symbolize.cc's FindSymbol faulty read loop causes failing SAFE_ASSERT
Reported by
bjo...@opera.com,
Dec 8 2016
|
||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.75 Safari/537.36 Steps to reproduce the problem: Tricky problem to reproduce! It can occur during dumping stack traces, e.g. after a failing DCHECK, which will cause the DCHECK-message to not get printed. For example, I think this may have happened here: https://bugs.chromium.org/p/chromium/issues/detail?id=648460&can=1&q=FindSymbol&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified# Notice the __GI_abort caused by google::FindSymbol. Explaining what is happening in 'What went wrong?'. What is the expected behavior? Don't read more symbols than there is in the section. What went wrong? In summary, here's what happens: * FindSymbol reads symbols from some object file. * It does this at a rate of (32 or 64) symbols per read, reading until it has read all the symbols from a section. * It doesn't account for the fact that there may not be an even multiple of (32 or 64) symbols in the section. * If there are for example 65 symbols in the section, it will try to read (31 or 63) symbols past the end of the section. * This will either: - Fail a SAFE_ASSERT because the end of the file has been reached and FindSymbol expected a multiple of sizeof(ElfW(Sym)) bytes to be read. - Interpret garbage data as symbols, which could have other ramifications but probably passes quietly. Did this work before? No Does this work in other browsers? Yes Chrome version: 57.0.2945.0 Channel: stable OS Version: Flash Version: Shockwave Flash 23.0 r0 I will submit a fix for this.
,
Dec 12 2016
,
Dec 12 2016
,
Dec 12 2016
,
Dec 14 2016
,
Jan 13 2017
,
Jan 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3dae0a2d7da309159a301e40a592692ec8431a38 commit 3dae0a2d7da309159a301e40a592692ec8431a38 Author: bjornr <bjornr@opera.com> Date: Fri Jan 13 16:29:54 2017 Fixed google::FindSymbol reading past end of a section The symbol reading logic of google::FindSymbol was reading symbols in blocks of N, not accounting for that a section might not have a multiple of N symbols in it. This makes it read in blocks of N or the number of symbols remaining, whichever is smallest. BUG= 672481 Review-Url: https://codereview.chromium.org/2566623003 Cr-Commit-Position: refs/heads/master@{#443571} [modify] https://crrev.com/3dae0a2d7da309159a301e40a592692ec8431a38/base/third_party/symbolize/symbolize.cc
,
Sep 29 2017
,
Jul 5
|
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by phistuck@chromium.org
, Dec 8 2016