From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2205) id 505E83858D38; Fri, 14 Oct 2022 19:23:11 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 505E83858D38 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1665775391; bh=XAq60HUroSPmJz8zSMi9TlnKuME10doUjCYqwqG1pm4=; h=From:To:Subject:Date:From; b=V1xqEEnVJymc+h1+NLhF0AZneSz6S+f62p+O/oDhdt4OYBkUMjCYNzdbkrTXcomnS +V4Et5EbkfwQyV1MAcZI+6jLJDjxo4NrJ1tQsINE4i6YbbV2UDu+V8hNwRsMc3rshV Zr1djeBZzT4XhKOufe+oHZYoa+fIk1E8w0DyWwiE= Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Tom de Vries To: gdb-cvs@sourceware.org Subject: [binutils-gdb] [gdb] Fix heap-buffer-overflow in find_program_interpreter X-Act-Checkin: binutils-gdb X-Git-Author: Tom de Vries X-Git-Refname: refs/heads/master X-Git-Oldrev: 7c635f3e61e014d713f7fc884215576187fda038 X-Git-Newrev: 8e94bb3e3a478544c0d8abfad8404af015f7130b Message-Id: <20221014192311.505E83858D38@sourceware.org> Date: Fri, 14 Oct 2022 19:23:11 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3D8e94bb3e3a47= 8544c0d8abfad8404af015f7130b commit 8e94bb3e3a478544c0d8abfad8404af015f7130b Author: Tom de Vries Date: Fri Oct 14 21:22:57 2022 +0200 [gdb] Fix heap-buffer-overflow in find_program_interpreter =20 With the test-case included in this patch, we run into: ... (gdb) target remote localhost:2347^M `target:twice-connect' has disappeared; keeping its symbols.^M Remote debugging using localhost:2347^M warning: Unable to find dynamic linker breakpoint function.^M GDB will be unable to debug shared library initializers^M and track explicitly loaded dynamic code.^M Reading /usr/lib/debug/.build-id/$hex/$hex.debug from remote target...^M 0x00007ffff7dd4550 in ?? ()^M (gdb) PASS: gdb.server/twice-connect.exp: session=3Dsecond: gdbserver s= tarted FAIL: gdb.server/twice-connect.exp: found interpreter ... =20 The problem originates in find_program_interpreter, where bfd_get_section_contents is called to read .interp, but fails. The fun= ction returns false but the result is ignored, so find_program_interpreter re= turns some random string. =20 Fix this by checking the result of the call to bfd_get_section_contents. =20 Tested on x86_64-linux. =20 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=3D29652 Diff: --- gdb/solib-svr4.c | 8 ++++-- gdb/testsuite/gdb.server/twice-connect.c | 22 ++++++++++++++ gdb/testsuite/gdb.server/twice-connect.exp | 46 ++++++++++++++++++++++++++= ++++ gdb/testsuite/lib/gdbserver-support.exp | 7 ++++- 4 files changed, 79 insertions(+), 4 deletions(-) diff --git a/gdb/solib-svr4.c b/gdb/solib-svr4.c index 27267e0bde9..7e83819a03d 100644 --- a/gdb/solib-svr4.c +++ b/gdb/solib-svr4.c @@ -568,9 +568,11 @@ find_program_interpreter (void) int sect_size =3D bfd_section_size (interp_sect); =20 gdb::byte_vector buf (sect_size); - bfd_get_section_contents (current_program_space->exec_bfd (), - interp_sect, buf.data (), 0, sect_size); - return buf; + bool res + =3D bfd_get_section_contents (current_program_space->exec_bfd (), + interp_sect, buf.data (), 0, sect_size); + if (res) + return buf; } } =20 diff --git a/gdb/testsuite/gdb.server/twice-connect.c b/gdb/testsuite/gdb.s= erver/twice-connect.c new file mode 100644 index 00000000000..6b3984dc7d2 --- /dev/null +++ b/gdb/testsuite/gdb.server/twice-connect.c @@ -0,0 +1,22 @@ +/* This testcase is part of GDB, the GNU debugger. + + Copyright 2022 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . = */ + +int +main (void) +{ + return 0; +} diff --git a/gdb/testsuite/gdb.server/twice-connect.exp b/gdb/testsuite/gdb= .server/twice-connect.exp new file mode 100644 index 00000000000..c892a0f80a9 --- /dev/null +++ b/gdb/testsuite/gdb.server/twice-connect.exp @@ -0,0 +1,46 @@ +# This testcase is part of GDB, the GNU debugger. + +# Copyright 2022 Free Software Foundation, Inc. + +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +load_lib gdbserver-support.exp + +standard_testfile + +if { [skip_gdbserver_tests] } { + return 0 +} + +if { [build_executable "failed to prepare" $::testfile $::srcfile \ + {debug}] } { + return -1 +} + +# Don't use $binfile arg, to make sure we use the remote file target:$binf= ile. +clean_restart + +# Start gdbserver, and connect to it, twice. +foreach_with_prefix session {first second} { + lassign [gdbserver_start "" "$binfile"] unused gdbserver_address + gdb_test "disconnect" + set res [gdb_target_cmd "remote" $gdbserver_address] + gdb_assert { $res =3D=3D 0 } "gdbserver started" +} + +# Verify that we're not running into this warning, which triggers if +# find_program_interpreter returns something invalid. +set warning "warning: Unable to find dynamic linker breakpoint function" +gdb_assert { [regexp $warning $gdb_target_remote_cmd_msg] =3D=3D 0 } \ + "found interpreter" diff --git a/gdb/testsuite/lib/gdbserver-support.exp b/gdb/testsuite/lib/gd= bserver-support.exp index 08e529fa985..3f2cec246fa 100644 --- a/gdb/testsuite/lib/gdbserver-support.exp +++ b/gdb/testsuite/lib/gdbserver-support.exp @@ -48,7 +48,7 @@ # the connection message in order for the procedure to succeed. # proc gdb_target_cmd_ext { targetname serialport {additional_text ""} } { - global gdb_prompt + global gdb_prompt gdb_target_remote_cmd_msg =20 set serialport_re [string_to_regexp $serialport] for {set i 1} {$i <=3D 3} {incr i} { @@ -73,22 +73,27 @@ proc gdb_target_cmd_ext { targetname serialport {additi= onal_text ""} } { } -re "Remote MIPS debugging.*$additional_text.*$gdb_prompt" { verbose "Set target to $targetname" + set gdb_target_remote_cmd_msg $expect_out(buffer) return 0 } -re "Remote debugging using .*$serialport_re.*$additional_text.*$gdb_= prompt $" { verbose "Set target to $targetname" + set gdb_target_remote_cmd_msg $expect_out(buffer) return 0 } -re "Remote debugging using stdio.*$additional_text.*$gdb_prompt $" { verbose "Set target to $targetname" + set gdb_target_remote_cmd_msg $expect_out(buffer) return 0 } -re "Remote target $targetname connected to.*$additional_text.*$gdb_p= rompt $" { verbose "Set target to $targetname" + set gdb_target_remote_cmd_msg $expect_out(buffer) return 0 } -re "Connected to.*$additional_text.*$gdb_prompt $" { verbose "Set target to $targetname" + set gdb_target_remote_cmd_msg $expect_out(buffer) return 0 } -re "Ending remote.*$gdb_prompt $" { }