* [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size
@ 2023-02-06 13:06 thaines.astro at gmail dot com
2023-02-15 20:18 ` [Bug libdw/30085] " mark at klomp dot org
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: thaines.astro at gmail dot com @ 2023-02-06 13:06 UTC (permalink / raw)
To: elfutils-devel
https://sourceware.org/bugzilla/show_bug.cgi?id=30085
Bug ID: 30085
Summary: Negative strides in dwarf_aggregate_size
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: libdw
Assignee: unassigned at sourceware dot org
Reporter: thaines.astro at gmail dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
In section 5.13 of DWARF5, the standard says
Note that the stride can be negative
I don't see anywhere in the standard besides this footnote that indicates it
should be a signed value.
In the array_size helper, the stride is calculated as
Dwarf_Word stride = eltsize;
if (INTUSE(dwarf_attr_integrate)(die, DW_AT_byte_stride, attr_mem) != NULL) {
if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
return -1;
} else if (INTUSE(dwarf_attr_integrate)(die, DW_AT_bit_stride, attr_mem) !=
NULL) {
if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
return -1;
if (stride % 8) /* XXX maybe compute in bits? */
return -1;
stride /= 8;
}
Since we could be reading a negative integer, the use of dwarf_formudata would
cause the total size to be incorrect.
I don't have a reproducer, and I've not seen any binaries that have run across
this. I just noticed it while reading through the source.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread* [Bug libdw/30085] Negative strides in dwarf_aggregate_size
2023-02-06 13:06 [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size thaines.astro at gmail dot com
@ 2023-02-15 20:18 ` mark at klomp dot org
2023-02-21 16:03 ` mark at klomp dot org
2023-02-21 16:43 ` thaines.astro at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: mark at klomp dot org @ 2023-02-15 20:18 UTC (permalink / raw)
To: elfutils-devel
https://sourceware.org/bugzilla/show_bug.cgi?id=30085
Mark Wielaard <mark at klomp dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mark at klomp dot org
--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
I have to admit that I don't understand what it means for a stride to be
negative. It looks to me that a stride is like a size, it has to be positive.
It would be good to have an example when the stride can be negative.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread* [Bug libdw/30085] Negative strides in dwarf_aggregate_size
2023-02-06 13:06 [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size thaines.astro at gmail dot com
2023-02-15 20:18 ` [Bug libdw/30085] " mark at klomp dot org
@ 2023-02-21 16:03 ` mark at klomp dot org
2023-02-21 16:43 ` thaines.astro at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: mark at klomp dot org @ 2023-02-21 16:03 UTC (permalink / raw)
To: elfutils-devel
https://sourceware.org/bugzilla/show_bug.cgi?id=30085
--- Comment #2 from Mark Wielaard <mark at klomp dot org> ---
I asked around and John DelSignore came up with the following fortran example:
= array.f95 =
program f_prog
integer*4, allocatable, target, dimension (:,:) :: big_array
integer, dimension (:,:), pointer :: neg_array
allocate (big_array(2000,1000))
neg_array => big_array(2000:1:-1,1000:1:-1)
end program f_prog
So, neg_array is a pointer to an array section where the elements of big_array
are reversed. That is, neg_array(x,y) references big_array(2000-x+1,1000-y+1).
In this example, the stride makes us go "backwards" into the array.
But note that gfortran -g array.f95 produces DW_FORM_exprlocs for the
DW_AT_byte_stride because almost all attributes of the array are dynamic at
runtime:
[ c9] array_type abbrev: 10
ordering (data1) col_major (1)
data_location (exprloc)
[ 0] push_object_address
[ 1] deref
allocated (exprloc)
[ 0] push_object_address
[ 1] deref
[ 2] lit0
[ 3] ne
type (ref4) [ 72]
sibling (ref4) [ 106]
[ db] subrange_type abbrev: 1
lower_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 48
[ 3] deref
upper_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 56
[ 3] deref
byte_stride (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 40
[ 3] deref
[ 4] push_object_address
[ 5] plus_uconst 32
[ 7] deref
[ 8] mul
[ f0] subrange_type abbrev: 1
lower_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 72
[ 3] deref
upper_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 80
[ 3] deref
byte_stride (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 64
[ 3] deref
[ 4] push_object_address
[ 5] plus_uconst 32
[ 7] deref
[ 8] mul
[ 106] array_type abbrev: 11
ordering (data1) col_major (1)
data_location (exprloc)
[ 0] push_object_address
[ 1] deref
associated (exprloc)
[ 0] push_object_address
[ 1] deref
[ 2] lit0
[ 3] ne
type (ref4) [ 72]
[ 114] subrange_type abbrev: 1
lower_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 48
[ 3] deref
upper_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 56
[ 3] deref
byte_stride (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 40
[ 3] deref
[ 4] push_object_address
[ 5] plus_uconst 32
[ 7] deref
[ 8] mul
[ 129] subrange_type abbrev: 1
lower_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 72
[ 3] deref
upper_bound (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 80
[ 3] deref
byte_stride (exprloc)
[ 0] push_object_address
[ 1] plus_uconst 64
[ 3] deref
[ 4] push_object_address
[ 5] plus_uconst 32
[ 7] deref
[ 8] mul
Something dwarf_aggregate_size doesn't handle. And even if it could handle the
expression, it doesn't know the object address or how to deref memory...
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread* [Bug libdw/30085] Negative strides in dwarf_aggregate_size
2023-02-06 13:06 [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size thaines.astro at gmail dot com
2023-02-15 20:18 ` [Bug libdw/30085] " mark at klomp dot org
2023-02-21 16:03 ` mark at klomp dot org
@ 2023-02-21 16:43 ` thaines.astro at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: thaines.astro at gmail dot com @ 2023-02-21 16:43 UTC (permalink / raw)
To: elfutils-devel
https://sourceware.org/bugzilla/show_bug.cgi?id=30085
--- Comment #3 from Tim Haines <thaines.astro at gmail dot com> ---
I was actually trying to make a Fortran example, but couldn't get one to work!
Glad John was able to make one.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-02-21 16:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-06 13:06 [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size thaines.astro at gmail dot com
2023-02-15 20:18 ` [Bug libdw/30085] " mark at klomp dot org
2023-02-21 16:03 ` mark at klomp dot org
2023-02-21 16:43 ` thaines.astro at gmail dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).