test_m680x crashes on Windows

[tmfink]

On Windows x86 Visual Studio 2017, all other tests run, but test_m680x.exe crashes with a dialog box that says:

The debug info showed is for branch next at 309c07e, but the bug is also present in branch master at :

Crash 1

Debug Assertion Failed!

Program: test_m680x.exe
File: minkernel\crts\ucrt\src\appcrt\stdio\output.cpp
Line: 141

Expression: format != nullptr
...

The call stack at the exception:

>	test_m680x.exe!common_vsprintf<__crt_stdio_output::standard_base,char>(const unsigned __int64 options, char * const buffer, const unsigned int buffer_count, const char * const format, __crt_locale_pointers * const locale, char * const arglist) Line 141	C++
 	test_m680x.exe!__stdio_common_vsprintf(unsigned __int64 options, char * buffer, unsigned int buffer_count, const char * format, __crt_locale_pointers * locale, char * arglist) Line 239	C++
 	[External Code]	
 	test_m680x.exe!SStream_concat(SStream * ss, const char * fmt, ...) Line 49	C
 	test_m680x.exe!printInstructionName(cs_struct * handle, SStream * OS, unsigned int insn) Line 112	C
 	test_m680x.exe!M680X_printInst(MCInst * MI, SStream * O, void * PrinterInfo) Line 279	C
 	test_m680x.exe!cs_disasm(unsigned int ud, const unsigned char * buffer, unsigned int size, unsigned __int64 offset, unsigned int count, cs_insn * * insn) Line 953	C
 	test_m680x.exe!test(...) Line 350	C
 	test_m680x.exe!main(...) Line 398	C
 	[External Code]	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]	Unknown

Relevant Frames

SStream_concat() line SStream.c:49

• fmt == NULL

https://github.com/aquynh/capstone/blob/309c07e6315d592dfd5c7d6a9b0961760771146f/SStream.c#L42-L53

printInstructionName() in M680XInstPrinter.c:49

https://github.com/aquynh/capstone/blob/309c07e6315d592dfd5c7d6a9b0961760771146f/arch/M680X/M680XInstPrinter.c#L108-L114

Discussion

Somehow, the format string fmt is being set to NULL because handle->insn_name((csh)handle, insn) returns NULL.

Crash 2

This patch causes the crash to occur later.

diff --git a/arch/M680X/M680XInstPrinter.c b/arch/M680X/M680XInstPrinter.c
index 3c3356b8..4463bec0 100644
--- a/arch/M680X/M680XInstPrinter.c
+++ b/arch/M680X/M680XInstPrinter.c
@@ -109,7 +109,8 @@ static void printInstructionName(cs_struct *handle, SStream *OS,
        unsigned int insn)
 {
 #ifndef CAPSTONE_DIET
-       SStream_concat(OS, handle->insn_name((csh)handle, insn));
+       char *insn_str = handle->insn_name((csh)handle, insn);
+       SStream_concat(OS, insn_str ? insn_str : "???");
 #endif
 }

Some instruction mnemonic printing is still messed up:

...
0x101B: 94         ???
        op_count: 2
                operands[0].type: REGISTER = w (in mnemonic)
                        access: READ | WRITE
                operands[1].type: REGISTER = (null) (in mnemonic)
                        access: READ | WRITE
        Registers read: cc w (null)
        Registers modified: cc w (null)
        groups_count: 1

0x101C: 95         ???
        op_count: 2
                operands[0].type: REGISTER = w (in mnemonic)

Call stack at exception:

 	test_m680x.exe!common_strnlen_c<0,unsigned char>(const unsigned char * const string, const unsigned int maximum_count) Line 72	C++
 	test_m680x.exe!common_strnlen_simd<0,0,unsigned char>(const unsigned char * const string, const unsigned int maximum_count) Line 130	C++
 	test_m680x.exe!common_strnlen<0,unsigned char>(const unsigned char * const string, const unsigned int maximum_count) Line 189	C++
 	test_m680x.exe!strnlen(const char * string, unsigned int maximum_count) Line 201	C++
 	test_m680x.exe!__crt_stdio_output::output_processor<char,__crt_stdio_output::stream_output_adapter<char>,__crt_stdio_output::standard_base<char,__crt_stdio_output::stream_output_adapter<char> > >::type_case_s_compute_narrow_string_length(const int maximum_length, char __formal) Line 2292	C++
 	test_m680x.exe!__crt_stdio_output::output_processor<char,__crt_stdio_output::stream_output_adapter<char>,__crt_stdio_output::standard_base<char,__crt_stdio_output::stream_output_adapter<char> > >::type_case_s() Line 2279	C++
 	test_m680x.exe!__crt_stdio_output::output_processor<char,__crt_stdio_output::stream_output_adapter<char>,__crt_stdio_output::standard_base<char,__crt_stdio_output::stream_output_adapter<char> > >::state_case_type() Line 2023	C++
 	test_m680x.exe!__crt_stdio_output::output_processor<char,__crt_stdio_output::stream_output_adapter<char>,__crt_stdio_output::standard_base<char,__crt_stdio_output::stream_output_adapter<char> > >::process() Line 1668	C++
 	test_m680x.exe!common_vfprintf::__l2::<lambda>() Line 49	C++
 	test_m680x.exe!__crt_seh_guarded_call<int>::operator()<void <lambda>(void),int <lambda>(void) &,void <lambda>(void) >(__acrt_lock_stream_and_call::__l2::void <lambda>(void) && setup, common_vfprintf::__l2::int <lambda>(void) & action, __acrt_lock_stream_and_call::__l2::void <lambda>(void) && cleanup) Line 204	C++
 	test_m680x.exe!__acrt_lock_stream_and_call<int <lambda>(void) >(_iobuf * const stream, common_vfprintf::__l2::int <lambda>(void) && action) Line 256	C++
 	test_m680x.exe!common_vfprintf<__crt_stdio_output::standard_base,char>(const unsigned __int64 options, _iobuf * const stream, const char * const format, __crt_locale_pointers * const locale, char * const arglist) Line 37	C++
 	test_m680x.exe!__stdio_common_vfprintf(unsigned __int64 options, _iobuf * stream, const char * format, __crt_locale_pointers * locale, char * arglist) Line 61	C++
 	[External Code]	
>	test_m680x.exe!print_insn_detail(unsigned int handle, cs_insn * insn) Line 176	C
 	test_m680x.exe!test(...) Line 374	C
 	test_m680x.exe!main(...) Line 398	C
 	[External Code]	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]	Unknown

Relevant snippets:

• op->access has value 48 (way past bounds of s_access)

https://github.com/aquynh/capstone/blob/309c07e6315d592dfd5c7d6a9b0961760771146f/tests/test_m680x.c#L174-L177

https://github.com/aquynh/capstone/blob/309c07e6315d592dfd5c7d6a9b0961760771146f/tests/test_m680x.c#L42-L44

Further root cause analysis required.

[aquynh]

@aladur please ack.

[tmfink]

The following coverity issues have are still open and include m680x code:

#1166
#1112

[aladur]

Thanks for the reminder. I will have a look on these issues.

[aladur]

@tmfink did You also check with Visual Studio 2015?
Just to know if it rather is VS2017 specific or a Windows/Visual Studio issue in general.

[tmfink]

@aladur I tried to build with VS2015 but was unable. I suspect there's something wrong with my VS2015 configuration.

[aladur]

The msvc solution and projects work with VS2010 or later.
Usually when opening a solution VS asks for re-targeting the projects. Sometimes the re-targeting has to be activated by hand in the solutions context menu.
I can successfully build all combinations of Debug/Release Win32/x64 with VS2015 on Windows 10 and the command line output makes sense (especially test_m680x as part of this issue).
Maybe have another try with a capstone clone from scratch, or tell me the issue.

[tmfink]

Fixed in:

• next: 48f3baf
• v4: 810b856

[tmfink]

The msvc solution and projects work with VS2010 or later.

I'm getting LNK1158 cannot run 'rc.exe', so I think it's something with my VS2015 install.
I don't think it's worth looking into since VS2017 works fine.