Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Integer overflow in stack walker when processing minidump. #422

Closed
5225225 opened this issue Feb 2, 2022 · 4 comments · Fixed by #424
Closed

Integer overflow in stack walker when processing minidump. #422

5225225 opened this issue Feb 2, 2022 · 4 comments · Fixed by #424

Comments

@5225225
Copy link
Contributor

5225225 commented Feb 2, 2022 •
edited
Loading

Apologies for the very poorly minimised test case, just making a note of this now so I don't forget.

The bug is in the stack walker, but I found this when fuzzing minidump_processor.

thread 'test_stack_walk_overflow' panicked at 'attempt to add with overflow', /home/jess/src/rust-minidump/minidump-processor/src/stackwalker/x86.rs:165:21
it's like 300 lines long, i hid it here 
#[test]
fn test_stack_walk_overflow() {
    let symbols = [
        116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48,
        45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116,
    ];

    let dump = [
        80, 77, 68, 77, 0, 0, 167, 147, 0, 0, 0, 62, 0, 0, 0, 0, 0, 167, 147, 0, 0, 7, 0, 0, 0, 0,
        1, 22, 249, 1, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 1, 0, 115, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 39,
        0, 80, 77, 0, 0, 0, 0, 0, 0, 0, 0, 0, 95, 128, 0, 0, 0, 0, 0, 255, 255, 255, 249, 0, 0, 7,
        27, 0, 0, 0, 1, 0, 0, 18, 0, 0, 0, 0, 255, 255, 255, 254, 0, 0, 0, 0, 0, 0, 0, 0, 54, 0, 0,
        0, 80, 3, 186, 74, 74, 74, 74, 74, 74, 74, 74, 74, 4, 255, 255, 0, 0, 0, 0, 0, 255, 0, 33,
        0, 11, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
        255, 255, 255, 255, 255, 255, 255, 3, 1, 0, 0, 0, 0, 0, 0, 127, 0, 0, 0, 255, 255, 255,
        255, 255, 255, 255, 92, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 56, 0, 0, 0, 37, 80, 77, 68, 77, 88,
        120, 255, 238, 39, 0, 251, 0, 162, 162, 162, 0, 0, 109, 109, 109, 0, 0, 0, 0, 0, 0, 0, 1,
        80, 77, 68, 77, 37, 0, 167, 147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 9, 0, 2, 147, 1, 0, 0,
        0, 0, 0, 0, 32, 80, 0, 67, 3, 0, 1, 0, 145, 5, 0, 0, 0, 0, 0, 0, 46, 0, 0, 85, 0, 0, 0, 0,
        7, 1, 0, 0, 255, 251, 0, 1, 101, 0, 0, 0, 0, 7, 32, 32, 32, 32, 32, 32, 54, 45, 57, 32, 77,
        68, 77, 80, 147, 167, 97, 0, 43, 0, 0, 0, 0, 0, 0, 0, 147, 167, 245, 245, 10, 10, 32, 32,
        32, 32, 0, 0, 0, 0, 0, 0, 0, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32, 245, 10, 10, 4, 0, 0,
        0, 0, 90, 0, 1, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 80, 77, 68, 77, 0, 0, 167, 147, 0, 0, 0,
        62, 0, 0, 0, 0, 0, 167, 147, 0, 0, 7, 0, 0, 0, 2, 0, 24, 0, 0, 90, 0, 9, 253, 0, 0, 7, 0,
        0, 0, 1, 0, 0, 0, 0, 10, 0, 0, 0, 3, 0, 0, 0, 255, 255, 255, 255, 0, 187, 1, 80, 77, 68,
        77, 37, 0, 167, 147, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
        255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 4, 255, 251, 0, 0, 46, 0, 0, 0, 0, 0, 0, 0, 137, 0, 0, 0, 76, 68, 77,
        80, 0, 0, 0, 0, 0, 77, 68, 46, 6, 0, 0, 0, 0, 0, 1, 0, 82, 0, 0, 0, 0, 1, 0, 0, 0, 239, 1,
        0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 168, 1, 0, 0, 0, 0, 0, 1, 138, 0, 0, 0, 32, 0, 0, 0,
        255, 80, 77, 68, 77, 0, 0, 167, 147, 0, 0, 0, 62, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 100,
        0, 1, 22, 249, 0, 0, 0, 0, 0, 0, 0, 7, 0, 0, 0, 1, 0, 10, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0,
        255, 255, 255, 255, 0, 255, 0, 155, 64, 0, 0, 3, 39, 0, 80, 77, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        4, 167, 147, 0, 0, 46, 0, 0, 0, 0, 0, 0, 0, 137, 0, 0, 9, 0, 0, 0, 103, 71, 0, 0, 0, 0, 77,
        68, 46, 6, 0, 0, 0, 0, 0, 1, 0, 0, 0, 3, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0,
        0, 0, 0, 0, 88, 254, 0, 0, 0, 0, 0, 1, 138, 0, 0, 32, 0, 0, 0, 0, 255, 255, 255, 0, 0, 0,
        0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88, 120, 255,
        238, 39, 0, 0, 0, 162, 162, 162, 0, 0, 109, 109, 109, 0, 0, 0, 0, 0, 0, 0, 1, 80, 77, 68,
        77, 37, 0, 167, 147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 0, 0, 0, 147, 0, 3, 0, 0, 0, 0, 7,
        0, 0, 3, 67, 80, 10, 10, 32, 32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10,
        10, 10, 10, 10, 10, 10, 10, 10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1, 0, 0,
        0, 0, 0, 0, 8, 45, 10, 10, 10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105,
        108, 101, 115, 92, 109, 105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97,
        245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77,
        80, 115, 116, 117, 147, 64, 0, 0, 3, 0, 0, 80, 77, 68, 77, 0, 0, 0, 7, 0, 0, 0, 0, 12, 0,
        4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 28, 0, 0, 0, 0, 0, 0, 64, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 208, 0, 0, 9, 45, 49, 32, 0, 0, 0,
        43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32,
        49, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 112,
        32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 0, 10, 10, 10, 10, 10, 45, 10, 10, 10,
        10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32,
        0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 45, 10, 46, 10, 11, 10,
        10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0, 0, 0, 8, 45, 10, 10, 10, 10, 10, 10, 21, 10, 114,
        111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109, 105, 99, 114, 111, 115, 111,
        102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32,
        48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117, 147, 64, 0, 0, 3, 0, 0, 80, 77, 68,
        77, 0, 0, 0, 7, 0, 0, 0, 0, 12, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 28, 0,
        0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 208, 0, 0,
        9, 63, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88,
        120, 255, 238, 39, 0, 0, 0, 100, 162, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        168, 1, 0, 0, 0, 0, 0, 1, 138, 0, 0, 0, 0, 83, 64, 41, 0, 0, 255, 0, 0, 128, 0, 0, 0, 0, 4,
        0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0,
        162, 162, 162, 0, 0, 109, 109, 109, 0, 0, 0, 0, 0, 0, 0, 1, 80, 77, 68, 77, 37, 0, 167,
        147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 0, 0, 0, 147, 0, 3, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 3, 246, 255, 253, 115, 111, 10, 0, 32, 118, 105, 115, 117, 97, 108, 32, 115,
        116, 117, 100, 105, 111, 32, 57, 92, 118, 99, 92, 112, 108, 97, 116, 102, 111, 114, 109,
        115, 100, 107, 92, 105, 110, 99, 108, 117, 100, 101, 92, 119, 105, 110, 118, 101, 114, 46,
        104, 13, 10, 70, 73, 76, 69, 32, 49, 57, 32, 99, 58, 92, 32, 32, 32, 32, 32, 32, 32, 32,
        49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10, 10, 32, 32, 32,
        32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32,
        32, 32, 49, 45, 49, 112, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 0, 10, 10,
        10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32,
        32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0, 0, 0, 8, 45, 10, 10,
        10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109,
        105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32,
        32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117,
        147, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109, 105, 99, 114,
        111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32, 32, 32, 32, 32,
        32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117, 147, 0, 0, 0, 0, 0,
        0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 0, 10,
        10, 10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 32,
        32, 32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241,
        241, 241, 241, 241, 241, 241, 241, 241, 241, 142, 241, 241, 241, 241, 241, 241, 241, 241,
        241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241,
        241, 76, 69, 32, 49, 57, 32, 99, 32, 32, 32, 49, 45, 49, 32, 245, 10, 10, 32, 32, 32, 32,
        32, 32, 32, 32, 32, 48, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32,
        32, 49, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 45,
        10, 46, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 0, 91, 7, 35, 0, 0, 0,
        0, 0, 127, 10, 45, 10, 46, 10, 10, 10, 10, 237, 245, 245, 245, 48, 10, 32, 32, 32, 32, 32,
        32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10,
        10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 8, 0, 134, 134, 242, 168, 134, 166,
        134, 134, 185, 126, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 1, 105, 0, 0, 0, 1, 138, 0, 0, 0, 0, 83,
        64, 41, 0, 0, 255, 0, 0, 128, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37,
        80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0, 162, 162, 162, 0, 0, 109, 109, 109, 0, 0,
        0, 0, 0, 0, 0, 1, 80, 77, 68, 77, 37, 0, 167, 147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 0, 0,
        0, 147, 0, 3, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 246, 255, 253, 115, 111, 10, 0,
        32, 118, 105, 115, 117, 97, 108, 32, 115, 116, 117, 100, 105, 111, 32, 57, 92, 118, 99, 92,
        112, 108, 97, 116, 102, 111, 114, 109, 115, 100, 107, 92, 105, 110, 99, 108, 117, 100, 101,
        92, 119, 105, 110, 118, 101, 114, 46, 104, 13, 10, 70, 73, 32, 99, 58, 92, 32, 32, 32, 32,
        32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10,
        10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32,
        32, 32, 32, 32, 32, 32, 49, 45, 49, 112, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        10, 0, 10, 10, 10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32,
        32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        10, 10, 10, 10, 10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0, 0, 0,
        8, 45, 10, 10, 10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101,
        115, 92, 109, 105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245,
        10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115,
        116, 117, 147, 64, 0, 0, 3, 0, 0, 80, 77, 68, 77, 0, 0, 0, 7, 0, 0, 0, 0, 12, 0, 4, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 28, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 208, 0, 0, 9, 63, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3,
        0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0, 100, 162, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 168, 1, 0, 0, 0, 0, 0, 1, 138, 0, 0, 0, 0, 83,
        64, 41, 0, 0, 255, 0, 0, 128, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37,
        80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0, 162, 162, 162, 0, 0, 109, 109, 109, 0, 0,
        0, 0, 0, 0, 0, 1, 80, 77, 68, 77, 37, 0, 167, 147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 0, 0,
        0, 147, 0, 3, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 246, 255, 253, 115, 111, 10, 0,
        32, 118, 105, 115, 117, 97, 108, 32, 115, 116, 117, 100, 105, 111, 32, 57, 92, 118, 99, 92,
        112, 108, 97, 116, 102, 111, 114, 109, 115, 100, 107, 92, 105, 110, 99, 108, 117, 100, 101,
        92, 119, 105, 110, 118, 101, 114, 46, 104, 13, 10, 70, 73, 76, 69, 32, 49, 57, 32, 99, 58,
        92, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41,
        65, 138, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 49, 32, 245,
        10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 112, 32, 0, 0, 0, 10, 10, 10, 10,
        10, 10, 10, 10, 10, 10, 0, 10, 10, 10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245,
        245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10,
        10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1,
        0, 0, 0, 0, 0, 0, 8, 45, 10, 10, 10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11,
        102, 105, 108, 101, 115, 92, 109, 105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115,
        117, 97, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108,
        32, 77, 80, 115, 116, 117, 147, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115,
        92, 109, 105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10,
        10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116,
        117, 147, 107, 92, 105, 110, 99, 108, 117, 100, 101, 92, 119, 105, 110, 118, 101, 114, 46,
        104, 13, 10, 70, 73, 76, 69, 32, 49, 57, 32, 99, 58, 92, 32, 32, 32, 32, 32, 32, 32, 32,
        49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10, 10, 32, 32, 32,
        32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32,
        32, 32, 49, 45, 49, 112, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 0, 10, 10,
        10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32,
        32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0, 0, 0, 8, 45, 10, 10,
        10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109,
        105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32,
        32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117,
        147, 64, 0, 0, 3, 0, 0, 80, 77, 68, 77, 0, 0, 0, 7, 0, 0, 0, 0, 12, 0, 4, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 28, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 6, 0, 0, 0, 208, 0, 0, 9, 63, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52,
        0, 0, 0, 37, 80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0, 100, 162, 0, 0, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 168, 1, 0, 0, 0, 0, 0, 1, 138, 0, 0, 0, 0, 83, 64, 41, 0, 0,
        255, 0, 0, 128, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77,
        88, 120, 255, 238, 39, 0, 0, 0, 162, 162, 162, 0, 0, 109, 109, 109, 0, 0, 0, 0, 0, 0, 0, 1,
        80, 77, 68, 77, 37, 0, 167, 147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 0, 0, 0, 147, 0, 3, 0,
        0, 0, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 246, 255, 253, 115, 111, 10, 0, 32, 118, 105,
        115, 117, 97, 108, 32, 115, 116, 117, 100, 105, 111, 32, 57, 92, 118, 99, 92, 112, 108, 97,
        116, 102, 111, 114, 109, 115, 100, 107, 92, 105, 110, 99, 108, 117, 100, 101, 92, 119, 105,
        110, 118, 101, 114, 46, 104, 13, 10, 70, 73, 76, 69, 32, 49, 57, 32, 99, 58, 92, 32, 32,
        32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32,
        245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 49, 32, 245, 10, 10, 32,
        32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 112, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10,
        10, 10, 10, 0, 10, 10, 10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10,
        32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10,
        10, 10, 10, 10, 10, 10, 10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0,
        0, 0, 8, 45, 10, 10, 10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108,
        101, 115, 92, 109, 105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245,
        245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80,
        115, 116, 117, 147, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109,
        105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32,
        32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117,
        147, 0, 0, 0, 0, 0, 0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
        32, 32, 32, 0, 10, 10, 10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10,
        32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10,
        10, 10, 10, 10, 10, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241,
        241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 142, 241, 241, 241, 241,
        241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241, 241,
        241, 241, 241, 241, 241, 76, 69, 32, 49, 57, 32, 99, 32, 32, 32, 49, 45, 49, 32, 245, 10,
        10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32,
        32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        10, 10, 10, 10, 45, 10, 46, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 0,
        91, 7, 35, 0, 0, 0, 0, 0, 127, 10, 45, 10, 46, 10, 10, 10, 10, 237, 245, 245, 245, 48, 10,
        32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41,
        65, 138, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 8, 0, 134,
        134, 242, 168, 134, 166, 134, 134, 185, 126, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 1, 105, 0, 0, 0,
        1, 138, 0, 0, 0, 0, 83, 64, 41, 0, 0, 255, 0, 0, 128, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0,
        0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0, 162, 162, 162, 0, 0,
        109, 109, 109, 0, 0, 0, 0, 0, 0, 0, 1, 80, 77, 68, 77, 37, 0, 167, 147, 0, 0, 0, 7, 0, 0,
        0, 117, 0, 0, 0, 0, 0, 0, 147, 0, 3, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 246, 255,
        253, 115, 111, 10, 0, 32, 118, 105, 115, 117, 97, 108, 32, 115, 116, 117, 100, 105, 111,
        32, 57, 92, 118, 99, 92, 112, 108, 97, 116, 102, 111, 114, 109, 115, 100, 107, 92, 105,
        110, 99, 108, 117, 100, 101, 92, 119, 105, 110, 118, 101, 114, 46, 104, 13, 10, 70, 73, 76,
        69, 32, 49, 57, 32, 99, 58, 92, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 0, 0, 0,
        43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32,
        49, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 49, 45, 49, 112,
        32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 0, 10, 10, 10, 10, 10, 45, 10, 10, 10,
        10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 49, 32,
        0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 45, 10, 46, 10, 11, 10,
        10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0, 0, 0, 8, 45, 10, 10, 10, 10, 10, 10, 21, 10, 114,
        111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109, 105, 99, 114, 111, 115, 111,
        102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32,
        48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117, 147, 64, 0, 0, 3, 0, 0, 80, 77, 68,
        77, 0, 0, 0, 7, 0, 0, 0, 0, 12, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 28, 0,
        0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 208, 0, 0,
        9, 63, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88,
        120, 255, 238, 39, 0, 0, 0, 100, 162, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        168, 1, 0, 0, 0, 0, 0, 1, 138, 0, 0, 0, 0, 83, 64, 41, 0, 0, 255, 0, 0, 128, 0, 0, 0, 0, 4,
        0, 0, 0, 0, 0, 3, 0, 0, 0, 52, 0, 0, 0, 37, 80, 77, 68, 77, 88, 120, 255, 238, 39, 0, 0, 0,
        162, 162, 162, 0, 0, 109, 109, 109, 0, 0, 0, 0, 0, 0, 0, 1, 80, 77, 68, 77, 37, 0, 167,
        147, 0, 0, 0, 7, 0, 0, 0, 117, 0, 0, 0, 0, 0, 0, 147, 0, 3, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0,
        0, 0, 0, 0, 3, 246, 255, 253, 115, 111, 10, 0, 32, 118, 105, 115, 117, 97, 108, 32, 115,
        116, 117, 100, 105, 111, 32, 57, 92, 118, 99, 92, 112, 108, 97, 116, 102, 111, 114, 109,
        115, 100, 107, 92, 105, 110, 99, 108, 117, 100, 101, 92, 119, 105, 110, 118, 101, 114, 46,
        104, 13, 10, 70, 73, 76, 69, 32, 49, 57, 32, 99, 58, 92, 32, 32, 32, 32, 32, 32, 32, 32,
        49, 45, 49, 32, 0, 0, 0, 43, 0, 0, 0, 0, 0, 0, 0, 41, 65, 138, 32, 245, 10, 10, 32, 32, 32,
        32, 32, 32, 32, 32, 32, 49, 45, 49, 32, 49, 32, 245, 10, 10, 32, 32, 32, 32, 32, 32, 32,
        32, 32, 49, 45, 49, 112, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 0, 10, 10,
        10, 10, 10, 45, 10, 10, 10, 10, 10, 10, 237, 245, 245, 245, 10, 10, 32, 32, 32, 32, 32, 32,
        32, 32, 32, 48, 45, 49, 32, 0, 0, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
        10, 45, 10, 46, 10, 11, 10, 10, 237, 10, 10, 10, 10, 1, 0, 0, 0, 0, 0, 0, 8, 45, 10, 10,
        10, 10, 10, 10, 21, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109,
        105, 99, 114, 111, 115, 111, 102, 116, 32, 118, 105, 115, 117, 97, 245, 245, 10, 10, 32,
        32, 32, 32, 32, 32, 32, 32, 32, 48, 45, 57, 32, 77, 68, 108, 32, 77, 80, 115, 116, 117,
        147, 10, 114, 111, 103, 124, 97, 1, 11, 102, 105, 108, 101, 115, 92, 109, 105, 99, 114,
        111, 115, 111, 102,
    ];

    struct StaticSymbolSupplier {
        file: Vec<u8>,
    }

    impl minidump_processor::SymbolSupplier for StaticSymbolSupplier {
        fn locate_symbols(
            &self,
            _module: &dyn minidump::Module,
        ) -> Result<minidump_processor::SymbolFile, minidump_processor::SymbolError> {
            minidump_processor::SymbolFile::from_bytes(&self.file)
        }
    }

    let dump = minidump::Minidump::read(&dump[..]).unwrap();
    let supplier = StaticSymbolSupplier {
        file: symbols.to_vec(),
    };
    let provider = minidump_processor::Symbolizer::new(supplier);
    let _ = minidump_processor::process_minidump(&dump, &provider);
}
@Gankra
Copy link
Collaborator

Gankra commented Feb 2, 2022

...huh. It's surprising you're seeing overflow there given I have an explicit guard on the previous line for preventing an overflow in this code.

...

forehead slap

caller_sp = last_bp + POINTER_WIDTH * 2 is operating in 32-bit

@Gankra
Copy link
Collaborator

Gankra commented Feb 2, 2022

fixing it...

Gankra added a commit to Gankra/rust-minidump that referenced this issue Feb 2, 2022
@Gankra
Harden 32-bit unwinders against mixed-width calculations.
7655217 
Fixes rust-minidump#422

This issue is kinda nonsense, but in a 'hey good job fuzzer for finding this wild input' kinda way?
Basically rust-minidump likes doing things in 64-bit to reuse code and keep things uniform, but this
creates a fun situation where you can define *impossible* memory ranges for a 32-bit system and have
calculated pointers successfully access that memory because the operations are happening in 64-bit.

In-and-of-itself this is not a problem, but it does mean that things can go Bad when you have some
of the operations happening in the platform's native width, causing some operations to succeed and
others to overflow. In particular, this would allow you to load some memory that is beyond u32::MAX
(which normally would be a strong proof that the entire memory range is a valid pointer) and then
update the 32-bit frame pointer to that address, causing an overflow.

The fix is to simply do the overflow check that *already existed for exactly this code* in 32-bit
instead of 64-bit. I'm not sure if an actual minidump would have been able to trigger this bug,
since it's possible some earlier code would have freaked out at the memory range definitions.
But hey, the guards were wrong either way.
@Gankra Gankra mentioned this issue Feb 2, 2022
Merged
Gankra added a commit that referenced this issue Feb 2, 2022
@Gankra
Harden 32-bit unwinders against mixed-width calculations.
0e9ad09 
Fixes #422

This issue is kinda nonsense, but in a 'hey good job fuzzer for finding this wild input' kinda way?
Basically rust-minidump likes doing things in 64-bit to reuse code and keep things uniform, but this
creates a fun situation where you can define *impossible* memory ranges for a 32-bit system and have
calculated pointers successfully access that memory because the operations are happening in 64-bit.

In-and-of-itself this is not a problem, but it does mean that things can go Bad when you have some
of the operations happening in the platform's native width, causing some operations to succeed and
others to overflow. In particular, this would allow you to load some memory that is beyond u32::MAX
(which normally would be a strong proof that the entire memory range is a valid pointer) and then
update the 32-bit frame pointer to that address, causing an overflow.

The fix is to simply do the overflow check that *already existed for exactly this code* in 32-bit
instead of 64-bit. I'm not sure if an actual minidump would have been able to trigger this bug,
since it's possible some earlier code would have freaked out at the memory range definitions.
But hey, the guards were wrong either way.
@luser
Copy link
Collaborator

luser commented Feb 3, 2022

Would it make things better to fiddle the APIs to make the shared unwinder machinery generic over the CPU word size? I'd have to go read through the code again to see if that's feasible.

@Gankra
Copy link
Collaborator

Gankra commented Feb 4, 2022

In my memory there's a certain amount of dyn going on that makes associated types a non-starter, but also it's a lot of work even if you can get it to work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Harden 32-bit unwinders against mixed-width calculations. Gankra/rust-minidump
3 participants
@luser @Gankra @5225225