Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NtSetInformationProcess ProcessTlsInformation struct is IN and OUT #1228

Open
derekbruening opened this issue Nov 28, 2014 · 0 comments
Open

Comments

@derekbruening
Copy link
Contributor

From bruen...@google.com on May 13, 2013 22:54:16

shows up like this on win8:
[ RUN ] OleTest.CoCreateInstance

Error #1: UNINITIALIZED READ: reading 0x01b0e3e4-0x01b0e3e8 4 byte(s) within 0x01b0e3cc-0x01b0e3e8
#0 system call NtSetInformationProcess parameter #2
#1 ntdll.dll!LdrpHandleTlsData (0x77d723b6 <ntdll.dll+0x123b6>) modid:25
#2 ntdll.dll!LdrpSnapModule (0x77dba153 <ntdll.dll+0x5a153>) modid:25
#3 ntdll.dll!LdrpMapAndSnapModules (0x77db9794 <ntdll.dll+0x59794>) modid:25
#4 ntdll.dll!LdrpPrepareModuleForExecution (0x77db9a9f <ntdll.dll+0x59a9f>) modid:25
#5 ntdll.dll!LdrpLoadDll (0x77dba247 <ntdll.dll+0x5a247>) modid:25
#6 ntdll.dll!LdrLoadDll (0x77db7229 <ntdll.dll+0x57229>) modid:25
#7 KERNELBASE.dll!LoadLibraryExW (0x77bfe7db <KERNELBASE.dll+0xe7db>) modid:24
#8 combase.dll!LoadLibraryWithLogging [d:\win8_gdr\com\combase\common\loadfree.cxx:160](0x75e67cb3 <combase.dll+0x27cb3) modid:18
#9 combase.dll!CClassCache::CDllPathEntry::LoadDll [d:\win8_gdr\com\combase\objact\dllcache.cxx:2398](0x75e67c05 <combase.dll+0x27c05) modid:18
#10 combase.dll!CClassCache::CDllPathEntry::Create [d:\win8_gdr\com\combase\objact\dllcache.cxx:2242](0x75e67a63 <combase.dll+0x27a63) modid:18
#11 combase.dll!CClassCache::CClassEntry::CreateDllClassEntry [d:\win8_gdr\com\combase\objact\dllcache.cxx:1035](0x75e67860 <combase.dll+0x27860) modid:18

app xsp=0x01b0e36c
arg 0 = 0xffffffff
arg 1 = 0x23
arg 2 = 0x1b0e3cc
arg 3 = 0x1c

      memarg iter pre param 2 parameter `#2` 0x1b0e3cc-0x1b0e3e8 r

memref: read @0x0000001a 0x01b0e3cc 0x1c bytes (pre-dword 0x00 0x00)

0x23 == 35 == ProcessTlsInformation

native clearly does not initialize the last dword (and clearly there's some var-len in this struct):
0:000> dds esp
01b0e360 ffffffff
01b0e364 00000023
01b0e368 01c78650 <Unloaded_>+0x1c1864e
01b0e36c 00000028
0:000> dd 01c78650
01c78650 00000000 00000001 00000002 00000000
01c78660 00000000 01c76018 baadf00d 00000000
01c78670 01c76058 baadf00d abababab abababab

and post-syscall it seems to be written to, along with earlier fields:

0:000> dd 01c78650
01c78650 00000000 00000001 00000002 00000000
01c78660 00000002 00000000 00000a44 00000002
01c78670 00000000 000005d8 abababab abababab

0:000> ~
. 0 Id: 374.a44 Suspend: 1 Teb: 7e41f000 Unfrozen
1 Id: 374.5d8 Suspend: 1 Teb: 7e41c000 Unfrozen

Original issue: http://code.google.com/p/drmemory/issues/detail?id=1228

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant