bitwiseworks / libc

LIBC Next (kLIBC fork)
9 stars 4 forks source link

logstrict: Crash when logging with no groups provided #112

Closed dmik closed 3 years ago

dmik commented 3 years ago

If the logger instance does not use log groups (i.e. pGroups in __libc_LogInit[Ex] is NULL which is perfectly legal), an attempt to write out anything into the log file will result in a truncated log header:

Opened log at 2021-08-19 17:16:13.48 (00d15a79 ms since boot)
Process ID: 0xbbb (3003) Parent PID: 0xbba (3002) Type: 2
Exe hmte  : 0x50a (D:\CODING\LIBCX\MASTER-BUILD\STAGE\BIN\LIBCX-STATS.EXE)
Arg 0     : libcx-stats
Cur dir   : C:\var\log\app
CRT Module: LIBCN0 hmod=0xb82 (C:\USR\LIB\LIBCN0.DLL)
__libc_logInit: addr 0x1e07f8a9 iObj=0 offObj=0x4f8a9
Origin        : libcx
Enabled groups:

and a crash in LIBC:

Filename: C:\USR\LIB\LIBCN0.DLL (08/16/2021 23:44:02 1,225,146)
 Address:  005B:1E08008E (0001:0005008E)
 Cause:    Attempted to read from 00000004
           (not a valid address)

______________________________________________________________________

 Failing Instruction
______________________________________________________________________

 1E080080  MOV  EAX, [EDI+0x4]          (8b47 04)
 1E080083  MOV  [ESP], EAX              (890424)
 1E080086  CALL 0x1ffc5e28              (e8 9d5df401)
 1E08008B  MOV  EAX, [EDI+0x8]          (8b47 08)
 1E08008E >MOV  ECX, [EAX+0x4]          (8b48 04)
 1E080091  TEST ECX, ECX                (85c9)
 1E080093  JZ   0x1e080668              (0f84 cf050000)
 1E080099  MOV  DWORD [EBP-0x25c], 0x0  (c785 a4fdffff 00000000)

______________________________________________________________________

 Registers
______________________________________________________________________

 EAX : 00000000   EBX  : 0012F3F0   ECX : 0012F638   EDX  : 000001CB
 ESI : 20034614   EDI  : 20034600
 ESP : 0012F3A0   EBP  : 0012F878   EIP : 1E08008E   EFLG : 00010293
 CS  : 005B       CSLIM: FFFFFFFF   SS  : 0053       SSLIM: FFFFFFFF

 EAX : not a valid address
 EBX : read/write memory on this thread's stack
 ECX : read/write memory on this thread's stack
 EDX : not a valid address
 ESI : read/write memory allocated by LIBCN0
 EDI : read/write memory allocated by LIBCN0

...

  EBP     Address    Module     Obj:Offset    Nearest Public Symbol
--------  ---------  --------  -------------  -----------------------
Trap  ->  1E08008E   LIBCN0    0001:0005008E  logstrict.c#742 ___libc_LogSNPrintf + B3D 0001:0004F551 (logstrict.obj)

0012F878  1E080959   LIBCN0    0001:00050959  logstrict.c#442 ___libc_LogInitEx + E1 0001:00050878 (logstrict.obj)

The crash happens because when LIBC writes enabled log groups to the header, it doesn't check if pGroups is NULL before accessing it and hence the crash.

This is a regression of a9eb83452cb2b814b77cdac82c985f46a1188fb3.

The problem is rather critical as it completely breaks LIBCx assertion logging and will even result into shadowing a proper EXCEPTQ report (related to the LIBCx assertion) with LIBC own (shown above), see https://github.com/bitwiseworks/libcx/issues/98. Needs an urgent fix.