bug fix for read string array

SeeFlowerX · Mar 13, 2024 · 16159c4 · 16159c4
1 parent 2ea9925
commit 16159c4
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 2 deletions.
diff --git a/src/common/buffer.h b/src/common/buffer.h
@@ -179,7 +179,7 @@ static __always_inline int save_str_to_buf(event_data_t *event, void *ptr, u8 in
     // Read into buffer
     int sz =
         bpf_probe_read_str(&(event->args[event->buf_off + 1 + sizeof(int)]), MAX_STRING_SIZE, ptr);
-    if (sz > 0) {
+    if (sz >= 0) {
         barrier();
         // Satisfy verifier for probe read
         if (event->buf_off > ARGS_BUF_SIZE - (MAX_STRING_SIZE + 1 + sizeof(int)))

diff --git a/src/common/consts.h b/src/common/consts.h
@@ -7,6 +7,7 @@
 #define MAX_PATH_COMPONENTS   48
 #define MAX_LOOP_COUNT 32
 #define MAX_STRCMP_LEN 256
+#define STRARR_MAGIC_LEN 0xffff0000
 
 #if defined(__MODULE_STACK)
     #define MAX_OP_COUNT 64

diff --git a/src/utils.h b/src/utils.h
@@ -258,7 +258,10 @@ static __noinline u32 read_args(program_data_t* p, point_args_t* point_args, op_
                 ptr = ptr & 0xffffffffffff;
                 int status = save_str_to_buf(p->event, (void*) ptr, op_ctx->save_index);
                 if (status == 0) {
-                    save_bytes_to_buf(p->event, 0, 0, op_ctx->save_index);
+                    // save_str_to_buf 中应当将 bpf_probe_read_str 返回 0 时视为字符串为空
+                    // 地址异常时 bpf_probe_read_str 返回为负数 此时将认为字符串数组读取结束
+                    // 这里需要为字符串数组的读取设定一个标志 和空字符串的情况区分开
+                    save_bytes_to_buf(p->event, 0, STRARR_MAGIC_LEN, op_ctx->save_index);
                     // 为读取字符串数组设计的
                     op_ctx->loop_count = op_ctx->break_count;
                 }

diff --git a/user/argtype/argtype_complex.go b/user/argtype/argtype_complex.go
@@ -94,6 +94,9 @@ func parse_STRING_ARRAY(ctx IArgType, ptr uint64, buf *bytes.Buffer, parse_more
 		if err := binary.Read(buf, binary.LittleEndian, &arg_str); err != nil {
 			panic(err)
 		}
+		if arg_str.Len == STRARR_MAGIC_LEN {
+			break
+		}
 		payload := make([]byte, arg_str.Len)
 		if err := binary.Read(buf, binary.LittleEndian, &payload); err != nil {
 			panic(err)

diff --git a/user/common/const.go b/user/common/const.go
@@ -9,6 +9,7 @@ const SYSCALL_MAX_OP_COUNT = 256
 const STACK_MAX_OP_COUNT = 64
 const MAX_STRCMP_LEN = 256
 const MAX_BUF_READ_SIZE = 4096
+const STRARR_MAGIC_LEN = 0xffff0000
 
 const (
 	REG_ARM_R0 uint32 = iota