lundi 2 août 2021

How to decide on stack corruption

The function serializeState is called from two different functions. The first call is always succ and the second one always gets the failure. <error: Cannot access memory at rbndress 0x6e656b6f5467>}, _M_string_length = 620059168, and so on.

If i consistently see the failure happening at the same place, is it still stack corruption ? or should I be seeing crashes at different places to classify as stack corruption. Which would be the best way to go about it. I tried gdb, valgrind. It hasn't shown me any info on what is happening. So am stuck unable to decide what to do next.

Someone in other threads has also recommended https://github.com/google/sanitizers/wiki/AddressSanitizer. i haven't tried it out yet. is it a good way to go ?

Please see gdb output snippet below.




Thread rbn 1 "foo" hit Breakpoint 1, rbn_trf::Serialize::serializeState (this=this@entry=0x8cae00 <RbnUtils::MySingleton<rbn_trf::rerecFactory>::GetInstance()::instance+64>, src=
    0x24eec7d8, dst=dst@entry=0x24f87bf0) at Serialize.cpp:499
499             {
(gdb) n
500                     dst->state = src->m_State;
(gdb) p src
$1 = (rbn_trf::State *) 0x24eec7d8
(gdb) p *src
$2 = {_vptr.State = 0x8b50a0 <vtable for rbn_trf::rerec+64>, m_Configuration = @0x24e82780, m_StateList = {_M_t = {
      _M_impl = {<std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, rbn_trf::State*> > >> = {<__gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, rbn_trf::State*> > >> = {<No data fields>}, <No data fields>}, <std::_Rb_tree_key_compare<std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >> = {
          _M_key_compare = {<std::binary_function<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool>> = {<No data fields>}, <No data fields>}}, <std::_Rb_tree_herbner> = {_M_herbner = {_M_color = std::_S_red, _M_parent = 0x24eec9f0, _M_left = 0x24eeca90,
            _M_right = 0x24eeca40}, _M_node_count = 3}, <No data fields>}}}, m_State = {static npos = 18446744073709551615,
    _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x24eec828 "Idle"}, _M_string_length = 4, {
      _M_local_buf = "Idle\000\000\000\000\260p\356$\000\000\000", _M_allocated_capacity = 1701602377}}, m_Token = {static npos = 18446744073709551615,
    _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x24eec848 "0"}, _M_string_length = 1, {
      _M_local_buf = "0", '\000' <repeats 14 times>, _M_allocated_capacity = 48}}, m_Error = {static npos = 18446744073709551615,
    _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x24eec868 ""}, _M_string_length = 0, {
      _M_local_buf = "\000eopoly\000\000\000\000\000\000\000\000", _M_allocated_capacity = 34177698065507584}}, m_DataFrom = 0, m_DataTo = 0}
(gdb) c
Continuing.

Thread rbn 1 "foo" hit Breakpoint 1, rbn_trf::Serialize::serializeState (this=this@entry=0x8cae00 <RbnUtils::MySingleton<rbn_trf::rerecFactory>::GetInstance()::instance+64>,
    src=src@entry=0x24f55990, dst=dst@entry=0x24f87e30) at Serialize.cpp:499
499             {
(gdb) n
500                     dst->state = src->m_State;
(gdb) p *src
$3 = {_vptr.State = 0x7f00000001, m_Configuration = @0x24f54f78, m_StateList = {_M_t = {
      _M_impl = {<std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, rbn_trf::State*> > >> = {<__gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, rbn_trf::State*> > >> = {<No data fields>}, <No data fields>}, <std::_Rb_tree_key_compare<std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >> = {
          _M_key_compare = {<std::binary_function<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool>> = {<No data fields>}, <No data fields>}}, <std::_Rb_tree_herbner> = {_M_herbner = {_M_color = (unknown: 620029280),
            _M_parent = 0x8b52f8 <vtable for tev::events::EventItem+16>, _M_left = 0x24f559c8, _M_right = 0xe}, _M_node_count = 7956000659384526162}, <No data fields>}}}, m_State = {
    static npos = 18446744073709551615, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
      _M_p = 0x6e656b6f5467 <error: Cannot access memory at rbndress 0x6e656b6f5467>}, _M_string_length = 620059168, {
      _M_local_buf = "\025\000\000\000\000\000\000\000\025\000\000\000\000\000\000", _M_allocated_capacity = 21}}, m_Token = {static npos = 18446744073709551615,
    _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x24f55a00 "\001"}, _M_string_length = 620059144, {
      _M_local_buf = "\001\000\000\000\000\000\000\000\060\000\000\000\000\000\000", _M_allocated_capacity = 1}}, m_Error = {static npos = 18446744073709551615,
    _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p = 0x24f55a20 "tt:rerecReference"}, _M_string_length = 33, {
      _M_local_buf = "tt:rerecRefe", _M_allocated_capacity = 8245918729561076852}}, m_DataFrom = 435459876210, m_DataTo = 65}
(gdb) n







Aucun commentaire:

Enregistrer un commentaire