rizinorg / rizin

UNIX-like reverse engineering framework and command-line toolset.
https://rizin.re
GNU Lesser General Public License v3.0
2.56k stars 343 forks source link

test_autocmplt segfaults in Rizin 0.3.0 when built via Gentoo ebuild #1797

Closed ajakk closed 2 years ago

ajakk commented 2 years ago

Work environment

Building Rizin 0.3.0 and running the unit test suite via a Gentoo ebuild (in attached tarball)

Expected behavior

test_autocmplt shouldn't segfault

Actual behavior

test_autocmplt segfaults (from the meson test log):

86/90 autocmplt                      FAIL            2.28s   killed by signal 11 SIGSEGV
14:38:31 MALLOC_PERTURB_=111 /var/tmp/portage/dev-util/rizin-0.3.0/work/rizin-0.3.0-build/test/unit/test_autocmplt
----------------------------------- output -----------------------------------
stderr:
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: Neither hash nor gnu_hash exist. Falling back to heuristics for deducing the number of dynamic symbols...
WARNING: rz_type_db_get_bitsize: assertion 'typedb && type' failed (line 763)
WARNING: rz_type_db_get_bitsize: assertion 'typedb && type' failed (line 763)
WARNING: rz_type_db_get_bitsize: assertion 'typedb && type' failed (line 763)
Core was generated by `/var/tmp/portage/dev-util/rizin-0.3.0/work/rizin-0.3.0-build/test/unit/test_aut'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f7a086898d9 in ts_tree_root_node (self=0x0) at lib/src/tree.c:36
36      TSNode ts_tree_root_node(const TSTree *self) {
(gdb) bt
#0  0x00007f7a086898d9 in ts_tree_root_node (self=0x0) at lib/src/tree.c:36
#1  0x00007f7a09cc8602 in rz_core_autocomplete_rzshell (core=0x55f8a8329fa0, buf=0x7f7a0a295028 <rz_line_instance+104>,
    prompt_type=RZ_LINE_PROMPT_DEFAULT) at ../rizin-v0.3.0/librz/core/cautocmpl.c:689
#2  0x000055f8a774a4da in test_autocmplt_global () at ../rizin-v0.3.0/test/unit/test_autocmplt.c:428
#3  0x000055f8a774adce in all_tests () at ../rizin-v0.3.0/test/unit/test_autocmplt.c:451
#4  0x000055f8a774ae20 in main (argc=1, argv=0x7fff8a7b3ee8) at ../rizin-v0.3.0/test/unit/test_autocmplt.c:455
(gdb)

The same happens when using bundled tree-sitter,

rizin.tar.gz

ret2libc commented 2 years ago

Does it happen if you compile rizin without the ebuild with the usual instructions meson build && meson compile -C build?

ajakk commented 2 years ago

Yes.

ret2libc commented 2 years ago

Can you provide the instructions to reproduce on a clean docker container?

thestr4ng3r commented 2 years ago

Very strange: 20211005_13h40m25s_grim

This is the v0.3.0 tag and:

florian@florian-gentoo ~/dev/rizin/test $ uname -a
Linux florian-gentoo 5.10.52-gentoo #1 SMP PREEMPT Sat Jul 24 01:34:11 -00 2021 aarch64 GNU/Linux
thestr4ng3r commented 2 years ago

Actually, it is not weird at all. Looks like this also expects an installed prefix. By compiling with a random prefix and not installing, this is reproducible everywhere. cc @XVilka because this seems type-related.

thestr4ng3r commented 2 years ago

Looks like it only works with install by chance because the cmd parser is initialized here:

Bildschirmfoto 2021-10-05 um 14 46 01

Without install core->rcmd->language is still null when the autocompletion is triggered.

thestr4ng3r commented 2 years ago

Anyway, @ajakk this fixes the issue for the ebuild:

--- /home/florian/Downloads/rizin/rizin-0.3.0.ebuild    2021-10-04 16:41:05.000000000 +0200
+++ rizin-0.3.0.ebuild  2021-10-05 15:31:03.172000067 +0200
@@ -89,6 +89,7 @@
    ln -sf "${BUILD_DIR}/librz/analysis/d" "${T}/usr/share/${PN}/${PV}/types" || die
    ln -sf "${BUILD_DIR}/librz/syscall/d" "${T}/usr/share/${PN}/${PV}/syscall" || die
    ln -sf "${BUILD_DIR}/librz/asm/d" "${T}/usr/share/${PN}/${PV}/opcodes" || die
+   ln -sf "${BUILD_DIR}/librz/flag/d" "${T}/usr/share/${PN}/${PV}/flag" || die
    export RZ_PREFIX="${T}/usr"

    meson_src_test

I would still consider this an issue for us though.

DMaroo commented 2 years ago
diff --git a/test/unit/test_autocmplt.c b/test/unit/test_autocmplt.c
index 18070d318..f6686200d 100644
--- a/test/unit/test_autocmplt.c
+++ b/test/unit/test_autocmplt.c
@@ -401,7 +401,7 @@ static bool test_autocmplt_seek(void) {
 }

 static bool test_autocmplt_global(void) {
-       RzCore *core = rz_core_new();
+       RzCore *core = fake_core_new2();
        mu_assert_notnull(core, "core should not be null");

        RzAnalysisVarGlobal *glob1 = rz_analysis_var_global_new("GINT", 0x1337); // untyped global

@thestr4ng3r Could you apply this patch, and try building from your Gentoo setup and test it? I think this can fix it.

ajakk commented 2 years ago

That patch seems to fix it for me!

DMaroo commented 2 years ago

@ajakk Just to confirm before I make changes, the following patch fixes the build issues on Gentoo, right?

diff --git a/test/unit/test_autocmplt.c b/test/unit/test_autocmplt.c
index 18070d318..f6686200d 100644
--- a/test/unit/test_autocmplt.c
+++ b/test/unit/test_autocmplt.c
@@ -401,7 +401,7 @@ static bool test_autocmplt_seek(void) {
 }

 static bool test_autocmplt_global(void) {
-       RzCore *core = rz_core_new();
+       RzCore *core = fake_core_new2();
        mu_assert_notnull(core, "core should not be null");

        RzAnalysisVarGlobal *glob1 = rz_analysis_var_global_new("GINT", 0x1337); // untyped global
thestr4ng3r commented 2 years ago

@thestr4ng3r Could you apply this patch, and try building from your Gentoo setup and test it? I think this can fix it.

It does, but it also hides the issue that the cmd parser is not being initialized by default, but only after some command has been run. cc @ret2libc