Hi everyone I am running in a crash when using `proc pidpath

Question

Hi everyone I am running in a crash when using `proc pidpath` from `libproc h` to get the path of the process from the pid The code is pretty standard ```char path PROC PIDPATHINFO MAXSIZE = 0 int bufsize = proc pidpath pid path sizeof path if bufsize gt 0 return std string path return ``` Also osquery already uses it so it should work fine Am I missing something Anybody experienced the same

sharvil · Answer

Can you share the stacktrace

sharvil · Answer

And what macOS version are you on

Andrea · Answer

```ProductName macOS ProductVersion 12 1 BuildVersion 21C52``` Everything I can get is this ```Process 6936 stopped thread 1 queue = com apple main thread stop reason = EXC BAD ACCESS code=2 address=0x7ff7bf6ffff8 frame 0 0x0000000100025615 processinfo test`std 1 basic ostream lt char std 1 char traits lt char gt gt amp std 1 put character sequence lt char std 1 char traits lt char gt gt std 1 basic ostream lt char std 1 char traits lt char gt gt amp char const unsigned long + 47 processinfo test`std 1 put character sequence lt char std 1 char traits lt char gt gt gt 0x100025615 lt +47 gt callq 0x10002c558 symbol stub for std 1 basic ostream lt char std 1 char traits lt char gt gt sentry sentry std 1 basic ostream lt char std 1 char traits lt char gt gt amp 0x10002561a lt +52 gt cmpb $0x0 0x40 rbp 0x10002561e lt +56 gt je 0x1000256a8 lt +194 gt 0x100025624 lt +62 gt movq r14 rax```

sharvil · Answer

can you try replacing `PROC PIDPATHINFO MAXSIZE` with something like `4096` in the char array and try again I think `PROC PIDPATHINFO MAXSIZE` doesn t come from libproc h header it might be coming from somewhere else

sharvil · Answer

Just tried it locally PROC PIDPATHINFO MAXSIZE does get include and is defined as 4 PATHMAX is it crashing on a particularly long path

sharvil · Answer

``` pidpath clang++ pidpath cpp o pidpath pidpath pidpath 1 proc 1 sbin launchd pidpath pidpath 350 proc 350 System Library PrivateFrameworks SkyLight framework Versions A Resources WindowServer pidpath pidpath 69115 proc 69115 Applications Microsoft Excel pidpath pidpath 59177 proc 59177 Applications Google Chrome Framework framework Versions 103 0 5060 134 Helpers Google Chrome Helper GPU app Contents MacOS Google Chrome Helper GPU pidpath```

Andrea · Answer

I have tried with the numeric value too same crash thinking face

Andrea · Answer

let me check the length of the path

sharvil · Answer

What s the locale on the machine Does the path have any non ascii characters Perhaps something like that

Andrea · Answer

the path is definitely under 4096 and definitely ASCII

sharvil · Answer

weird not sure since this works locally for me probably attach a debugger

Andrea · Answer

the simplest example works here too ```andrea andrea macbook ~ pidpath 543 proc 543 Applications Google <http Chrome app Contents Frameworks Google|Chrome app Contents Frameworks Google> Chrome Framework framework Versions 103 0 5060 134 Helpers chrome crashpad handler andrea andrea macbook ~ pidpath 883 proc 883 Applications Slack app Contents Frameworks Electron Framework framework Versions A Helpers chrome crashpad handler ```

Andrea · Answer

lol

Andrea · Answer

I am speechless now

sharvil · Answer

Is this code part of an osquery extension I wonder if codesign or something comes into play

sharvil · Answer

Anything in the `<http Console app|Console app>` Crash Report `EXC BAD ACCESS code=2` seems to imply `KERN PROTECTION FAILURE` which could be permissions related

Andrea · Answer

I thought about it too but I find out because the app signed and notarised was crashing confused

sharvil · Answer

gt I thought about it too but I find out because the app signed and notarised was crashing Which app Is the crash happening in osquery

Andrea · Answer

no no don t worry it s not osquery

sharvil · Answer

ah still quite an interesting crash though the only other thing I can think of is when a `pid` doesn t have a path in the filesystem kinda zombie like process but that s far fetched

Andrea · Answer

so apparently the function was written as part of a Objective C file mm so defining the function in that context was creating some issues

Andrea · Answer

moved the function in a c++ file and it works fine

sharvil · Answer

Ah I guess ARC may not play that nicely I am sure there is a way to guard retain that memory

Andrea · Answer

not sure what ARC is but I ll have a look Anyway thank you for your help very appreciated

sharvil · Answer

cool no problem arc is the reference counting in Objective C

Andrea · Answer

ahh ok