Avoiding stack overflow using a trampoline - c

The trampoline function in the program below works properly. I think the program below results in stack overflow because the functions thunk_f and thunk1 call each other indefinitely, resulting in the creation of new stack frames. However, I want to write a program that behaves more similarly to a nonterminating loop, as trampolines should prevent stack overflow.
#include <stdio.h>
#include <ctype.h>
#include <stdlib.h>
void trampoline(void *(*func)()) {
while (func) {
void *call = func();
func = (void *(*)())call;
}
}
void *thunk1(int *param);
void *thunk_f(int *param);
void *thunk1(int *param)
{
++*param;
trampoline(thunk_f(param));
return NULL;
}
void *thunk_f(int *param)
{
return thunk1(param);
}
int main(int argc, char **argv)
{
int a = 4;
trampoline(thunk1(&a));
printf("%d\n", a);
}

You are using the trampoline incorrectly: rather than letting it invoke your thunk_f function, you call it with the result of the thunk_f function.
As a result, you are getting a stack overflow. You can avoid the stack overflow (but not the infinite loop) by returning thunk_f instead of calling it:
void *thunk1(int *param)
{
++*param;
return thunk_f;
}
And calling trampoline in main correctly:
int main(int argc, char **argv)
{
int a = 4;
trampoline(thunk1, &a);
printf("%d\n", a);
}
And of course this requires that trampoline gets an additional argument, to pass the &a parameter on:
void trampoline(void *(*func)(int *), int *arg) {
while (func) {
void *call = func(arg);
func = (void *(*)())call;
}
}
This works — but as noted, it’s just an infinite loop without output. To see what’s happening, put the printf inside thunk1:
void *thunk1(int *param)
{
printf("%d\n", ++*param);
return thunk_f;
}
Lastly, I should probably note that this is invalid C, because it’s illegal to convert between a object pointer and a function pointer (always compile with pedantic warnings!). To make the code legal, wrap the function pointer into an object:
#include <stdio.h>
#include <ctype.h>
#include <stdlib.h>
struct f {
struct f (*p)(void *);
};
void trampoline(struct f f, void *args) {
while (f.p) {
f = (f.p)(args);
}
}
struct f thunk1(void *param);
struct f thunk_f(void *param);
struct f thunk1(void *param) {
printf("%d\n", ++*((int *) param));
return (struct f) {thunk_f};
}
struct f thunk_f(void *param) {
return thunk1(param);
}
int main() {
int a = 4;
trampoline((struct f) {thunk1}, &a);
}

Related

Segmentation fault after swap context

Why do I get segmentation fault when executing the following piece of code? I noticed that if I declare a second stack ( char s2[10000]; and init_context2(&unew2, s2, 10000);) everything works fine. But I can't understand why two stacks are required. Is it possible to use only one, if yes how?
output:
before context init
before context swap
Message
Message2
Segmentation fault
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <ucontext.h>
ucontext_t uold, unew, unew2;
char s1[10000];
static void message()
{
puts("Message");
}
static void message2()
{
puts("Message2");
}
void init_context(ucontext_t * uc, void* stack, size_t stack_size)
{
//puts("Inside init context");
getcontext(uc);
uc->uc_link = &uold;
uc->uc_stack.ss_sp = stack;
uc->uc_stack.ss_size = stack_size;
uc->uc_stack.ss_flags = 0;
makecontext(uc, message, 0);
}
void init_context2(ucontext_t * uc, void* stack, size_t stack_size)
{
//puts("Inside init context 2");
getcontext(uc);
uc->uc_link = &uold;
uc->uc_stack.ss_sp = stack;
uc->uc_stack.ss_size = stack_size;
uc->uc_stack.ss_flags = 0;
makecontext(uc, message2, 0);
}
int main(int argc, char** argv) {
int i;
for(i=0; i<10; i++)
{
puts("before context init");
init_context(&unew, s1, 10000);
init_context2(&unew2, s1, 10000);
puts("before context swap");
swapcontext(&uold, &unew);
swapcontext(&uold, &unew2);
}
return (EXIT_SUCCESS);
}
The reason is that you are reusing the stack simultaneously for both contexts; that is, while both contexts are valid. makecontext initializes the stack with something (not sure exactly what, but possibly a return address that links back to the previous context), and thus one clobbers the other.
Simple moving your call to init_context2() to after the first context has run makes the program work:
for(i=0; i<10; i++)
{
puts("before context init");
init_context(&unew, s1, 10000);
puts("before context swap");
swapcontext(&uold, &unew);
init_context2(&unew2, s1, 10000);
swapcontext(&uold, &unew2);
}

Getting all functions with prefix in C

Is it possible to get function pointers to functions that have a prefix? At first I thought the names of c functions were lost during compilation. But then, dlsym returns the pointer to a function of a specified name.
So if there a way to do something like:
void * handle = dlopen(0, RTLD_NOW|RTLD_GLOBAL);
*(void **)(&fptr);
while(fptr = dlsym(handle, "prefix*")) {
fptr(args);
}
Why not just do something like this:
#include <stdio.h>
void funcA(int n) { printf("funcA: %d\n", n); }
void funcB(int n) { printf("funcB: %d\n", n); }
void funcC(int n) { printf("funcC: %d\n", n); }
void (*funcs[3]) (int n) = {
funcA,
funcB,
funcC
};
int main() {
int i;
for (i = 0; i < sizeof funcs / sizeof *funcs; ++i)
funcs[i](i);
return 0;
}
well this isn't a built-in way, and I don't think there is a built-in way... you could parse nm, but that is yucky.
but if you are building a plug in arch you can use an already known symbol to get all of the symbols.
lib.c
char ** functions()
{
static char * f[3] = {"function1","function2",NULL};
return f;
}
void function1()
{
printf("function1\n");
}
void function2()
{
printf("function2\n");
}
main.c
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <errno.h>
typedef char ** (*functions)(void);
typedef void (*voidFunc)(void);
int main(int argc, const char * argv[])
{
void * ref = dlopen("/abs/path/to/libExample.dylib", RTLD_LAZY | RTLD_LOCAL);
if (!ref)
{
printf("filed to open dylib: %i",errno);
}
functions f = dlsym(ref, "functions");
if (f)
{
char** fnames = f();
char * fname = NULL;
for (int i = 0; 1 ; i++)
{
fname = fnames[i];
if (fname) {
voidFunc g = dlsym(ref, fname);
if (g)
{
g();
}
}else{
break;
}
}
}
dlclose(ref);
return EXIT_SUCCESS;
}
outputs:
function1
function2
Program ended with exit code: 0
not a linux way, but on OS X there is a some extra stuff that would probably be easier:
/*
* Structure filled in by dladdr().
*/
typedef struct dl_info {
const char *dli_fname; /* Pathname of shared object */
void *dli_fbase; /* Base address of shared object */
const char *dli_sname; /* Name of nearest symbol */
void *dli_saddr; /* Address of nearest symbol */
} Dl_info;
extern int dladdr(const void *, Dl_info *);

Typecasting (or deference) void * to struct foo*

In api.h
typedef void* hidden_my_type;
void do_something(my_type x);
In core.c
struct _my_type
{
int a;
}
void do_something(hidden_my_type void_x)
{
struct *_my_type x = void_x; /*Don't understand is that correct way to do, as I'm getting segmentation fault error */
printf("Value: %d\n", x->a);
}
Other way I thought as,
struct *_my_type x = (struct _my_type *)malloc(sizeof(struct _my_type));
void_x = x
printf(Value: %d\n", x->a);
But still I'm getting seg-fault error.
ok here is the problem with void*....
e.g.
in core.c
void init_my_type(hidden_my_type a)
{
my_type *the_a = malloc(...);
a = the_a // <<<<<<<<<<<<<<<<<<<<<<<<<<<< is this correct?! a is void* and the_a // is original type
pthread_cond_init(&the_a->...);
.. (in short any other methods for init ..)
}
void my_type_destroy(my_hidden_type x)
{
my_type *the_x = x;
pthread_detroy(&the_x-> ...);
}
in main.c
test()
{
my_hidden_type x;
init_my_type(x);
....
my_type_detroy(x);
}
this it self should fail. as in main.c test function, x is void* ... init will allocate but in destroy I'm again passing void* .. which can be anything!
EDIT (Solved for me)
In api.h
typedef void* hidden_my_type;
void do_something(my_type x);
In core.c
struct _my_type
{
int a;
}
void init_hidden_type(hidden_my_type void_p_my_type)
{
struct _my_type *real_my_type = (struct _my_type *)malloc(sizeof(struct _my_type));
//--- Do init for your type ---
void_p_my_type = real_my_type;
}
void do_something(hidden_my_type void_x)
{
struct *_my_type x = void_x;
printf("Value: %d\n", x->a);
}
Version 0 — Critique of Question's Code
The posted code does not compile.
api.h
typedef void* hidden_my_type;
void do_something(my_type x);
This defines hidden_my_type but not the my_type that is passed to do_something(). Presumably, you intended:
typedef void *my_type;
void do_something(my_type x);
core.c
struct _my_type
{
int a;
}
As noted below too, there is a semi-colon missing after the structure definition.
void do_something(hidden_my_type void_x)
{
struct *_my_type x = void_x;
printf("Value: %d\n", x->a);
}
You have the hidden_my_type vs my_type problem again. You have the * of the pointer where it cannot go; it must go after the struct _my_type. You probably intended something like:
void do_something(my_type void_x)
{
struct _my_type *x = void_x;
printf("Value: %d\n", x->a);
}
This is now syntactically correct (I think; I haven't actually run it past a compiler). You have not shown how it is used; indeed, since the user code has no way to generate a pointer to a valid structure, there is no way for this code to be used safely.
Your test code (unshown — why don't you show your test code) might look something like this:
#include "api.h"
int main(void)
{
my_type x = 0;
do_something(x);
return 0;
}
Alternatively, it might not have the = 0 initializer in place. Either way, your code is unable to function sanely, and a core dump is almost inevitable. When you hide the structure from the user, you have to provide them with a mechanism to get hold of a valid (pointer to) the structure, and you've not done that.
Version 1
This is a better way to do it, because it is more nearly type-safe:
api.h version 1
typedef struct _my_type *my_type;
void do_something(my_type x);
core.c version 1
#include "api.h"
struct _my_type
{
int a;
};
Note the added semi-colon, and the include of the api.h file.
void do_something(my_type x)
{
// Now you don't have to do casting here!
//struct *_my_type x = void_x; /*Don't understand is that correct way to do, as I'm getting segmentation fault error */
printf("Value: %d\n", x->a);
}
Version 2
Actually, we can debate the wisdom of hiding the pointer; I would prefer not to do so:
api.h version 2
#ifndef API_H_INCLUDED
#define API_H_INCLUDED
typedef struct my_type my_type;
extern void do_something(my_type *x);
extern my_type *my_type_initializer(void);
extern void my_type_release(my_type *x);
#endif /* API_H_INCLUDED */
core.c version 2
#include "api.h"
#include <stdio.h>
#include <stdlib.h>
struct my_type
{
int a;
};
void do_something(my_type *x)
{
printf("Value: %d\n", x->a);
}
my_type *my_type_initializer(void)
{
my_type *x = malloc(sizeof(*x));
x->a = 57; // More plausibly, this would be 0
return x;
}
void my_type_release(my_type *x)
{
free(x);
}
main.c
#include "api.h"
int main(void)
{
my_type *x = my_type_initializer();
do_something(x);
my_type_release(x);
return 0;
}
That's nice and clean. Of course, the user cannot allocate a struct my_type (only a pointer to it), so you need a function to allocate the structure for them. Think of the Standard C Library, and the FILE type, and fopen() to allocate and fclose() to release and fprintf() etc to manipulate the type. The my_type_initializer() is functioning as an analogue to fopen(), my_type_release() as an analogue to fclose(), and do_something() as an analogue to fprintf().
Jonathan, you beat me to an answer, but this may be helpful as well. Here, api.c contains the (private) implementation, and api.h provides the interface to be consumed by other code such as main.c.
// main.c: uses only the public interface to the private code
#include "api.h"
int main(int argc, char *argv[]) {
void *foo;
foo = create_foo("five", 5);
print_foo(foo);
delete_foo(foo);
}
// EOF main.c
// api.h: the public interface
#ifndef _api_h_
#define _api_h_
void *create_foo(char *name, int number);
void print_foo(void *foo);
void delete_foo(void *foo);
#endif // _api_h_
// api.c: the private implementation
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
// The real structure is private to the implementation.
typedef struct {
char name[20];
int number;
} real_struct;
// Create a new structure, initialize, return as ptr-to-void.
void *create_foo(char *name, int number) {
real_struct *s = malloc(sizeof(real_struct));
strcpy(s->name, name);
s->number = number;
return (void *) s;
}
// Print the data.
void print_foo(void *foo) {
real_struct *s = (real_struct *) foo;
printf("name: %s, number: %d\n", s->name, s->number);
}
// Release the memory.
void delete_foo(void *foo) {
free(foo);
}
// EOF api.c
This code should compile and run:
$ gcc -o foo main.c api.c
$ ./foo
name: five, number: 5

jump table examples in C

Please give me some examples of jump table usage. I have seen this example on wikipedia:
#include <stdio.h>
#include <stdlib.h>
typedef void (*Handler)(void); /* A pointer to a handler function */
/* The functions */
void func3 (void) { printf( "3\n" ); }
void func2 (void) { printf( "2\n" ); }
void func1 (void) { printf( "1\n" ); }
void func0 (void) { printf( "0\n" ); }
Handler jump_table[4] = {func0, func1, func2, func3};
int main (int argc, char **argv) {
int value;
/* Convert first argument to 0-3 integer (Hash) */
value = atoi(argv[1]) % 4;
if (value < 0) {
value *= -1;
}
/* Call appropriate function (func0 thru func3) */
jump_table[value]();
}
But I was wondering if there is an alternate way of calling the function instead of using index as shown, in the above case it is jump_table[value]();
What I want to achieve is, instead of using the index is there a way to use the name of the function itself.
For example, say we have all the function pointers in a struct.
typedef struct _funcptrs
{
void func1();
void func2();
} funcptrs;
and now when I want to call the function can I do something like funcptrs.func1() ?
You can certainly create a struct containing pointers to functions. There are even good reasons to do so.
For one example, consider the interface between an operating system and a device driver of some sort. Simplifying a lot, this might look something on this order:
struct device {
int (*open)(unsigned mode);
int (*close)(void);
int (*read)(void *buffer, size_t size);
int (*write)(void *buffer, size_t size);
};
Then an individual device driver would create a struct of this type, and initialize the individual pointers to refer to the functions relevant to a particular device:
struct device serial_port = {
open_serial,
close_serial,
read_serial,
write_serial
};
struct device ethernet_adapter = {
open_net,
close_net,
read_net,
write_net
};
struct device keyboard = {
open_keyboard,
close_keyboard,
read_keyboard,
NULL // we'll assume no writing to the keyboard...
};
Then some higher-level function can receive one of these, and open/close/read/write some device without having to know the exact identity of the device involved. Of course, for a real OS, it gets a bit more complex than this but the general idea is (or at least can be) fairly similar.
Certainly, but you need to declare them as function pointers and initialize them first. Though this defeats the purpose of a jump table if you have to spell out the function name.
e.g.
#include <stdio.h>
void func1 (void) { printf( "1\n" ); }
void func0 (void) { printf( "0\n" ); }
typedef struct
{
void (*func0)(void);
void (*func1)(void);
} funcptrs;
int main(int argc, char *argv[])
{
funcptrs funcs = { func0, func1 };
funcs.func1();
return 0;
}
If you need to call the function by having the name of the function as a string, you need to create a mapping between the functions name and a function pointer, then search the table for that function, and call it.
#include <stdio.h>
#include <string.h>
void func1 (void) { printf( "1\n" ); }
void func0 (void) { printf( "0\n" ); }
#define DEFUN(name) { #name, name }
typedef struct
{
const char *name;
void (*func)(void);
} funcptrs;
void call(funcptrs *ptrs, const char *name)
{
int i;
for(i = 0; ptrs[i].name; i++) {
if(strcmp(ptrs[i].name, name) == 0) {
ptrs[i].func();
break;
}
}
}
int main(int argc, char *argv[])
{
funcptrs funcs[] = {DEFUN(func0), DEFUN(func1), {NULL,NULL}};
call(funcs, "func0");
return 0;
}
You can use an enum to represent the indices of your array and give them meaningful names for you.
#include <stdio.h>
#include <stdlib.h>
typedef void (*Handler)(void); /* A pointer to a handler function */
/* The functions */
void func3 (void) { printf( "3\n" ); }
void func2 (void) { printf( "2\n" ); }
void func1 (void) { printf( "1\n" ); }
void func0 (void) { printf( "0\n" ); }
enum{
FUNC0,
FUNC1,
FUNC2,
FUNC3
};
Handler jump_table[4] = {func0, func1, func2, func3};
int main (int argc, char **argv) {
/* Call appropriate function (func0 thru func3) */
jump_table[FUNC0]();
jump_table[FUNC1]();
jump_table[FUNC2]();
jump_table[FUNC3]();
return 0;
}
This will output
0
1
2
3

Accessing members of the struct via void *

The solution consists of two parts, one is a static library that receives instances of struct from the user of the library. Library doesn't know what will be the type of structs, all it knows there will be two function pointers to it with a specific name.
Library Code
pre-compiled library has no way of knowing types of user structs, hence receiving via void*
void save(void *data) {
// library will save/cache user's object
data->registered(); // if register successful
}
void remove(void *data) {
// library will remove the object from memory
data->remove(); // if removed successful
}
User of the Library Code
struct Temp { // random order of fields
void (*custom1)();
void (*registered)();
void (*custom2)();
void (*remove)();
void (*custom3)();
}
void reg() {
printf("registered");
}
void rem() {
printf("removed");
}
void custom1() {}
void custom2() {}
void custom3() {}
var temp = malloc(struct Temp, sizeof(struct Temp));
temp->registered = reg;
temp->remove = rem;
temp->custom1 = custom1; // some custom functions
temp->custom2 = custom2;
temp->custom3 = custom3;
// calling library code
save(temp);
remove(temp);
Q. Is there a way for the Library to know how to iterate and go through member fields and see if there's a pointer to such function and call it available.
Is there a way for the Library to know how to iterate and go through member fields and see if there's a pointer to such function and call it available.
No there is not.
Your best bet is to create a structure in the library that has these members, and pass that structure instead of void*.
As #immibis said, there is no way for this to work (i.e. no way for the compiler to justify compiling such code) if the compiler does not know what the types of the data being passed to the function are.
Since you wanted to pass the objects along to the library without storing information about the type of each object in the library, you can fake polymorphism in C, by doing the following:
callback.h
#ifndef _CALLBACK_H_
#define _CALLBACK_H_
typedef struct {
void (*registered)();
void (*removed)();
} ICallback;
#endif _CALLBACK_H_
pre_comp.h
#ifndef _PRE_COMP_H_
#define _PRE_COMP_H_
#include "callback.h"
void save(ICallback* data);
void remove(ICallback* data);
#endif /* _PRE_COMP_H_ */
precomp.c
#include <stdlib.h> /* NULL */
#include "callback.h"
#include "pre_comp.h"
void save(ICallback *data) {
if (NULL != data && NULL != data->registered) {
data->registered(); // if register successful
}
}
void remove(ICallback *data) {
if (NULL != data && NULL != data->removed) {
data->removed(); // if removed successful
}
}
main.c
#include <stdio.h>
#include "pre_comp.h"
#include "callback.h"
struct Temp {
ICallback base; // has to be defined first for this to work
void (*custom1)();
void (*custom2)();
void (*custom3)();
};
// calling library code
void reg() {
puts("registered");
}
void rem() {
puts("removed");
}
int main() {
struct Temp data = {{reg, rem}};
save((ICallback*)&data);
remove((ICallback*)&data);
}
compiling
gcc pre_comp.c main.c
output
registered
removed
If the library has 0 information about the possible struct types, then you
cannot do it. The library has to get somehow the information or the offsets.
The only way I can think of is:
All register member have the same prototype
Pass the offset to the function.
I created an example of this
#include <stdio.h>
#include <stddef.h>
#include <stdint.h>
// function that does not know anything about any struct
void reg(void *data, size_t offset)
{
uintptr_t *p = (uintptr_t*) (((char*) data) + offset);
void (*reg)() = (void(*)()) *p;
reg();
}
struct A {
int c;
void (*reg)();
};
struct B {
int b;
int c;
void (*reg)();
};
void reg_a()
{
printf("reg of A\n");
}
void reg_b()
{
printf("reg of B\n");
}
int main(void)
{
struct A a;
struct B b;
a.reg = reg_a;
b.reg = reg_b;
reg(&a, offsetof(struct A, reg));
reg(&b, offsetof(struct B, reg));
return 0;
}
This prints:
$ ./c
reg of A
reg of B
I run it with valgrind and I did not get any errors nor warnings. I'm not sure if
this violates somehow strict aliasing rules or yields undefined behaviour
because of the uintptr_t* conversions, but at least it seems to work.
I think however, the more cleaner solution is to rewrite the register (btw. register
is a keyword in C, you cannot use that for a function name) function to
accept a function pointer and possible parameters, something like this:
#include <stdio.h>
#include <stdarg.h>
void reg(void (*func)(va_list), int dummy, ...)
{
if(func == NULL)
return;
va_list ap;
va_start(ap, dummy);
func(ap);
va_end(ap);
}
void reg1(int a, int b)
{
printf("reg1, a=%d, b=%d\n", a, b);
}
void vreg1(va_list ap)
{
int a = va_arg(ap, int);
int b = va_arg(ap, int);
reg1(a, b);
}
void reg2(const char *text)
{
printf("reg2, %s\n", text);
}
void vreg2(va_list ap)
{
const char *text = va_arg(ap, const char*);
reg2(text);
}
int main(void)
{
reg(vreg1, 0, 3, 4);
reg(vreg2, 0, "Hello world");
return 0;
}
This has the output:
reg1, a=3, b=4
reg2, Hello world
Note that reg has a dummy parameter. I do that because the man page of
stdarg says:
man stdarg
va_start():
[...]
Because the address of this argument may be used in the va_start() macro,
it should not be declared as a register variable, or as a
function or an array type.
You can take an approach similar to qsort and pass function pointers in addition to a void pointer to the structure.
Here is the function prototype for qsort, which is a function that can be used to sort arrays of any type:
void qsort(void *base, size_t nmemb, size_t size, int (*compar)(const void *, const void *));
It takes a function pointer that performs the comparison because without it qsort wouldn't know how to compare two objects.
This can be applied to your task with a function prototype like this:
int DoFoo(void *thing, void (*register)(void *), void (*remove)(void *))
This function takes a void pointer to your struct and then two functions that it can call when it needs to register or remove that struct. Having the functions be members of the struct is not required and I generally do not recommend it. I recommend reading up on qsort because it is does something similar to what you are trying to do.

Resources