Crash while parsing protobuf message containing string using C ++ and Android NDK

I have two programs running on the Android 2.3.4 platform. One of them is the C ++ binary code in the form of a daemon compiled with cmake, the other is apk with the jni part compiled with ndk-build. I am using android-ndk-r6. I use protobuf messages and local unix sockets to transfer data between them. I use the SerializeAsString and ParseFromString methods. Here is a snippet

AbstractMessage protobuff_msg; protobuff_msg.set_id ( 1 ); //TODO: for now hardcoded, later can be used for request-response pairs protobuff_msg.set_type ( AbstractMessage_MessageType_REQUEST ); protobuff_msg.set_method ( AbstractMessage_MethodName_LOAD_DEFINITION ); AbstractMessage_Parameter* param = protobuff_msg.mutable_param()->Add(); param->set_name(AbstractMessage_ParameterName_FILEPATH); param->set_value(filepath); std::string msg = protobuff_msg.SerializeAsString(); client_->write_protobuf_message ( msg, MAGIC_NUMBER ); 

AbstractMessage - message protobuf, AbstractMessage_MessageType_REQUEST, LOAD_DEFINITION, FILEPATH - enumerations, AbstractMessage_Parameter - re-attached message. The parameter value is a string, all other types are int-s. The client is a special library for socket communication.

 int Foo::write_protobuf_message(std::string protobuf_msg, int magic_number) { int send_int = 0; send_int = htonl(magic_number); int n = write_to_socket((void *)&send_int, sizeof(int)); if(n<0) return -1; send_int = htonl(protobuf_msg.size()); n = write_to_socket((void *)&send_int, sizeof(int)); if(n<0) return -1; n = write_to_socket((void *)protobuf_msg.c_str(),protobuf_msg.size()); return n; } The parsing: void foo ( void* buffer, int buff_size, int error) { std::string buffstr; if (error == 0) { buffstr.assign ( ( char* ) buffer, buff_size ); AbstractMessage proto_msg; bool res = proto_msg.ParsePartialFromString(buffstr); if (res) { //TODO handle ok parsing return; } else { //TODO handle failed parsing return; } } } 

This script is being tested with two C ++ daemon daemons as testing tools, and it works. However, when I try to execute a real deal with apk, I get the following failure:

 09-30 11:43:28.335: INFO/DEBUG(1044): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 09-30 11:43:28.335: INFO/DEBUG(1044): Build fingerprint: 'foobar/voles/sholes/sholes:2.2.1/FRG83D/75603:user/release-keys' 09-30 11:43:28.335: INFO/DEBUG(1044): pid: 3991, tid: 4001 >>> com.foo.bar <<< 09-30 11:43:28.335: INFO/DEBUG(1044): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad 09-30 11:43:28.335: INFO/DEBUG(1044): r0 00000027 r1 deadbaad r2 a0000000 r3 00000000 09-30 11:43:28.335: INFO/DEBUG(1044): r4 00000001 r5 00000000 r6 80422d0c r7 0000a000 09-30 11:43:28.342: INFO/DEBUG(1044): r8 44156eb0 r9 44156eb4 10 000ab44c fp 000001f0 09-30 11:43:28.342: INFO/DEBUG(1044): ip afd46668 sp 44156c80 lr afd193b1 pc afd15e80 cpsr 60000030 09-30 11:43:28.342: INFO/DEBUG(1044): d0 6472656767756265 d1 696e6a2f6c6c6173 09-30 11:43:28.342: INFO/DEBUG(1044): d2 4194fc184194fb65 d3 4194fc804194fc74 09-30 11:43:28.342: INFO/DEBUG(1044): d4 4194fce84194fcb4 d5 4194fd504194fd1c 09-30 11:43:28.342: INFO/DEBUG(1044): d6 4194fdb84194fd84 d7 4194fe204194fdec 09-30 11:43:28.342: INFO/DEBUG(1044): d8 0000000000000000 d9 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): d10 0000000000000000 d11 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): d12 0000000000000000 d13 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): d14 0000000000000000 d15 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): d16 00000000405122d8 d17 3fe999999999999a 09-30 11:43:28.350: INFO/DEBUG(1044): d18 42eccefa43de3400 d19 3fbc71c71c71c71c 09-30 11:43:28.350: INFO/DEBUG(1044): d20 4008000000000000 d21 3fd99a27ad32ddf5 09-30 11:43:28.350: INFO/DEBUG(1044): d22 3fd24998d6307188 d23 3fcc7288e957b53b 09-30 11:43:28.350: INFO/DEBUG(1044): d24 3fc74721cad6b0ed d25 3fc39a09d078c69f 09-30 11:43:28.350: INFO/DEBUG(1044): d26 0000000000000000 d27 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): d28 0000000000000000 d29 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): d30 0000000000000000 d31 0000000000000000 09-30 11:43:28.350: INFO/DEBUG(1044): scr 60000010 09-30 11:43:28.514: INFO/DEBUG(1044): #00 pc 00015e80 /system/lib/libc.so (__libc_android_abort) 09-30 11:43:28.514: INFO/DEBUG(1044): #01 pc 00013834 /system/lib/libc.so (dlfree) 09-30 11:43:28.514: INFO/DEBUG(1044): #02 pc 00014726 /system/lib/libc.so (free) 09-30 11:43:28.514: INFO/DEBUG(1044): code around pc: 09-30 11:43:28.514: INFO/DEBUG(1044): afd15e60 2c006824 e028d1fb b13368db c064f8df 09-30 11:43:28.514: INFO/DEBUG(1044): afd15e70 44fc2401 4000f8cc 49124798 25002027 09-30 11:43:28.514: INFO/DEBUG(1044): afd15e80 f7f57008 2106ebce ed7af7f6 460aa901 09-30 11:43:28.514: INFO/DEBUG(1044): afd15e90 f04f2006 95015380 95029303 e8a0f7f6 09-30 11:43:28.514: INFO/DEBUG(1044): afd15ea0 462aa905 f7f62002 f7f5e8ac 2106ebba 09-30 11:43:28.514: INFO/DEBUG(1044): code around lr: 09-30 11:43:28.514: INFO/DEBUG(1044): afd19390 4a0e4b0d e92d447b 589c41f0 26004680 09-30 11:43:28.514: INFO/DEBUG(1044): afd193a0 686768a5 f9b5e006 b113300c 47c04628 09-30 11:43:28.514: INFO/DEBUG(1044): afd193b0 35544306 37fff117 6824d5f5 d1ef2c00 09-30 11:43:28.514: INFO/DEBUG(1044): afd193c0 e8bd4630 bf0081f0 0002816c ffffff88 09-30 11:43:28.522: INFO/DEBUG(1044): afd193d0 b086b570 f602fb01 9004460c a804a901 09-30 11:43:28.522: INFO/DEBUG(1044): stack: 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c40 afd42664 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c44 000a9908 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c48 00000015 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c4c afd18479 /system/lib/libc.so 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c50 afd4270c 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c54 afd426b8 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c58 00000000 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c5c afd193b1 /system/lib/libc.so 09-30 11:43:28.522: INFO/DEBUG(1044): 44156c60 00000001 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c64 44156c94 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c68 80422d0c 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c6c 0000a000 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c70 44156eb0 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c74 afd186d3 /system/lib/libc.so 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c78 df002777 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c7c e3a070ad 09-30 11:43:28.530: INFO/DEBUG(1044): #00 44156c80 00000023 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c84 001533b8 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c88 80422d0c 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c8c 44156cec 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c90 80422d0c 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c94 fffffbdf 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c98 44156eb0 09-30 11:43:28.530: INFO/DEBUG(1044): 44156c9c afd46450 09-30 11:43:28.530: INFO/DEBUG(1044): 44156ca0 44156cec 09-30 11:43:28.530: INFO/DEBUG(1044): 44156ca4 afd13839 /system/lib/libc.so 09-30 11:43:28.530: INFO/DEBUG(1044): #01 44156ca8 80422d0c 09-30 11:43:28.530: INFO/DEBUG(1044): 44156cac 44156cec 09-30 11:43:28.538: INFO/DEBUG(1044): 44156cb0 0000000b 09-30 11:43:28.538: INFO/DEBUG(1044): 44156cb4 00000000 09-30 11:43:28.538: INFO/DEBUG(1044): 44156cb8 44156eb0 09-30 11:43:28.538: INFO/DEBUG(1044): 44156cbc afd14729 /system/lib/libc.so 09-30 11:43:30.382: INFO/BootReceiver(1185): Copying /data/tombstones/tombstone_00 to DropBox (SYSTEM_TOMBSTONE) 

If I try to parse only ints (I am modifying the protobuf message without string / bytes), everything works fine. If I add the string / bytes, everything will fail. I tried also with a required and optional string, also with bytes. Nothing works. I found that such an accident was caused by a statement. Any ideas?

+4
source share
1 answer

What can I say about your mistake:

 signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaad 

deadbaad usually means an invalid address .. so you most likely have an invalid address in the parsing section.

I would suggest including dalvik.vm.checkjni=true and try to find out if you have more information.

0
source

All Articles