Skip to content

SEGFAULT in some plugin deletion contexts #1527

@lacraig2

Description

@lacraig2

When deleting a callback under very specific conditions we can get ugly errors.

In particular, when deleting a callback that is the last of its kind from within that callback we see a segfault in the following code:

#define MAKE_CALLBACK_NO_ARGS_void(name_upper, name) \
void panda_callbacks_ ## name(void) { \
panda_cb_list *plist; \
for (plist = panda_cbs[PANDA_CB_ ## name_upper]; \
plist != NULL; \
plist = panda_cb_list_next(plist)) { \
if (plist->enabled) \
plist->entry. ENTRY_NAME(name, plist->context); \
} \
} \
void panda_cb_trampoline_ ## name(void* context) {\
(*(panda_cb*)context) . ENTRY_NAME(name); \
}

A minimal example of this behavior for reproducing:

#!/usr/bin/env python3
from pandare import Panda

panda = Panda(generic="i386")

@panda.queue_blocking
def run_cmd():
    panda.revert_sync("root")
    print(panda.run_serial_cmd("uname -a"))
    print(panda.run_serial_cmd("uname -a"))
    print(panda.run_serial_cmd("uname -a"))
    panda.end_analysis()

@panda.cb_main_loop_wait
def asidchange():
    panda.delete_callbacks()

panda.run()

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions