnd_create_reg(REG_XBX),
- opnd_create_reg(REG_XCX), opnd_create_reg(REG_XDX));
+ opnd_create_reg(REG_XCX), OPND_CREATE_INT16(0));
return DR_EMIT_DEFAULT;
}
```
Build and test:
```console
$ cmake -DBUILD_TESTS=ON ../dynamorio
$ make -j6
$ ctest -V -R "count-bbs"
test 127
Start 127: code_api|client.count-bbs
127: Test command: /dynamorio/bin64/drrun "-s" "90" "-quiet" "-killpg" "-stderr_mask" "0xC" "-dumpcore_mask" "0" "-code_api" "-c" "/dynamorio/suite/tests/bin/libclient.count-bbs.dll.so" "--" "/dynamorio/suite/tests/bin/simple_app"
127: Test timeout computed to be: 1500
127:
1/1 Test #127: code_api|client.count-bbs ........***Failed Required regular expression not found. Regex=[^Hello, world!
bbcount0_fp\.\.\. yes
bbcount1\.\.\. yes
bbcount4\.\.\. yes
$
] 0.03 sec
0% tests passed, 1 tests failed out of 1
```
**Expected behavior**
The modified test should pass, or the doc should be modified to state more explicitly what operands are not supported.
**Versions**
- What version of DynamoRIO are you using? **8.0.1**
- Does the latest build from
https://github.com/DynamoRIO/dynamorio/wiki/Latest-Build solve the problem? **No**
- What operating system version are you running on? **Ubuntu 20.04.1 LTS**
- Is your application 32-bit or 64-bit? **64**
**Additional context**
Might be a duplicate of #1707.
Contributor guide
Assessment
This issue has not been assessed yet.