ASSERT syscall_windows.c:617: PORT_MESSAGE size much larger than expected

[derekbruening]

From bruen...@google.com on February 24, 2011 15:51:31

beyond issue #308 on xp64 vm this test hits the title assert:

[----------] 2 tests from JSONReaderTest
[ RUN ] JSONReaderTest.Reading

I think it's that test anyway based on callstacks: the assert text prints out much sooner but perhaps just stderr vs stdout

:::Dr.Memory::: ASSERT FAILURE (thread 135600): ..\src\drmemory\syscall_windows.c:617: size <= 2*(sizeof(PORT_MESSAGE) + PORT_MAXIMUM_MESSAGE_LENGTH) (PORT_MESSAGE size much larger than expected)

0:001> ~0s; kn

ChildEBP RetAddr

WARNING: Frame IP not in any known module. Following frames may be wrong.
00 0012c9a0 004387c6 0x2060536f
01 0012c9c0 004e728e base_unittests!std::_Iterator_base::_Adopt+0x76 [c:\program files (x86)\microsoft visual studio 9.0\vc\include\xutility @ 177]
02 0012c9d0 004e6fde base_unittests!std::_String_const_iterator<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::_String_const_iterator<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >+0x8e [c:\program files (x86)\microsoft visual studio 9.0\vc\include\xstring @ 78]
03 0012c9e4 004e6e73 base_unittests!std::_String_iterator<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::_String_iterator<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >+0x1e [c:\program files (x86)\microsoft visual studio 9.0\vc\include\xstring @ 335]
04 0012c9f8 004e6c1a base_unittests!std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::begin+0x23 [c:\program files (x86)\microsoft visual studio 9.0\vc\include\xstring @ 1502]
05 0012ca38 004e688e base_unittests!std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::insert+0x7a [c:\program files (x86)\microsoft visual studio 9.0\vc\include\xstring @ 1221]
06 0012ca74 0073bb2d base_unittests!std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::push_back+0x4e [c:\program files (x86)\microsoft visual studio 9.0\vc\include\xstring @ 1646]
07 0012ca88 006c63a3 base_unittests!base::WriteUnicodeCharacter+0x2d [c:\users\timurrrr\desktop\chromium\src\base\utf_string_conversion_utils.cc @ 96]
08 0012cab8 006c6058 base_unittests!`anonymous namespace'::ConvertUnicode<char,std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> > >+0x73 [c:\users\timurrrr\desktop\chromium\src\base\utf_string_conversions.cc @ 33]
09 0012cacc 006c60b3 base_unittests!UTF8ToWide+0x28 [c:\users\timurrrr\desktop\chromium\src\base\utf_string_conversions.cc @ 62]
0a 0012cb10 0072f6a0 base_unittests!UTF8ToWide+0x43 [c:\users\timurrrr\desktop\chromium\src\base\utf_string_conversions.cc @ 67]
0b 0012cba0 0072f4bb base_unittests!base::JSONReader::JsonToValue+0x90 [c:\users\timurrrr\desktop\chromium\src\base\json\json_reader.cc @ 137]
0c 0012cc20 0072f473 base_unittests!base::JSONReader::ReadAndReturnError+0x3b [c:\users\timurrrr\desktop\chromium\src\base\json\json_reader.cc @ 106]
0d 0012cc34 00640d7d base_unittests!base::JSONReader::Read+0x13 [c:\users\timurrrr\desktop\chromium\src\base\json\json_reader.cc @ 98]
0e 0012fcf4 00662338 base_unittests!base::JSONReaderTest_Reading_Test::TestBody+0xbccd [c:\users\timurrrr\desktop\chromium\src\base\json\json_reader_unittest.cc @ 424]
0f 0012fd44 00662ff3 base_unittests!testing::Test::Run+0x128 [c:\users\timurrrr\desktop\chromium\src\testing\gtest\src\gtest.cc @ 2060]
10 0012fdac 00663661 base_unittests!testing::internal::TestInfoImpl::Run+0x153 [c:\users\timurrrr\desktop\chromium\src\testing\gtest\src\gtest.cc @ 2308]
11 0012fdd8 006683cf base_unittests!testing::TestCase::Run+0xf1 [c:\users\timurrrr\desktop\chromium\src\testing\gtest\src\gtest.cc @ 2413]
12 0012fe14 00667216 base_unittests!testing::internal::UnitTestImpl::RunAllTests+0x27f [c:\users\timurrrr\desktop\chromium\src\testing\gtest\src\gtest.cc @ 4014]
13 0012fe58 00631e5e base_unittests!testing::UnitTest::Run+0xb6 [c:\users\timurrrr\desktop\chromium\src\testing\gtest\src\gtest.cc @ 3670]
0:001> kn

ChildEBP RetAddr

00 24b79370 7109dd5c ntdll!ZwRaiseHardError+0x12
01 24b793b4 71087a1b dynamorio!nt_messagebox+0x7c [e:\derek\dr\git\src\core\win32\ntdll.c @ 3253]
02 24b79cc4 10100a4c dynamorio!dr_messagebox+0x8b [e:\derek\dr\git\src\core\x86\instrument.c @ 3005]
03 24b79cd0 10100a76 drmemorylib!wait_for_user+0xc [e:\derek\drmemory\git\src\common\utils.c @ 72]
04 24b79cdc 1010ae88 drmemorylib!drmemory_abort+0x16 [e:\derek\drmemory\git\src\common\utils.c @ 95]
05 24b79d7c 1010c18d drmemorylib!handle_port_message_access+0x3a8 [e:\derek\drmemory\git\src\drmemory\syscall_windows.c @ 617]
06 24b79da0 100d8c98 drmemorylib!os_handle_post_syscall_arg_access+0x2d [e:\derek\drmemory\git\src\drmemory\syscall_windows.c @ 844]
07 24b79e48 100d71bb drmemorylib!process_post_syscall_reads_and_writes+0x958 [e:\derek\drmemory\git\src\drmemory\syscall.c @ 721]
08 24b79f34 71086b49 drmemorylib!event_post_syscall+0x25b [e:\derek\drmemory\git\src\drmemory\syscall.c @ 815]
09 24b79f68 71094e6a dynamorio!instrument_post_syscall+0x99 [e:\derek\dr\git\src\core\x86\instrument.c @ 1681]
0a 24b79f94 71035f15 dynamorio!post_system_call+0x76a [e:\derek\dr\git\src\core\win32\syscall.c @ 3662]
0b 24b79f9c 710368c5 dynamorio!handle_post_system_call+0x25 [e:\derek\dr\git\src\core\dispatch.c @ 1839]
0c 24b79fbc 71036972 dynamorio!dispatch_enter_dynamorio+0x3f5 [e:\derek\dr\git\src\core\dispatch.c @ 715]
0d 234110c0 002915d8 dynamorio!dispatch+0x12 [e:\derek\dr\git\src\core\dispatch.c @ 148]
WARNING: Frame IP not in any known module. Following frames may be wrong.
0e 00000000 00000000 0x2915d8
0:001> .frame 5
05 24b79d7c 1010c18d drmemorylib!handle_port_message_access+0x3a8 [e:\derek\drmemory\git\src\drmemory\syscall_windows.c @ 617]
0:001> dv
pre = 0
sysnum = 40
mc = 0x24b79e84
arg_num = 2
arg_info = 0x101a8cd4
start = 0x00310668 "???"
size = 0x300
check_type = 1
pm = struct _PORT_MESSAGE
0:001> dt -b pm
Local var @ 0x24b79d64 Type _PORT_MESSAGE
+0x000 u1 :
+0x000 s1 :
+0x000 DataLength : 5
+0x002 TotalLength : 768
+0x000 Length : 0x3000005
+0x004 u2 :
+0x000 s2 :
+0x000 Type : 16
+0x002 DataInfoOffset : 0
+0x000 ZeroInit : 0x10
+0x008 ClientId :
+0x000 UniqueProcess : 0x0000002c
+0x004 UniqueThread : 0x0000000c
+0x008 DoNotUseThisField : 2.5463949513322156e-313
+0x010 MessageId : 0x14
+0x014 u3 :
+0x000 ClientViewSize : 0
+0x000 CallbackId : 0
0:001> kb =35eff84 35efd20 24b81f00
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
035efd1c 7da3db78 000212c4 035eff74 00000000 0x24b81f00
035eff84 7da43414 035effac 7da43338 002915d8 RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x198
035eff8c 7da43338 002915d8 00000000 00000000 RPCRT4!RecvLotsaCallsWrapper+0xd
035effac 7da433fc 00266d78 035effec 7d4e0017 RPCRT4!BaseCachedThreadRoutine+0x9d
035effb8 7d4e0017 00283c30 00000000 00000000 RPCRT4!ThreadStartRoutine+0x1b
035effec 00000000 7da433e1 00283c30 00000000 kernel32!BaseThreadStart+0x34

in issue #35 I observed this same code on xpsp3 using 0x100, here on xp64 it
uses 0x200 (b/c wow64?):

RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x113:
7da3db33 bb00020000 mov ebx,0x200

RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x11a:
7da54d26 6a64 push 0x64
7da54d28 ff152401a37d call dword ptr [RPCRT4!_imp__Sleep (7da30124)]
7da54d2e e9058efeff jmp RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x122 (7da3db38)

RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x122:
7da3db38 8b0dec00ad7d mov ecx,[RPCRT4!gBufferCache (7dad00ec)]
7da3db3e 53 push ebx
7da3db3f e8aa8affff call RPCRT4!BCACHE::Allocate (7da365ee)

Original issue: http://code.google.com/p/drmemory/issues/detail?id=309

[derekbruening]

From timurrrr@google.com on May 24, 2011 12:42:54

http://www.zezula.net/en/prog/lpc.html -> [about an example of an app using LPC functions]
"If you are running 32-bit applications using LPC functions under 64-bit Windows, you will encounter various bad functionalty. As it turned out, the layer between 32-bit Ntdll.dll and 64-bit Ntdll.dll does not translate the layout of PORT_MESSAGE structure. As consequence, kernel API can't recognize format of the PORT_MESSAGE structure and usually returns STATUS_INVALID_PARAMETER (0xC000000D)."