<div dir="ltr"><div>Hi,</div><div><br></div><div>strace will behave in an undefined way (crash under current glibc), if the fd argument to FD_ISSET() macro is >= FD_SETSIZE.</div><div><br></div><div>I guess, the code needs to check (in decode_select) that nfd (first select's arg) is < FD_SETSIZE.</div>
<div><br></div><div> $ cat a.c </div><div>#include <sys/select.h></div><div>int main(void) {</div><div> fd_set set;</div><div> select(1200, &set, 0, 0, 0);</div><div> return 0;</div><div>}</div><div>$ make a</div>
<div>cc a.c -o a</div><div>$ gdb ./strace</div><div><div>(gdb) r ~/a</div></div><div><div>*** buffer overflow detected ***: /home/jagger/Downloads/strace-4.8/strace terminated</div><div>======= Backtrace: =========</div>
<div>/lib/x86_64-linux-gnu/libc.so.6(+0x741cf)[0x7ffff7a881cf]</div><div>/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7ffff7b1fb2c]</div><div>/lib/x86_64-linux-gnu/libc.so.6(+0x10a9f0)[0x7ffff7b1e9f0]</div><div>
/lib/x86_64-linux-gnu/libc.so.6(+0x10ba77)[0x7ffff7b1fa77]</div><div>/home/jagger/Downloads/strace-4.8/strace[0x403ad2]</div><div>/home/jagger/Downloads/strace-4.8/strace[0x415d68]</div><div>/home/jagger/Downloads/strace-4.8/strace[0x414170]</div>
<div>/home/jagger/Downloads/strace-4.8/strace[0x40235f]</div><div>/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7ffff7a35ec5]</div><div>/home/jagger/Downloads/strace-4.8/strace[0x402434]</div><div>======= Memory map: ========</div>
<div>00400000-00469000 r-xp 00000000 fc:00 1192039 /home/jagger/Downloads/strace-4.8/strace</div><div>00668000-00669000 r--p 00068000 fc:00 1192039 /home/jagger/Downloads/strace-4.8/strace</div>
<div>00669000-0066a000 rw-p 00069000 fc:00 1192039 /home/jagger/Downloads/strace-4.8/strace</div><div>0066a000-0068c000 rw-p 00000000 00:00 0 [heap]</div><div>7ffff77fe000-7ffff7814000 r-xp 00000000 fc:00 926244 /lib/x86_64-linux-gnu/libgcc_s.so.1</div>
<div>7ffff7814000-7ffff7a13000 ---p 00016000 fc:00 926244 /lib/x86_64-linux-gnu/libgcc_s.so.1</div><div>7ffff7a13000-7ffff7a14000 rw-p 00015000 fc:00 926244 /lib/x86_64-linux-gnu/libgcc_s.so.1</div>
<div>7ffff7a14000-7ffff7bd0000 r-xp 00000000 fc:00 917872 /lib/x86_64-linux-gnu/<a href="http://libc-2.19.so">libc-2.19.so</a></div><div>7ffff7bd0000-7ffff7dcf000 ---p 001bc000 fc:00 917872 /lib/x86_64-linux-gnu/<a href="http://libc-2.19.so">libc-2.19.so</a></div>
<div>7ffff7dcf000-7ffff7dd3000 r--p 001bb000 fc:00 917872 /lib/x86_64-linux-gnu/<a href="http://libc-2.19.so">libc-2.19.so</a></div><div>7ffff7dd3000-7ffff7dd5000 rw-p 001bf000 fc:00 917872 /lib/x86_64-linux-gnu/<a href="http://libc-2.19.so">libc-2.19.so</a></div>
<div>7ffff7dd5000-7ffff7dda000 rw-p 00000000 00:00 0 </div><div>7ffff7dda000-7ffff7dfd000 r-xp 00000000 fc:00 917871 /lib/x86_64-linux-gnu/<a href="http://ld-2.19.so">ld-2.19.so</a></div><div>7ffff7fd3000-7ffff7fd6000 rw-p 00000000 00:00 0 </div>
<div>7ffff7ff7000-7ffff7ffa000 rw-p 00000000 00:00 0 </div><div>7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]</div><div>7ffff7ffc000-7ffff7ffd000 r--p 00022000 fc:00 917871 /lib/x86_64-linux-gnu/<a href="http://ld-2.19.so">ld-2.19.so</a></div>
<div>7ffff7ffd000-7ffff7ffe000 rw-p 00023000 fc:00 917871 /lib/x86_64-linux-gnu/<a href="http://ld-2.19.so">ld-2.19.so</a></div><div>7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 </div><div>7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]</div>
<div>ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]</div><div>select(1200, [1 2 3 5 9 10 11 14 16 18 19 20 21 25 26 28 29 30 31 65 67 69 72 73 86 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 195 196 199 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 259 261 263 264 270 273 277 279 280 281 282 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 326 327 330 332 335 336 337 338 339 340 341 342 343 344 345 346 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 387 390 391 392 397 398 399 400 401 402 403 404 405 406 407 408 409 410 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 512 576 578 579 581 583 584 586 598 773 774 776 778 790 838 842 854 903 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942</div>
<div>Program received signal SIGABRT, Aborted.</div></div><div><br></div><div><div>(gdb) bt</div><div>#0 0x00007ffff7a4af79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56</div><div>#1 0x00007ffff7a4e388 in __GI_abort () at abort.c:89</div>
<div>#2 0x00007ffff7a881d4 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff7b94415 "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:175</div><div>#3 0x00007ffff7b1fb2c in __GI___fortify_fail (msg=<optimized out>, msg@entry=0x7ffff7b943ac "buffer overflow detected") at fortify_fail.c:37</div>
<div>#4 0x00007ffff7b1e9f0 in __GI___chk_fail () at chk_fail.c:28</div><div>#5 0x00007ffff7b1fa77 in __fdelt_chk (d=d@entry=1024) at fdelt_chk.c:25</div><div>#6 0x0000000000403ac1 in decode_select (tcp=0x66b030, args=0x66b048, bitness=BITNESS_CURRENT) at desc.c:519</div>
<div>#7 0x0000000000415d48 in trace_syscall_entering (tcp=0x66b030) at syscall.c:2039</div><div>#8 trace_syscall (tcp=tcp@entry=0x66b030) at syscall.c:2712</div><div>#9 0x0000000000414150 in trace () at strace.c:2281</div>
<div>#10 0x000000000040235f in main (argc=<optimized out>, argv=<optimized out>) at strace.c:2311</div><div><br></div><div>(gdb) up 6</div><div>#6 0x0000000000403ac1 in decode_select (tcp=0x66b030, args=0x66b048, bitness=BITNESS_CURRENT) at desc.c:519</div>
<div>519<span class="" style="white-space:pre"> </span>if (FD_ISSET(j, fds)) {</div></div><div><br></div>-- <br>Robert Święcki
</div>