Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4c88433 authored by Christopher Ferris's avatar Christopher Ferris
Browse files

Fix use of uninitialized memory. 

When creating an UnwindMapLocal fails in the Build() function call,
the destructor for UnwindMap is called. Unfortunately, the map_cursor_
member variable has not been initialized, so the call to destroy it
winds up operating on garbage data.

Part of this is a result of a bad class hierarchy, so this refactors
the classes slightly, and properly initializes the map_cursor_ member
variable in the base class.

Bug: 26931578
Change-Id: I885596bf65e4ef63559cee2c56cd41576d5ecc1b
parent 71862501

libbacktrace/UnwindMap.cpp

+9 −4
Original line number Diff line number Diff line
@@ -33,14 +33,18 @@ 
// of maps using the same map cursor.

//-------------------------------------------------------------------------

UnwindMap::UnwindMap(pid_t pid) : BacktraceMap(pid) {

  unw_map_cursor_clear(&map_cursor_);

}



UnwindMapRemote::UnwindMapRemote(pid_t pid) : UnwindMap(pid) {

}



UnwindMap::~UnwindMap() {

UnwindMapRemote::~UnwindMapRemote() {

  unw_map_cursor_destroy(&map_cursor_);

  unw_map_cursor_clear(&map_cursor_);

}



bool UnwindMap::GenerateMap() {

bool UnwindMapRemote::GenerateMap() {

  // Use the map_cursor information to construct the BacktraceMap data

  // rather than reparsing /proc/self/maps.

  unw_map_cursor_reset(&map_cursor_);
@@ -63,7 +67,7 @@ bool UnwindMap::GenerateMap() { 
  return true;

}



bool UnwindMap::Build() {

bool UnwindMapRemote::Build() {

  return (unw_map_cursor_create(&map_cursor_, pid_) == 0) && GenerateMap();

}
@@ -84,6 +88,7 @@ bool UnwindMapLocal::GenerateMap() { 
  for (int i = 0; i < 3; i++) {

    maps_.clear();



    // Save the map data retrieved so we can tell if it changes.

    unw_map_local_cursor_get(&map_cursor_);



    unw_map_t unw_map;
@@ -142,7 +147,7 @@ BacktraceMap* BacktraceMap::Create(pid_t pid, bool uncached) { 
  } else if (pid == getpid()) {

    map = new UnwindMapLocal();

  } else {

    map = new UnwindMap(pid);

    map = new UnwindMapRemote(pid);

  }

  if (!map->Build()) {

    delete map;

libbacktrace/UnwindMap.h

+15 −9
Original line number Diff line number Diff line
@@ -29,29 +29,35 @@ 
class UnwindMap : public BacktraceMap {

public:

  UnwindMap(pid_t pid);

  virtual ~UnwindMap();



  virtual bool Build();



  unw_map_cursor_t* GetMapCursor() { return &map_cursor_; }



protected:

  virtual bool GenerateMap();



  unw_map_cursor_t map_cursor_;

};



class UnwindMapRemote : public UnwindMap {

public:

  UnwindMapRemote(pid_t pid);

  virtual ~UnwindMapRemote();



  bool Build() override;



private:

  bool GenerateMap();

};



class UnwindMapLocal : public UnwindMap {

public:

  UnwindMapLocal();

  virtual ~UnwindMapLocal();



  virtual bool Build();

  bool Build() override;



  virtual void FillIn(uintptr_t addr, backtrace_map_t* map);

  void FillIn(uintptr_t addr, backtrace_map_t* map) override;



protected:

  virtual bool GenerateMap();

private:

  bool GenerateMap();



  bool map_created_;

};