在固定工具中调用函数时发生分段错误

我目前正在构建一个 Pin 工具，该工具基于这篇博文检测来自 Linux 应用程序的未初始化读取。
您还可以从博客中查看作者的代码。

由于这个是针对Windows的，我试图创建一个与Linux兼容的。但是当我使用应用程序执行我的 Pin 工具时，发生了分段错误。奇怪的是，错误发生在调用函数时（错误发生在引脚工具调用taint_define函数中的函数taint_get时），而不是因为访问未初始化的堆指针或此类一般分段错误点。

分段错误点如下所示：

VOID Instruction(INS ins, VOID *v)
{
   Uninit_Instruction(ins, v);
}
void Uninit_Instruction(INS ins, void* v)
{
   // check if the stack pointer is altered (i.e. memory is allocated on the
   // stack by subtracting an immediate from the stack pointer)
   if(INS_Opcode(ins) == XED_ICLASS_SUB &&
      INS_OperandReg(ins, 0) == REG_STACK_PTR &&
      INS_OperandIsImmediate(ins, 1)) 
   {
      // insert call after, so we can pass the stack pointer directly
      INS_InsertCall(ins, IPOINT_AFTER, (AFUNPTR)taint_undefined,
             IARG_REG_VALUE, 
             REG_STACK_PTR, 
             IARG_ADDRINT, (UINT32) INS_OperandImmediate(ins, 1),
             IARG_END);
   }
   UINT32 memOperands = INS_MemoryOperandCount(ins);
   for (UINT32 memOp = 0; memOp < memOperands; memOp++)
   {
      if (INS_MemoryOperandIsRead(ins, memOp))
      {
     INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)taint_check,
            IARG_INST_PTR,
            IARG_MEMORYOP_EA, memOp,
            IARG_MEMORYREAD_SIZE,
            IARG_END);
      }
      if (INS_MemoryOperandIsWritten(ins, memOp))
      {
     INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)taint_define,
            IARG_MEMORYOP_EA, memOp,
            IARG_MEMORYWRITE_SIZE,
            IARG_END);
      }
   }
}

回调函数如下所示：

// Taint this address as written
void taint_define(ADDRINT addr, UINT32 size)
{
   // Debug purpose
   TraceFile << "taint_define: " << addr << ", " << size << endl;
   // taint the addresses as defined, pretty slow, but easiest to implement
   for (UINT32 i = 0; i < size; i++) 
   {
      //TraceFile << "taint_define_loop size: " << size << endl;
      UINT32 *t = taint_get(addr + i);
      TraceFile << "after taint_get" << endl;
      UINT32 index = (addr + i) % 0x20000;
      // define this bit
      t[index / 32] |= 1 << (index % 32);
   }
}

inline UINT32* taint_get(ADDRINT addr)
{
   // Debug purpose
   TraceFile << "taint_get: " << addr;
   // allocate memory to taint these memory pages
   if(taint[addr / 0x20000] == NULL) {
      // we need an 16kb page to track 128k of memory
      /*
        taint[addr / 0x20000] = (UINT32 *) W::VirtualAlloc(NULL, 0x20000 / 8,
    MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
      */
      taint[addr / 0x20000] = (UINT32*)malloc(0x20000/8);
   }
   return taint[addr / 0x20000];
}

输出如下所示：

C:Tool (or Pin) caused signal 11 at PC 0x7fcf475e08a4
segmentation fault (core dumped)

日志在这里。

Watched Image count: 0x1
WatchedImage: unread_3vars
Uninit_Image
Uninit_Image
Thread start
taint_define: 0x7fff06930d58, 0x8

我目前正在研究Fedora核心17 x86-64，gcc 4.7.2和Pin 2.12-58423。
而且，我的密码附在这里