Bug 564156 - the tcf-server will crash if symbol name returned NULL
Summary: the tcf-server will crash if symbol name returned NULL
Status: RESOLVED FIXED
Alias: None
Product: TCF
Classification: Tools
Component: Agent (show other bugs)
Version: unspecified   Edit
Hardware: All All
: P3 normal (vote)
Target Milestone: 1.7   Edit
Assignee: Project Inbox CLA
QA Contact: Eugene Tarassov CLA
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-06-10 03:54 EDT by wenyan xin CLA
Modified: 2021-06-25 16:23 EDT (History)
1 user (show)

See Also:


Attachments
binary file (159.25 KB, application/octet-stream)
2020-06-10 03:57 EDT, wenyan xin CLA
eugene: iplog-
Details

Note You need to log in before you can comment on or make changes to this bug.
Description wenyan xin CLA 2020-06-10 03:54:24 EDT
in get_symbol_name() function, in agent/tcf/services/symbols_elf.c file,

since the sym_info.name is NULL which returned by the unpack_elf_symbol_info( ..., &sym_info) function at 3330 line, that causes the tcf-server crashed at 3332 line.

I try to fix it as following,

tcf.agent$ git diff agent/tcf/services/symbols_elf.c
diff --git a/agent/tcf/services/symbols_elf.c b/agent/tcf/services/symbols_elf.c
index 07049f7..be4f3b4 100644
--- a/agent/tcf/services/symbols_elf.c
+++ b/agent/tcf/services/symbols_elf.c
@@ -3328,7 +3328,8 @@ int get_symbol_name(const Symbol * sym, char ** name) {
         if (sym->dimension == 0) {
             size_t i;
             unpack_elf_symbol_info(sym->tbl, sym->index, &sym_info);
-            for (i = 0;; i++) {
+            for (i = 0; i < sym->tbl->sym_count; i++) {
+                if (!sym_info.name) break;
                 if (sym_info.name[i] == 0) {
                     *name = sym_info.name;
                     break;
Comment 1 wenyan xin CLA 2020-06-10 03:55:33 EDT
the test source code:

/* includes */

#include <stdio.h>
#include <stdlib.h>

int main (
    int	   argc,	/* number of arguments */
    char * argv[]	/* array of arguments */
    ) {
    int nbRtp = atoi (argv[1]);
    printf("nbRtp = %d\n", nbRtp);

    return 0;
}
Comment 2 wenyan xin CLA 2020-06-10 03:57:46 EDT
Created attachment 283210 [details]
binary file
Comment 3 wenyan xin CLA 2020-06-10 04:01:03 EDT
in my test, if I step return as following stack trace, this issue will happen.

iRv64_rtp_nodbg (Step Over)	
	_Stoulx() 0x00000000040014dc	
	main() at rtp.c:10 0x00000000040003ec	
	_start() 0x00000000040001a0
Comment 4 Eugene Tarassov CLA 2020-06-10 20:50:59 EDT
Fixed.
Thanks!