Dr.Memory light mode fail to clean return address from app stack for handle test case

[derekbruening]

From [email protected] on November 08, 2013 16:51:35

./bin/drmemory.exe -verbose 0 -light -check_handle_leaks -dr_ops "-msgbox_mask 0xf" -- ./tests/handle.exe

For line: hFind = FindFirstFile(buf, &ffd);

The callstack is:
0:000> dds 1d259b60
1d259b60 1d259b54
1d259b64 00eabc1c
1d259b68 7562a6bc KERNELBASE!FindFirstFileExW+0x1cc
1d259b6c 0d01a6bc
1d259b70 012ca1c0 handle!__crtLCMapStringA_stat+0xa1 [f:\dd\vctools\crt_bld\self_x86\crt\src\a_map.c @ 149]
1d259b74 0100a1c0
1d259b78 7562aaf7 KERNELBASE!FindFirstFileA+0x4e
1d259b7c 0d01aaf7
1d259b80 012c1237 handle!test_file_handles+0x77 [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\tests\handle.cpp @ 107]
1d259b84 01001237
1d259b88 012c11ac handle!main+0x2c [d:\src\cygwin\home\zhaoqin\workspace\drmemory\drmemory.git\tests\handle.cpp @ 241]
1d259b8c 010011ac
1d259b90 012c1a98 handle!__tmainCRTStartup+0x10b [f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c @ 278]
1d259b94 01001a98
1d259b98 74ce336a kernel32!BaseThreadInitThunk+0xe
1d259b9c 0b01336a
1d259ba0 77129f72 ntdll!__RtlUserThreadStart+0x70
1d259ba4 12039f72
1d259ba8 77129f45 ntdll!_RtlUserThreadStart+0x1b

The line
012ca1c0 handle!__crtLCMapStringA_stat+0xa1 [f:\dd\vctools\crt_bld\self_x86\crt\src\a_map.c @ 149]
does not look right.

012ca1bb e8802f0000 call handle!_alloca_probe_16 (012cd140)
012ca1c0 8bc4 mov eax,esp

handle!_alloca_probe_16:
012cd140 51 push ecx
012cd141 8d4c2408 lea ecx,[esp+0x8]
012cd145 2bc8 sub ecx,eax
012cd147 83e10f and ecx,0xf
012cd14a 03c1 add eax,ecx
012cd14c 1bc9 sbb ecx,ecx
012cd14e 0bc1 or eax,ecx
012cd150 59 pop ecx
012cd151 e9dafaffff jmp handle!_chkstk (012ccc30)

handle!_chkstk:
012ccc30 51 push ecx
012ccc31 8d4c2404 lea ecx,[esp+0x4]
012ccc35 2bc8 sub ecx,eax
012ccc37 1bc0 sbb eax,eax
012ccc39 f7d0 not eax
012ccc3b 23c8 and ecx,eax
012ccc3d 8bc4 mov eax,esp
012ccc3f 2500f0ffff and eax,0xfffff000
012ccc44 3bc8 cmp ecx,eax
012ccc46 720a jb handle!_chkstk+0x22 (012ccc52)
012ccc48 8bc1 mov eax,ecx
012ccc4a 59 pop ecx
012ccc4b 94 xchg eax,esp
012ccc4c 8b00 mov eax,[eax]
012ccc4e 890424 mov [esp],eax
012ccc51 c3 ret

The key is the last 4 instrs, which move the stack pointer and put return target on top of it, and then return.
012ccc4b 94 xchg eax,esp
012ccc4c 8b00 mov eax,[eax]
012ccc4e 890424 mov [esp],eax
012ccc51 c3 ret

Original issue: http://code.google.com/p/drmemory/issues/detail?id=1374

[derekbruening]

From [email protected] on November 08, 2013 15:03:19

handle!_chkstk:
00a6cc30 51 push ecx
00a6cc31 8d4c2404 lea ecx,[esp+0x4]
00a6cc35 2bc8 sub ecx,eax
00a6cc37 1bc0 sbb eax,eax
00a6cc39 f7d0 not eax
00a6cc3b 23c8 and ecx,eax
00a6cc3d 8bc4 mov eax,esp
00a6cc3f 2500f0ffff and eax,0xfffff000
00a6cc44 3bc8 cmp ecx,eax
00a6cc46 720a jb handle!_chkstk+0x22 (00a6cc52)
00a6cc48 8bc1 mov eax,ecx
00a6cc4a 59 pop ecx
00a6cc4b 94 xchg eax,esp
00a6cc4c 8b00 mov eax,[eax]
00a6cc4e 890424 mov [esp],eax
00a6cc51 c3 ret
00a6cc52 2d00100000 sub eax,0x1000
00a6cc57 8500 test [eax],eax
00a6cc59 ebe9 jmp handle!_chkstk+0x14 (00a6cc44)

It also has the Unaddr error should handled:
00a6cc57 8500 test [eax],eax
need update is_alloca_pattern

Status: Started

[derekbruening]

From [email protected] on November 18, 2013 11:50:17

This issue was closed by revision r1624 .

Status: Fixed