New issue
Advanced search Search tips

Issue 672481 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Jul 5
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

symbolize.cc's FindSymbol faulty read loop causes failing SAFE_ASSERT

Reported by bjo...@opera.com, Dec 8 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.75 Safari/537.36

Steps to reproduce the problem:
Tricky problem to reproduce!
It can occur during dumping stack traces, e.g. after a failing DCHECK, which will cause the DCHECK-message to not get printed. For example, I think this may have happened here:
https://bugs.chromium.org/p/chromium/issues/detail?id=648460&can=1&q=FindSymbol&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified#
Notice the __GI_abort caused by google::FindSymbol.
Explaining what is happening in 'What went wrong?'.

What is the expected behavior?
Don't read more symbols than there is in the section.

What went wrong?
In summary, here's what happens:
 * FindSymbol reads symbols from some object file.
 * It does this at a rate of (32 or 64) symbols per read, reading until it has read all the symbols from a section.
 * It doesn't account for the fact that there may not be an even multiple of (32 or 64) symbols in the section.
 * If there are for example 65 symbols in the section, it will try to read (31 or 63) symbols past the end of the section.
 * This will either:
    - Fail a SAFE_ASSERT because the end of the file has been reached and FindSymbol expected a multiple of sizeof(ElfW(Sym)) bytes to be read.
    - Interpret garbage data as symbols, which could have other ramifications but probably passes quietly.

Did this work before? No 

Does this work in other browsers? Yes

Chrome version: 57.0.2945.0  Channel: stable
OS Version: 
Flash Version: Shockwave Flash 23.0 r0

I will submit a fix for this.
 
Labels: -Hotlist-Interop
Labels: prestable-55.0.2883.75
Labels: -prestable-55.0.2883.75
Labels: M-57
Labels: TE-NeedsTriageHelp

Comment 6 by joha...@opera.com, Jan 13 2017

Cc: joha...@opera.com
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3dae0a2d7da309159a301e40a592692ec8431a38

commit 3dae0a2d7da309159a301e40a592692ec8431a38
Author: bjornr <bjornr@opera.com>
Date: Fri Jan 13 16:29:54 2017

Fixed google::FindSymbol reading past end of a section

The symbol reading logic of google::FindSymbol was reading symbols in
blocks of N, not accounting for that a section might not have a multiple
of N symbols in it.

This makes it read in blocks of N or the number of symbols remaining,
whichever is smallest.

BUG= 672481 

Review-Url: https://codereview.chromium.org/2566623003
Cr-Commit-Position: refs/heads/master@{#443571}

[modify] https://crrev.com/3dae0a2d7da309159a301e40a592692ec8431a38/base/third_party/symbolize/symbolize.cc

Comment 8 by joha...@opera.com, Sep 29 2017

Cc: -joha...@opera.com joha...@vewd.com
Status: Fixed (was: Unconfirmed)

Sign in to add a comment