Console.WriteLine can crash with specially crafted strings

[mathieubourgeois]

It looks like using Console.WriteLine since 8.3.x crashes xamarin with a native crash. The crash occurs in printf, and didn't happen in 8.2.x. It looks like Console.WriteLine now calls a form of printf under the hood. If I try to log a string containing % characters, all hell breaks loose and it starts poking the stack for extra arguments and printing garbage. If I send enough, I get a crash (probably because it ends up dereferencing an invalid pointer somewhere on the stack). The string I provide is actually a reduced version of a string we're actually trying to log in our app. It's an url-encoded list of parameters to a web service (reduced for business purpose, but the reduced string crashes every time on my end as well)

Steps to Reproduce

1. Call the following code anywhere

Console.WriteLine("%20lo%20lo%20m%20m%20s%20s%20s%20s%20s%20s%20s");

Expected Behavior

Writes the exact string to the console

Actual Behavior

App crashes (this is the crash I obtain in armeabi-v7a), with other strings you can get random garbage.

07-09 19:05:52.918 2275 2275 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x20
07-09 19:05:52.918 2275 2275 F DEBUG : Cause: null pointer dereference
07-09 19:05:52.918 2275 2275 F DEBUG : r0 00000020 r1 00000020 r2 00000001 r3 00000000
07-09 19:05:52.918 2275 2275 F DEBUG : r4 f416166a r5 00000010 r6 00000014 r7 ffffffff
07-09 19:05:52.918 2275 2275 F DEBUG : r8 c877abbc r9 ffffffff sl c877b034 fp d459a7f4
07-09 19:05:52.918 2275 2275 F DEBUG : ip f415f594 sp c877ab18 lr f410c0fd pc f40e858c cpsr 600b0030
07-09 19:05:52.919 2275 2275 F DEBUG :
07-09 19:05:52.919 2275 2275 F DEBUG : backtrace:
07-09 19:05:52.919 2275 2275 F DEBUG : #00 pc 0001a58c /system/lib/libc.so (strlen+71)
07-09 19:05:52.919 2275 2275 F DEBUG : #1 pc 0003e0f9 /system/lib/libc.so (__vfprintf+3700)
07-09 19:05:52.919 2275 2275 F DEBUG : #2 pc 000454f5 /system/lib/libc.so (vasprintf+116)
07-09 19:05:52.919 2275 2275 F DEBUG : #3 pc 002bad20 /data/app/com.test.app-bNvAnqhOfjZ5uOWEHcDGDA==/lib/arm/libmonosgen-2.0.so (monoeg_g_log+80)

Version Information

Microsoft Visual Studio Professional 2017
Version 15.7.4
VisualStudio.15.Release/15.7.4+27703.2035
Microsoft .NET Framework
Version 4.7.03062

Installed Version: Professional

Visual C++ 2017 00370-20007-36350-AA982
Microsoft Visual C++ 2017

Application Insights Tools for Visual Studio Package 8.12.10405.1
Application Insights Tools for Visual Studio

ASP.NET and Web Tools 2017 15.0.40601.0
ASP.NET and Web Tools 2017

ASP.NET Core Razor Language Services 15.7.31476
Provides languages services for ASP.NET Core Razor.

ASP.NET Web Frameworks and Tools 2017 5.2.60419.0
For additional information, visit https://www.asp.net/

Azure App Service Tools v3.0.0 15.0.40608.0
Azure App Service Tools v3.0.0

C# Tools 2.8.3-beta6-62923-07. Commit Hash: 7aafab561e449da50712e16c9e81742b8e7a2969
C# components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used.

Common Azure Tools 1.10
Provides common services for use by Azure Mobile Services and Microsoft Azure Tools.

Cookiecutter 15.7.18156.1
Provides tools for finding, instantiating and customizing templates in cookiecutter format.

JavaScript Language Service 2.0
JavaScript Language Service

JavaScript Project System 2.0
JavaScript Project System

JavaScript UWP Project System 2.0
JavaScript UWP Project System

Merq 1.1.19-rc (a4ffc1b)
Command Bus, Event Stream and Async Manager for Visual Studio extensions.

Microsoft Azure Tools 2.9
Microsoft Azure Tools for Microsoft Visual Studio 2017 - v2.9.10420.2

Microsoft Continuous Delivery Tools for Visual Studio 0.3
Simplifying the configuration of continuous build integration and continuous build delivery from within the Visual Studio IDE.

Microsoft JVM Debugger 1.0
Provides support for connecting the Visual Studio debugger to JDWP compatible Java Virtual Machines

Microsoft MI-Based Debugger 1.0
Provides support for connecting Visual Studio to MI compatible debuggers

Microsoft Visual C++ Wizards 1.0
Microsoft Visual C++ Wizards

Microsoft Visual Studio Tools for Containers 1.1
Develop, run, validate your ASP.NET Core applications in the target environment. F5 your application directly into a container with debugging, or CTRL + F5 to edit & refresh your app without having to rebuild the container.

Microsoft Visual Studio VC Package 1.0
Microsoft Visual Studio VC Package

Mono Debugging for Visual Studio 4.10.5-pre (ab58725)
Support for debugging Mono processes with Visual Studio.

NuGet Package Manager 4.6.0
NuGet Package Manager in Visual Studio. For more information about NuGet, visit http://docs.nuget.org/.

ProjectServicesPackage Extension 1.0
ProjectServicesPackage Visual Studio Extension Detailed Info

Python 15.7.18156.1
Provides IntelliSense, projects, templates, debugging, interactive windows, and other support for Python developers.

Python - Django support 15.7.18156.1
Provides templates and integration for the Django web framework.

Python - IronPython support 15.7.18156.1
Provides templates and integration for IronPython-based projects.

Python - Profiling support 15.7.18156.1
Profiling support for Python projects.

ResourcePackage Extension 1.0
ResourcePackage Visual Studio Extension Detailed Info

SQL Server Data Tools 15.1.61804.210
Microsoft SQL Server Data Tools

Test Adapter for Boost.Test 1.0
Enables Visual Studio's testing tools with unit tests written for Boost.Test. The use terms and Third Party Notices are available in the extension installation directory.

Test Adapter for Google Test 1.0
Enables Visual Studio's testing tools with unit tests written for Google Test. The use terms and Third Party Notices are available in the extension installation directory.

TypeScript Tools 15.7.20419.2003
TypeScript Tools for Microsoft Visual Studio

Visual Basic Tools 2.8.3-beta6-62923-07. Commit Hash: 7aafab561e449da50712e16c9e81742b8e7a2969
Visual Basic components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used.

Visual C++ for Cross Platform Mobile Development (Android) 15.0.27625.00
Visual C++ for Cross Platform Mobile Development (Android)

Visual C++ for Cross Platform Mobile Development (iOS) 15.0.27520.00
Visual C++ for Cross Platform Mobile Development (iOS)

Visual F# Tools 10.1 for F# 4.1 15.7.0.0. Commit Hash: 173513e369ffb7a1c4d5dccf83696d9aac2ab2d0.
Microsoft Visual F# Tools 10.1 for F# 4.1

Visual Studio Code Debug Adapter Host Package 1.0
Interop layer for hosting Visual Studio Code debug adapters in Visual Studio

Visual Studio Tools for CMake 1.0
Visual Studio Tools for CMake

Visual Studio Tools for Unity 3.7.0.1
Visual Studio Tools for Unity

Visual Studio Tools for Universal Windows Apps 15.0.27703.2035
The Visual Studio Tools for Universal Windows apps allow you to build a single universal app experience that can reach every device running Windows 10: phone, tablet, PC, and more. It includes the Microsoft Windows 10 Software Development Kit.

VisualStudio.Mac 1.0
Mac Extension for Visual Studio

Windows Machine Learning Generator Extension 1.0
Windows Machine Learning Visual Studio Extension Detailed Info

Xamarin 4.10.10.2 (35a01d8dc)
Visual Studio extension to enable development for Xamarin.iOS and Xamarin.Android.

Xamarin Designer 4.12.1 (f3257e429)
Visual Studio extension to enable Xamarin Designer tools in Visual Studio.

Xamarin.Android SDK 8.3.3.2 (HEAD/dffc59120)
Xamarin.Android Reference Assemblies and MSBuild support.

Xamarin.iOS and Xamarin.Mac SDK 11.12.0.4 (64fece5)
Xamarin.iOS and Xamarin.Mac Reference Assemblies and MSBuild support.

[mathieubourgeois]

This seems to be the problematic commit

mono/mono@984f648

We went from

__android_log_print (level, appname, "%s", log, IntPtr.Zero);

in C# to

g_log (appname, (GLogLevelFlags)level, message);

in C, passing the message directly as a format string instead of a parameter. I'll try and see if putting it back to a similar system fixes the issue...