Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash on OS X? #297

Closed
malmaud opened this issue Sep 17, 2015 · 4 comments
Closed

Crash on OS X? #297

malmaud opened this issue Sep 17, 2015 · 4 comments

Comments

@malmaud
Copy link

malmaud commented Sep 17, 2015

My program is sporadically crashing with

* thread #1: tid = 0x9bb299, 0x000000030fe16c48 libmbedcrypto.0.dylib`entropy_gather_internal + 127, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x000000030fe16c48 libmbedcrypto.0.dylib`entropy_gather_internal + 127

I am not sure yet if somehow the Julia wrapper is causing this or if it is a genuine upstream bug. I don't have a minimal reproducible example yet, but I'm working on it. I thought in the meanwhile I'd open the issue in case someone has any insights.

@mpg
Copy link
Contributor

mpg commented Sep 18, 2015

Can you (install GNU binutils if needed and) show me the output of gobjdump -d library/libmbedcrypto.dylib | grep -A42 'entropy_gather_internal>:'? I'd like to see what happens at entropy_gather_internal + 127. Also, when you say crashing, can you be a bit more specific: segfault, other sign of memory corruption?

FWIW, we regularly run our tests on OS X (including all tests with ASan and most of them with Valgrind's memcheck) and never got a similar issue so far. Of course it might be that the circumstances that trigger the issue never happen in our tests.

@malmaud
Copy link
Author

malmaud commented Sep 21, 2015

It is a segfault. Here's the binutils output:

/usr/local/lib> gobjdump -d libmbedcrypto.dylib | grep -A42 'entropy_gather_internal>:'
00000000000167cc <_entropy_gather_internal>:
167cc: 55 push %rbp
167cd: 48 89 e5 mov %rsp,%rbp
167d0: 41 57 push %r15
167d2: 41 56 push %r14
167d4: 41 55 push %r13
167d6: 41 54 push %r12
167d8: 53 push %rbx
167d9: 48 81 ec 98 00 00 00 sub $0x98,%rsp
167e0: 49 89 fd mov %rdi,%r13
167e3: 48 8b 05 16 d8 01 00 mov 0x1d816(%rip),%rax # 34000 <_xtea_test_ct+0x5950>
167ea: 48 8b 00 mov (%rax),%rax
167ed: 48 89 45 d0 mov %rax,-0x30(%rbp)
167f1: 41 8b 8d d8 00 00 00 mov 0xd8(%r13),%ecx
167f8: b8 c0 ff ff ff mov $0xffffffc0,%eax
167fd: 85 c9 test %ecx,%ecx
167ff: 0f 84 90 00 00 00 je 16895 <_entropy_gather_internal+0xc9>
16805: b8 c3 ff ff ff mov $0xffffffc3,%eax
1680a: 0f 8e 85 00 00 00 jle 16895 <_entropy_gather_internal+0xc9>
16810: 49 8d 9d 00 01 00 00 lea 0x100(%r13),%rbx
16817: 45 31 e4 xor %r12d,%r12d
1681a: 4c 8d b5 50 ff ff ff lea -0xb0(%rbp),%r14
16821: 45 31 ff xor %r15d,%r15d
16824: 8b 03 mov (%rbx),%eax
16826: 83 f8 01 cmp $0x1,%eax
16829: 44 0f 44 f8 cmove %eax,%r15d
1682d: 48 c7 85 48 ff ff ff movq $0x0,-0xb8(%rbp)
16834: 00 00 00 00
16838: 48 8b 7b e8 mov -0x18(%rbx),%rdi
1683c: ba 80 00 00 00 mov $0x80,%edx
16841: 4c 89 f6 mov %r14,%rsi
16844: 48 8d 8d 48 ff ff ff lea -0xb8(%rbp),%rcx
1684b: ff 53 e0 callq *-0x20(%rbx)
1684e: 85 c0 test %eax,%eax
16850: 75 43 jne 16895 <_entropy_gather_internal+0xc9>
16852: 48 8b 8d 48 ff ff ff mov -0xb8(%rbp),%rcx
16859: 48 85 c9 test %rcx,%rcx
1685c: 74 1a je 16878 <_entropy_gather_internal+0xac>
1685e: 41 0f b6 f4 movzbl %r12b,%esi
16862: 4c 89 ef mov %r13,%rdi
16865: 4c 89 f2 mov %r14,%rdx
16868: e8 c7 fe ff ff callq 16734 <_entropy_update>
1686d: 48 8b 85 48 ff ff ff mov -0xb8(%rbp),%rax

@malmaud
Copy link
Author

malmaud commented Sep 22, 2015

Turns out it was an idiosyncratic problem on my end. Thanks for your help.

@malmaud malmaud closed this as completed Sep 22, 2015
@mpg
Copy link
Contributor

mpg commented Sep 22, 2015

Glad the problem is resolved. Thanks for keeping us updated.

gilles-peskine-arm added a commit to gilles-peskine-arm/mbedtls that referenced this issue Oct 11, 2019
* Mbed-TLS#272: Insert doxygen comments on old algorithms so they appear in PSA documentation
* Mbed-TLS#285: SE driver: make persistent data work
* Mbed-TLS#279: Include IANA reference in the definition of ECC curves and DH groups
* Mbed-TLS#287: DRBG documentation improvements
* Mbed-TLS#297: Fix int overflow in mbedtls_asn1_get_int (Credit to OSS-Fuzz)
Patater pushed a commit to Patater/mbedtls that referenced this issue Feb 10, 2020
…undefined_shift

Fix int overflow in mbedtls_asn1_get_int
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants