Skip to content

Fix segfault from null GetFunction() in DartDumper for Dart 3.10#190

Open
vichhka-git wants to merge 1 commit intoworawit:mainfrom
vichhka-git:fix/null-deref-getfunction-dart310
Open

Fix segfault from null GetFunction() in DartDumper for Dart 3.10#190
vichhka-git wants to merge 1 commit intoworawit:mainfrom
vichhka-git:fix/null-deref-getfunction-dart310

Conversation

@vichhka-git
Copy link

Summary

  • Fix SIGSEGV crash during Object Pool dump when processing Dart 3.10.7 snapshots
  • GetFunction() returns nullptr when an UnlinkedCall target address isn't found in the functions/stubs maps, but 3 call sites dereference the result without null checks

Problem

When running blutter against a Dart 3.10.7 libapp.so, the binary crashes with a segmentation fault (signal 11) during DumpObjectPool(). The crash occurs in getPoolObjectDescription() when handling UnlinkedCall entries whose kImmediate target address doesn't resolve to any known function.

Related to issue #182 — commit a4d2100 added kTaggedObject handling but missed null guards on the kImmediate path.

Changes (all in blutter/src/DartDumper.cpp)

Location Fix
getPoolObjectDescription() ~L812 Added null check on GetFunction() return; fallback to [unknown] label
DumpStructHeaderFile() ~L194 Added null check; also fixed pre-existing extra arg in std::format()
ObjectToString() ~L491 Split into null check + AsFunction() call; fallback to Function(addr)

Testing

  • Verified fix against a Dart 3.10.7 Android arm64 libapp.so that previously crashed
  • Full run completes successfully: Object Pool dump, code analysis, assembly generation, Frida script output all produced without error

GetFunction() returns nullptr when an UnlinkedCall target address is not
found in the functions or stubs maps. Three call sites in DartDumper.cpp
dereferenced the result without null checks, causing SIGSEGV during
Object Pool dump on Dart 3.10.7 snapshots.

Added null guards with fallback representations at:
- getPoolObjectDescription() UnlinkedCall kImmediate handler
- DumpStructHeaderFile() UnlinkedCall kImmediate handler
- ObjectToString() kFunctionCid handler

Also fixed a pre-existing extra argument in std::format() call in
DumpStructHeaderFile().
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant