ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

debuggerd_handler: don't use snprintf in handler.

Browse source 
snprintf isn't safe to call in the linker after initialization, because
it uses MB_CUR_MAX which is implemented via pthread_getspecific, which
uses TLS slots shared with libc. If the TLS slots are assigned in a
different order between libc.so and the linker, MB_CUR_MAX will
evaluate to an incorrect value, and lead to snprintf doing bad things.

Switch to __libc_format_buffer.

Bug: http://b/35367169
Test: debuggerd -b `pidof zygote`
Change-Id: I9d315cf63e5f3fd2f4545d6e3f707cdbe94ec606
This commit is contained in:
Josh Gao 2017-02-14 21:03:23 -08:00
parent af776fd518
commit 60515bf9f1
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
debuggerd/handler/debuggerd_handler.cpp
View file

@ -81,7 +81,7 @@ static void __noreturn __printflike(1, 2) fatal_errno(const char* fmt, ...) {
va_start(args, fmt);
char buf[4096];
vsnprintf(buf, sizeof(buf), fmt, args);
__libc_format_buffer_va_list(buf, sizeof(buf), fmt, args);
fatal("%s: %s", buf, strerror(err));
}
@ -256,8 +256,9 @@ static int debuggerd_dispatch_pseudothread(void* arg) {
char main_tid[10];
char pseudothread_tid[10];
snprintf(main_tid, sizeof(main_tid), "%d", thread_info->crashing_tid);
snprintf(pseudothread_tid, sizeof(pseudothread_tid), "%d", thread_info->pseudothread_tid);
__libc_format_buffer(main_tid, sizeof(main_tid), "%d", thread_info->crashing_tid);
__libc_format_buffer(pseudothread_tid, sizeof(pseudothread_tid), "%d", thread_info->pseudothread_tid);
execl(CRASH_DUMP_PATH, CRASH_DUMP_NAME, main_tid, pseudothread_tid, nullptr);
fatal_errno("exec failed");