CRASH (isspace use in any client with -private_loader)

[derekbruening]

From bruen...@google.com on September 21, 2011 16:03:54

Dr. Memory on Linux still doesn't work the -private_loader.

Program received signal SIGSEGV, Segmentation fault.
0xf6ea10dd in ?? ()
(gdb) bt
#0 0xf6ea10dd in __ctype_b_loc () at ../include/ctype.h:30
#1 0xf70aaedf in get_option_word (s=0xf778ccd4 "-logdir /usr/local/google/home/bruening/work/build/build_drmemory/logs ",
buf=0xffa1ae08 "\250\256\241\377i\r^\367P\257h ", <incomplete sequence \315>) at /home/bruening/drmemory/git/src/common/utils.c:334
#2 0xf704f54d in options_init (opstr=0xf778ccd4 "-logdir /usr/local/google/home/bruening/work/build/build_drmemory/logs ")
at /home/bruening/drmemory/git/src/drmemory/options.c:250
#3 0xf6fdd0f7 in drmem_options_init (opstr=0xf778ccd4 "-logdir /usr/local/google/home/bruening/work/build/build_drmemory/logs ")
at /home/bruening/drmemory/git/src/drmemory/drmemory.c:102
#4 0xf6fe2020 in dr_init (id=0) at /home/bruening/drmemory/git/src/drmemory/drmemory.c:1345
#5 0xf76a6d5f in instrument_init () at /home/bruening/dr/git/src/core/x86/instrument.c:530
#6 0xf74d8a2a in dynamorio_app_init () at /home/bruening/dr/git/src/core/dynamo.c:620
#7 0xf74657c7 in _init () at /home/bruening/dr/git/src/core/linux/preload.c:186
#8 0xf77a96cc in ?? () from /lib/ld-linux.so.2
#9 0xf77a97e9 in ?? () from /lib/ld-linux.so.2
#10 0xf779b88f in ?? () from /lib/ld-linux.so.2
(gdb) up 1
#1 0xf70aaedf in get_option_word (s=0xf778ccd4 "-logdir /usr/local/google/home/bruening/work/build/build_drmemory/logs ",
buf=0xffa1ae08 "\250\256\241\377i\r^\367P\257h ", <incomplete sequence \315>) at /home/bruening/drmemory/git/src/common/utils.c:334
334 while (_s != '\0' && isspace(_s))

0xf6ea10d4 <+36>: mov -0x58(%ecx),%edx
0xf6ea10da <+42>: mov %gs:(%edx),%edx
=> 0xf6ea10dd <+45>: mov (%edx),%edx

edx 0x0 0

in fact I can repro this crash in any client calling isspace, including
bbcount running hello,world, here's the diff:

diff --git a/api/samples/bbcount.c b/api/samples/bbcount.c
index 4c41040..0e324e5 100644
--- a/api/samples/bbcount.c
+++ b/api/samples/bbcount.c
@@ -40,6 +40,7 @@

#include <stddef.h> /* for offsetof */
#include "dr_api.h"
+#include <ctype.h>

#ifdef WINDOWS

define DISPLAY_STRING(msg) dr_messagebox(msg)

@@ -86,6 +87,8 @@ dr_init(client_id_t id)
if (dr_is_notify_on())
dr_fprintf(STDERR, "Client bbcount is running\n");
#endif

• if (!isspace('a'))//NOCHECKIN

•    dr_fprintf(STDERR, "a is not a space\n");
  

  }

  static void

Original issue: http://code.google.com/p/dynamorio/issues/detail?id=558

[derekbruening]

From zhao...@google.com on October 12, 2011 10:34:23

This issue was closed by revision r1038 .

Status: Fixed

[derekbruening]

From timurrrr@google.com on October 12, 2011 11:10:55

Can you add a test like this to make sure we don't regress in the future? [and for the other privloader bugs too]