Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add regression test for find_fake_fast command #1147

Merged
merged 2 commits into from
Sep 16, 2022
Merged

Add regression test for find_fake_fast command #1147

merged 2 commits into from
Sep 16, 2022

Conversation

CptGibbon
Copy link
Contributor

The test program creates a fake chunk size field in its .data section with a set NON_MAIN_ARENA flag.
The Python test runs the find_fake_fast command on an address succeeding the fake chunk.
A gdb.MemoryError indicates regression - issue #1142

The test program creates a fake chunk size field in its .data section
with a set NON_MAIN_ARENA flag. The Python test runs the find_fake_fast
command on an address succeeding the fake chunk. A gdb.MemoryError
indicates regression - issue #1142
@codecov-commenter
Copy link

codecov-commenter commented Sep 15, 2022

Codecov Report

Merging #1147 (a7a7fe5) into dev (88c6101) will increase coverage by 0.35%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##              dev    #1147      +/-   ##
==========================================
+ Coverage   50.22%   50.57%   +0.35%     
==========================================
  Files         173      173              
  Lines       19866    19874       +8     
  Branches     1814     1814              
==========================================
+ Hits         9978    10052      +74     
+ Misses       9551     9466      -85     
- Partials      337      356      +19     
Impacted Files Coverage Δ
tests/test_heap.py 95.13% <100.00%> (+0.17%) ⬆️
pwndbg/lib/memory.py 85.52% <0.00%> (+1.31%) ⬆️
pwndbg/heap/ptmalloc.py 38.44% <0.00%> (+1.46%) ⬆️
pwndbg/color/context.py 55.35% <0.00%> (+1.78%) ⬆️
pwndbg/color/message.py 92.30% <0.00%> (+5.12%) ⬆️
pwndbg/commands/heap.py 60.98% <0.00%> (+6.31%) ⬆️
pwndbg/color/memory.py 82.97% <0.00%> (+6.38%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@disconnect3d
Copy link
Member

Confirmed that this test indeed fails with the reverted fix commit:

dc@jhtc:/opt/pwndbg$ git revert 8dae554
[dev 84264c8] Revert "Add gdb.MemoryError check to get_heap() (#1145)"
 1 file changed, 2 insertions(+), 9 deletions(-)
dc@jhtc:/opt/pwndbg$ ./tests.sh test_find_fake_fast_command
ZIGPATH set to /opt/pwndbg/.zig
[+] Cleaning stuff
[+] Building heap_bugs.out
/opt/pwndbg/.zig/zig cc \
-target native-native-gnu.2.33 \
-Wl,-rpath=/opt/pwndbg/tests/binaries/glibcs/2.33:\
/opt/pwndbg/tests/binaries/glibcs/2.33/math:\
/opt/pwndbg/tests/binaries/glibcs/2.33/elf:\
/opt/pwndbg/tests/binaries/glibcs/2.33/dlfcn:\
/opt/pwndbg/tests/binaries/glibcs/2.33/nss:\
/opt/pwndbg/tests/binaries/glibcs/2.33/nis:\
/opt/pwndbg/tests/binaries/glibcs/2.33/rt:\
/opt/pwndbg/tests/binaries/glibcs/2.33/resolv:\
/opt/pwndbg/tests/binaries/glibcs/2.33/crypt:\
/opt/pwndbg/tests/binaries/glibcs/2.33/nptl_db:\
/opt/pwndbg/tests/binaries/glibcs/2.33/nptl:\
-Wl,--dynamic-linker=/opt/pwndbg/tests/binaries/glibcs/2.33/ld-linux-x86-64.so.2 \
-Wall -DDEBUG=1 -ggdb -O0 -gdwarf-4 -o heap_bugs.out heap_bugs.c
[+] Building 'heap_bins.out'
[+] Building 'telescope_binary.out'
[+] Building 'heap_find_fake_fast.out'
[+] Building 'reference-binary.out'
[+] Building 'vmmap.out'
[+] Building heap_vis.out
gcc -g -O0 -Wno-nonnull -o heap_vis.out heap_vis.c -pthread -lpthread
[+] Building 'emulate_disasm.o'
[+] Linking 'emulate_disasm.out'
[+] Building 'memory.o'
[+] Linking 'memory.out'
[+] Building 'emulate_disasm_loop.o'
[+] Linking 'emulate_disasm_loop.out'
[+] Building 'gosample.x86'
[+] Building 'gosample.x64'
rm emulate_disasm_loop.o emulate_disasm.o memory.o
pwndbg: loaded 203 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Launching pytest with args: ['/opt/pwndbg/tests/test_heap.py::test_find_fake_fast_command', '-vvv', '-s', '--showlocals', '--color=yes']
===================================================== test session starts =====================================================
platform linux -- Python 3.6.9, pytest-7.0.1, pluggy-0.13.1 -- /usr/bin/python
cachedir: .pytest_cache
rootdir: /opt/pwndbg
plugins: cov-2.10.0
collecting ... collected 1 item

tests/test_heap.py::test_find_fake_fast_command
Program stopped.
0x00007ffff7dd4090 in _start () from /lib64/ld-linux-x86-64.so.2
Breakpoint 1 at 0x55555555464e: file heap_find_fake_fast.c, line 14.

Breakpoint 1, break_here () at heap_find_fake_fast.c:14
14	void break_here(void) {}
FAKE CHUNKS
Traceback (most recent call last):
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 145, in __call__
    return self.function(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 238, in _OnlyWhenRunning
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 287, in _OnlyWithResolvedHeapSyms
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 263, in _OnlyWhenHeapIsInitialized
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/heap.py", line 318, in malloc_chunk
    arena = allocator.get_arena_for_chunk(cursor)
  File "/opt/pwndbg/pwndbg/heap/ptmalloc.py", line 310, in get_arena_for_chunk
    r = self.get_arena(arena_addr=self.get_heap(addr)["ar_ptr"])
  File "/opt/pwndbg/pwndbg/heap/ptmalloc.py", line 654, in get_arena
    if pwndbg.vmmap.find(arena_addr) is None
  File "/opt/pwndbg/pwndbg/lib/memoize.py", line 50, in __call__
    value = self.func(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/vmmap.py", line 100, in find
    address = int(address)
gdb.MemoryError: Cannot access memory at address 0x555554000000

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 145, in __call__
    return self.function(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 238, in _OnlyWhenRunning
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 287, in _OnlyWithResolvedHeapSyms
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 263, in _OnlyWhenHeapIsInitialized
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/heap.py", line 607, in find_fake_fast
    malloc_chunk(start + offset - psize, fake=True)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 150, in __call__
    pwndbg.exception.handle(self.function.__name__)
  File "/opt/pwndbg/pwndbg/exception.py", line 59, in handle
    raise e
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 145, in __call__
    return self.function(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 238, in _OnlyWhenRunning
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 287, in _OnlyWithResolvedHeapSyms
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 263, in _OnlyWhenHeapIsInitialized
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/heap.py", line 318, in malloc_chunk
    arena = allocator.get_arena_for_chunk(cursor)
  File "/opt/pwndbg/pwndbg/heap/ptmalloc.py", line 310, in get_arena_for_chunk
    r = self.get_arena(arena_addr=self.get_heap(addr)["ar_ptr"])
  File "/opt/pwndbg/pwndbg/heap/ptmalloc.py", line 654, in get_arena
    if pwndbg.vmmap.find(arena_addr) is None
  File "/opt/pwndbg/pwndbg/lib/memoize.py", line 50, in __call__
    value = self.func(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/vmmap.py", line 100, in find
    address = int(address)
gdb.MemoryError: Cannot access memory at address 0x555554000000

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 102, in invoke
    return self(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 150, in __call__
    pwndbg.exception.handle(self.function.__name__)
  File "/opt/pwndbg/pwndbg/exception.py", line 59, in handle
    raise e
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 145, in __call__
    return self.function(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 238, in _OnlyWhenRunning
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 287, in _OnlyWithResolvedHeapSyms
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 263, in _OnlyWhenHeapIsInitialized
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/heap.py", line 607, in find_fake_fast
    malloc_chunk(start + offset - psize, fake=True)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 150, in __call__
    pwndbg.exception.handle(self.function.__name__)
  File "/opt/pwndbg/pwndbg/exception.py", line 59, in handle
    raise e
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 145, in __call__
    return self.function(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 238, in _OnlyWhenRunning
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 287, in _OnlyWithResolvedHeapSyms
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/__init__.py", line 263, in _OnlyWhenHeapIsInitialized
    return function(*a, **kw)
  File "/opt/pwndbg/pwndbg/commands/heap.py", line 318, in malloc_chunk
    arena = allocator.get_arena_for_chunk(cursor)
  File "/opt/pwndbg/pwndbg/heap/ptmalloc.py", line 310, in get_arena_for_chunk
    r = self.get_arena(arena_addr=self.get_heap(addr)["ar_ptr"])
  File "/opt/pwndbg/pwndbg/heap/ptmalloc.py", line 654, in get_arena
    if pwndbg.vmmap.find(arena_addr) is None
  File "/opt/pwndbg/pwndbg/lib/memoize.py", line 50, in __call__
    value = self.func(*args, **kwargs)
  File "/opt/pwndbg/pwndbg/vmmap.py", line 100, in find
    address = int(address)
gdb.MemoryError: Cannot access memory at address 0x555554000000
FAILED

========================================================== FAILURES ===========================================================
_________________________________________________ test_find_fake_fast_command _________________________________________________

start_binary = <function start_binary.<locals>._start_binary at 0x7faae9707950>

    def test_find_fake_fast_command(start_binary):
        start_binary(HEAP_FIND_FAKE_FAST)
        gdb.execute("break break_here")
        gdb.execute("continue")

        # Ensure memory at fake_chunk's heap_info struct isn't mapped.
        unmapped_heap_info = pwndbg.heap.ptmalloc.heap_for_ptr(pwndbg.symbol.address("fake_chunk"))
        assert pwndbg.gdblib.memory.peek(unmapped_heap_info) is None

        # A gdb.MemoryError raised here indicates a regression from PR #1145
>       gdb.execute("find_fake_fast (void*)&fake_chunk+0x70")
E       gdb.error: Error occurred in Python: Cannot access memory at address 0x555554000000

start_binary = <function start_binary.<locals>._start_binary at 0x7faae9707950>
unmapped_heap_info = 93824969867264

tests/test_heap.py:417: error
=================================================== short test summary info ===================================================
FAILED tests/test_heap.py::test_find_fake_fast_command - gdb.error: Error occurred in Python: Cannot access memory at addres...
====================================================== 1 failed in 0.37s ======================================================
--------------------------------------------------------------------------------
If you want to debug tests locally, modify pytests_launcher.py and add --pdb to its args
--------------------------------------------------------------------------------

*********************************
********* TESTS SUMMARY *********
*********************************
Tests passed or skipped: 0
Tests failed: 1
dc@jhtc:/opt/pwndbg$ git ll
* 84264c8 - (HEAD -> dev) Revert "Add gdb.MemoryError check to get_heap() (#1145)" (14 seconds ago) <disconnect3d>
* 88c6101 - (origin/dev, origin/HEAD) fix distance command (#1146) (33 hours ago) <Disconnect3d>
* 8dae554 - Add gdb.MemoryError check to get_heap() (#1145) (34 hours ago) <CptGibbon>
* dea9a69 - add color for modified registers (#1127) (35 hours ago) <syheliel>

@disconnect3d disconnect3d merged commit 636db8b into pwndbg:dev Sep 16, 2022
@CptGibbon CptGibbon deleted the find_fake_fast-regression-test branch September 16, 2022 03:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants