redir issues

[paulfloyd]

First part, Darwin does not have a redirect for wcpncpy (see shared/vg_replace_strmem.c).

I tried adding VGO_darwin to the list of platforms but that still didn't work.

This looks like a problem with indirect functions.

Second part, some libc functions call end up calling "_chk" versions (e.g., strcpy_chk see here for the macro

https://github.com/apple-open-source/macos/blob/f60c49b581c54dfc3367b3ebc5b7904fd7d5db7b/xnu/osfmk/libsa/string.h#L940

). I'm not sure which compiler options cause __XNU_FORTIFY_SOURCE to be set. Should we also try to redirect these functions?

This is with MacOS X 10.13.

[LouisBrunner]

Hi @paulfloyd,

wcpncpy seems to be in libsystem_c.dylib, while VG_Z_LIBC_SONAME maps libsystem_malloc.dylib to on modern macOSes. I added that redir in #150, feel free to give it a try but my local testing seemed to show that it's properly redirected (even though I don't get the same stacktrace as the test itself).

Regarding the _chk functions, I am not sure. Is it possible those behaves slightly different from the non _chk functions? Those functions are also present inside libsystem_c.dylib by the way.
The usage of __xnu_member_size (which maps to __builtin_object_size / __builtin_dynamic_object_size) seems odd to be I guess the point is to be safer instead of being correct?

Do you have a use/test case that trigger a _chk?

[paulfloyd]

Not sure where I went wrong, I tried adding a Z-encoded libsystem_c.dylib redir for wcpncpy and it didn't work. Must have mistyped something. It's working now when I copied your change.

For the stacktrace, I just discovered that if a testcase C filename is the same as the C function that is being tested then the line numbers don't get replaced. That's in filter_memcheck, and I think that the intent is to preserve the testcase C filename occurrences in the callstack. I'll rename the wcpncpy testcase (and maybe a few others) to avoid this.

The _chk functions do behave differently. If they see an overlap when it is not allowed they will call abort().

Some functiions that call _chk versions are strncpy, strcpy, strncat, memccpy. There are probably quite a few more.

[paulfloyd]

I'm also trying to get memccpy to redirect. The function exists as

/usr/lib/system/libsystem_c.dylib
0000000000081e14 T ___memccpy_chk
U __platform_memccpy
I _memccpy (indirect for __platform_memccpy)

/usr/lib/system/libsystem_platform.dylib
0000000000004eb4 T __platform_memccpy

I've tried the two redirs in this diff

git diff
diff --git a/shared/vg_replace_strmem.c b/shared/vg_replace_strmem.c
index 6cc26d9a8..30ac53052 100644
--- a/shared/vg_replace_strmem.c
+++ b/shared/vg_replace_strmem.c
@@ -2382,6 +2382,9 @@ static inline void my_exit ( int x )

#if defined(VGO_linux) || defined(VGO_freebsd) || defined(VGO_darwin) || defined(VGO_solaris)
MEMCCPY(VG_Z_LIBC_SONAME, memccpy)
+#elif defined(VGO_darwin)

• WCPNCPY(libsystemZucZddylib, memccpy)
• WCPNCPY(libsystemZuplatformZddylib, _platform_memccpy)
  #endif

Any idea what I did wrong?

[LouisBrunner]

#if defined(VGO_linux) || defined(VGO_freebsd) || defined(VGO_darwin) || defined(VGO_solaris)
MEMCCPY(VG_Z_LIBC_SONAME, memccpy)
+#elif defined(VGO_darwin)

It seems like you are checking for defined(VGO_darwin) in the first condition already? Maybe it should be #if defined(VGO_darwin) instead of #elif?

[paulfloyd]

It seems like you are checking for defined(VGO_darwin) in the first condition already? Maybe it should be #if defined(VGO_darwin) instead of #elif?

Yes indeed, I should have looked more carefully.

I've pushed that change upstream.

[paulfloyd]

I'll see what Fedora does with FORTIFY_SOURCE and try to do the same for the __XNU_FORTIFY_SOURCE functions.

[LouisBrunner]

Second part, some libc functions call end up calling "_chk" versions (e.g., strcpy_chk see here for the macro

Turns out I already redir nearly all of them, I was only missing memcpy_chk and memmove_chk (that I can see in the symbols). Added in #155.

[paulfloyd]

I'll start merging those upstream.