[Bug libbacktrace/81983] libbacktrace calls bsearch with NULL base

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81983

Tom de Vries  changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution|--- |FIXED
   Target Milestone|--- |9.0

--- Comment #8 from Tom de Vries  ---
Patch committed, marking resolved-fixed.

[Bug libbacktrace/81983] libbacktrace calls bsearch with NULL base

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81983

--- Comment #7 from Tom de Vries  ---
Author: vries
Date: Tue Feb 12 14:00:59 2019
New Revision: 268796

URL: https://gcc.gnu.org/viewcvs?rev=268796&root=gcc&view=rev
Log:
[libbacktrace] Handle bsearch with NULL base in dwarf_lookup_pc

The call to bsearch in dwarf_lookup_pc can have NULL as base argument when
the nmemb argument is 0.  The base argument is required to be pointing to the
initial member of an array of nmemb objects.  It is not specified what
constitutes a valid pointer to an array of 0 objects, but glibc declares base
with attribute non-null, so the NULL will trigger a sanitizer runtime error.

Fix this by only calling bsearch if nmemb != 0.

2019-02-12  Tom de Vries  

PR libbacktrace/81983
* dwarf.c (dwarf_lookup_pc): Don't call bsearch if nmemb == 0.

Modified:
trunk/libbacktrace/ChangeLog
trunk/libbacktrace/dwarf.c

[Bug libbacktrace/81983] libbacktrace calls bsearch with NULL base

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81983

Tom de Vries  changed:

   What|Removed |Added

   Keywords||patch
 Status|WAITING |NEW

--- Comment #6 from Tom de Vries  ---
https://gcc.gnu.org/ml/gcc-patches/2019-02/msg00860.html

[Bug libbacktrace/81983] libbacktrace calls bsearch with NULL base

[ian at airs dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81983

--- Comment #5 from Ian Lance Taylor  ---
I would be inclined to just skip the bsearch when the count is zero.

[Bug libbacktrace/81983] libbacktrace calls bsearch with NULL base

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81983

--- Comment #4 from Tom de Vries  ---
Ian, how do you want this fixed?

We could add a safe_bsearch:
...
diff --git a/libbacktrace/internal.h b/libbacktrace/internal.h
index 065b9535e8b..7d9aa5e88c5 100644
--- a/libbacktrace/internal.h
+++ b/libbacktrace/internal.h
@@ -317,4 +317,13 @@ extern int backtrace_uncompress_zdebug (struct
backtrace_state *,
unsigned char **uncompressed,
size_t *uncompressed_size);

+static inline void *
+safe_bsearch (const void *key, const void *base, size_t nel, size_t width,
+ int (*compar)(const void *, const void *))
+{
+  return (base == NULL
+ ? NULL
+ : bsearch (key, base, nel, width, compar));
+}
+
 #endif
...
and do a:
...
$ sed -i \
"s/bsearch (/safe_bsearch (/g" \
libbacktrace/*
...