MozillaSecurity / MozillaSecurity/FuzzManager

Exception is thrown if $pc is not a readable address

Open
#496 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug FTB
Dominant language
Python
Stars
208
Forks
48
Avg merge
23h 5m
Merged PRs (30d)
2

Description

I occasionally get this crash when running funfuzz:

Traceback (most recent call last):
  File "/usr/local/fbcode/gcc-5-glibc-2.23/lib/python3.6/runpy.py", line 193, in _run_module_as_main
    "__main__", mod_spec)
  File "/usr/local/fbcode/gcc-5-glibc-2.23/lib/python3.6/runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "/home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/funfuzz/js/loop.py", line 298, in <module>
    sys.argv[1:], create_collector.make_collector(), False)
  File "/home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/funfuzz/js/loop.py", line 179, in many_timed_runs
    js_interesting_options.jsengineWithArgs, logPrefix, False, env=env)
  File "/home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/funfuzz/js/js_interesting.py", line 173, in __init__
    crashInfo = CrashInfo.CrashInfo.fromRawCrashData(out, err, pc, auxCrashData=auxCrashData)
  File "/home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/FTB/Signatures/CrashInfo.py", line 219, in fromRawCrashData
    result = GDBCrashInfo(stdout, stderr, configuration, auxCrashData)
  File "/home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/FTB/Signatures/CrashInfo.py", line 954, in __init__
    crashAddress = GDBCrashInfo.calculateCrashAddress(self.crashInstruction, self.registers)
  File "/home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/FTB/Signatures/CrashInfo.py", line 1021, in calculateCrashAddress
    raise RuntimeError("Invalid instruction: %s" % instruction)
RuntimeError: Invalid instruction: /home/gulshan/virtualenvs/funfuzz2/lib/python3.6/site-packages/funfuzz/util/gdb_cmds.txt:28:

The reason this happens is that $pc is not a readable address. In the gdb_cmds.txt script, we run the command x/8i $pc. When I load the coredump manually in GDB and run this command, I get:

> x $pc
0x7f7466df4d56: Cannot access memory at address 0x7f7466df4d56

Then calculateCrashAddress function throws an exception because the self.crashInstruction is not in the valid format (it doesn't match the regex).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with funfuzz/util/gdb_cmds.txt and FTB/Signatures/CrashInfo.py, especially GDBCrashInfo.init and calculateCrashAddress. Reproduce the unreadable-$pc GDB output shown in the issue and trace how it becomes self.crashInstruction. Done means this output no longer causes an unhandled RuntimeError during crash processing, with the relevant behavior covered by the existing tests if available.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.