Repository: pwndbg/pwndbg

Issue:
Freebins list gets truncated at the end
If the free bins list is too long, it is truncated at the end.

![issue](https://preview.ibb.co/c3qnBG/image.png)


Discussion:
Can you provide C code that can be used to reproduce this issue?

Also does `fastbins` command truncate it too? Maybe `bins` returns just a general look over all the bins not to bloat the display (?).
It's not truncated, that's just how the telescope code works.  If there
were somehow a loop, or just a really long chain, it'd take up too much
screen space.


*Zach Riggle*

On Fri, Oct 6, 2017 at 7:51 AM, Disconnect3d <notifications@github.com>
wrote:

> Can you provide C code that can be used to reproduce this issue?
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/pwndbg/pwndbg/issues/352#issuecomment-334745764>, or mute
> the thread
> <https://github.com/notifications/unsubscribe-auth/AAG0GBUn4QsGkDP41w50nSnd-uc9WQOWks5spiJhgaJpZM4Pvh65>
> .
>

Can a new command be added that'll allow me to traverse the chain for `n` block starting from `i`-th block? I'd say such long chains are not uncommon in real world applications (this is an instrumented version of GNU diffutils)

Resolving patch:
diff --git a/pwndbg/chain.py b/pwndbg/chain.py
--- a/pwndbg/chain.py
+++ b/pwndbg/chain.py
@@ -16,7 +16,7 @@
 import pwndbg.typeinfo
 import pwndbg.vmmap
 
-LIMIT = 5
+LIMIT = pwndbg.config.Parameter('dereference-limit', 5, 'max number of pointers to dereference in a chain')
 
 def get(address, limit=LIMIT, offset=0, hard_stop=None, hard_end=0):
     """
@@ -32,7 +32,8 @@ def get(address, limit=LIMIT, offset=0, hard_stop=None, hard_end=0):
     Returns:
         A list representing pointers of each ```address``` and reference
     """
-
+    limit = int(limit)+1
+    
     result = []
     for i in range(limit):
         # Don't follow cycles, except to stop at the second occurrence.
@@ -74,6 +75,7 @@ def format(value, limit=LIMIT, code=True, offset=0, hard_stop=None, hard_end=0):
         A string representing pointers of each address and reference
         Strings format: 0x0804a10 —▸ 0x08061000 ◂— 0x41414141
     """
+    limit = int(limit)+1
 
     # Allow results from get function to be passed to format
     if type(value) == list:
diff --git a/pwndbg/heap/__init__.py b/pwndbg/heap/__init__.py
--- a/pwndbg/heap/__init__.py
+++ b/pwndbg/heap/__init__.py
@@ -10,6 +10,8 @@
 
 current = None
 
+heap_chain_limit = pwndbg.config.Parameter('heap-dereference-limit', 8, 'number of bins to dereference')
+
 @pwndbg.events.new_objfile
 def update():
     import pwndbg.heap.dlmalloc
diff --git a/pwndbg/heap/ptmalloc.py b/pwndbg/heap/ptmalloc.py
--- a/pwndbg/heap/ptmalloc.py
+++ b/pwndbg/heap/ptmalloc.py
@@ -14,6 +14,7 @@
 from pwndbg.color import bold
 from pwndbg.color import red
 from pwndbg.constants import ptmalloc
+from pwndbg.heap import heap_chain_limit
 
 HEAP_MAX_SIZE     = 1024 * 1024
 
@@ -222,7 +223,7 @@ def fastbins(self, arena_addr=None):
         result = OrderedDict()
         for i in range(num_fastbins):
             size += pwndbg.arch.ptrsize * 2
-            chain = pwndbg.chain.get(int(fastbinsY[i]), offset=fd_offset)
+            chain = pwndbg.chain.get(int(fastbinsY[i]), offset=fd_offset, limit=heap_chain_limit)
 
             result[size] = chain
 
@@ -256,7 +257,7 @@ def bin_at(self, index, arena_addr=None):
         front, back = normal_bins[index * 2], normal_bins[index * 2 + 1]
         fd_offset   = self.chunk_key_offset('fd')
 
-        chain = pwndbg.chain.get(int(front), offset=fd_offset, hard_stop=current_base)
+        chain = pwndbg.chain.get(int(front), offset=fd_offset, hard_stop=current_base, limit=heap_chain_limit)
         return chain
 
 


Test patch: