From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2a07:de40:b251:101:10:150:64:2]) by sourceware.org (Postfix) with ESMTPS id C79B0384640D for ; Fri, 5 Apr 2024 15:10:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org C79B0384640D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org C79B0384640D Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2a07:de40:b251:101:10:150:64:2 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712329811; cv=none; b=W+sL3j+jUUq7pqHeZqGniodZjb6kgpSfVtHH18S1NjRTDa1nVczOtQ2jsYAZhXKTB+lxIYBiDd0wdjqn/bQ095pRg3eIDcLLfA4YOnCaAPhKRSRbzzKfl17g0566w4+zVPyizaLm4izAe2rvQUnkeISYpTJRi3Uo7nwwHTSzEeg= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712329811; c=relaxed/simple; bh=KBCtHBNg2ll7STIwaSrB3mcwPM5ljXOK6yhOISaLbq0=; h=DKIM-Signature:DKIM-Signature:DKIM-Signature:DKIM-Signature:From: To:Subject:Date:Message-Id:MIME-Version; b=JrgyDt+UuuoBt7zBI22ZaLN8BbROWnZQ+w7UY1a4/TiHihU+2prylS/SfKbs42AbB/LfQDzpunmYy9z4DzIxcKv9IHtf6a0izmFLKfBPY53eViHCN9z4o7ajAYPzUMLBOoJ8YbyoyYXEakDdRopPz6/6uMdJwGxAfsCWCm6Hlmc= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from imap2.dmz-prg2.suse.org (imap2.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 7C8711F7DD for ; Fri, 5 Apr 2024 15:10:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1712329807; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=szzdqs63x+HJIR4ssfRaIegaFkBezdaIo4qZm0RuiE4=; b=jrp20OroPnIWVjiIJC7QpZ7PYDrVNFMSUfEgKyFasKOJGhWzPoq28xKDRhSv+/DB8DvD1s gx71ws7kCLBcTfuFRSmvy3+c+IS83l+lY1VszWlRni0Osc4aJ3oN2opcdzJ5bp6fN9bMXw EjUAmj+1jabheTHCemE/zjvjdiHZxJ4= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1712329807; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=szzdqs63x+HJIR4ssfRaIegaFkBezdaIo4qZm0RuiE4=; b=VAOM8mrWIeMT84lqUK4Ps2FxxZHGKswb3ZNmxFa6xmhyiUqYBDvevcnUFnt/JUzjBSDw+N HoZnlPH3m2oQXoBA== Authentication-Results: smtp-out2.suse.de; dkim=pass header.d=suse.de header.s=susede2_rsa header.b=NbpJoowU; dkim=pass header.d=suse.de header.s=susede2_ed25519 header.b=NWckYuaN DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1712329806; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=szzdqs63x+HJIR4ssfRaIegaFkBezdaIo4qZm0RuiE4=; b=NbpJoowU5MWyXcdC3aEh4hRU3OP7XDSuwO4dxCvepSRCju0nXiG9HGHjOoIbAZSslbExAD LSGn2zjzoHivGNuIgT3wjtPJX91wMmmE53ndvjVj+97gVvNKydAjdvKLgIDODFU2p3xy6S VC9yertrNNnbdKOB/w6HI5qK68D4pd0= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1712329806; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=szzdqs63x+HJIR4ssfRaIegaFkBezdaIo4qZm0RuiE4=; b=NWckYuaNyqVc159DKFiuLGvXGgg+b64SVJ3B5IaXFQOkfdX00+Hg41YPQNcLwIHn0sETwP 85pnLZDQMJoWKdCA== Received: from imap2.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap2.dmz-prg2.suse.org (Postfix) with ESMTPS id 66339139F1 for ; Fri, 5 Apr 2024 15:10:06 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap2.dmz-prg2.suse.org with ESMTPSA id glOVF04UEGYFUwAAn2gu4w (envelope-from ) for ; Fri, 05 Apr 2024 15:10:06 +0000 From: Tom de Vries To: gdb-patches@sourceware.org Subject: [PATCH v3 1/2] [gdb/symtab] Fix an out of bounds array access in find_epilogue_using_linetable Date: Fri, 5 Apr 2024 17:10:11 +0200 Message-Id: <20240405151012.14763-1-tdevries@suse.de> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Level: X-Spamd-Result: default: False [-3.01 / 50.00]; BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM_LONG(-1.00)[-1.000]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; R_DKIM_ALLOW(-0.20)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.01)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; MIME_TRACE(0.00)[0:+]; FROM_HAS_DN(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[gdb-patches@sourceware.org]; RCVD_TLS_ALL(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[hotmail.de:email,imap2.dmz-prg2.suse.org:helo,imap2.dmz-prg2.suse.org:rdns,suse.de:dkim,suse.de:email,sourceware.org:url]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; FUZZY_BLOCKED(0.00)[rspamd.com]; TO_DN_NONE(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; SPAMHAUS_XBL(0.00)[2a07:de40:b281:104:10:150:64:98:from]; DKIM_TRACE(0.00)[suse.de:+] X-Rspamd-Action: no action X-Rspamd-Queue-Id: 7C8711F7DD X-Rspamd-Server: rspamd1.dmz-prg2.suse.org X-Spam-Score: -3.01 X-Spam-Status: No, score=-12.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: From: Bernd Edlinger An out of bounds array access in find_epilogue_using_linetable causes random test failures like these: FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: $fba_value == $fn_fba FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: check frame-id matches FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: bt 2 FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: up FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: $sp_value == $::main_sp FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: $fba_value == $::main_fba FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: [string equal $fid $::main_fid] Here the read happens below the first element of the line table, and the test failure depends on the value that is read from there. It also happens that std::lower_bound returns a pointer exactly at the upper bound of the line table, also here the read value is undefined, that happens in this test: FAIL: gdb.dwarf2/dw2-epilogue-begin.exp: confirm watchpoint doesn't trigger Fixes: 528b729be1a2 ("gdb/dwarf2: Add support for DW_LNS_set_epilogue_begin in line-table") Co-Authored-By: Tom de Vries PR symtab/31268 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31268 --- gdb/symtab.c | 85 +++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 75 insertions(+), 10 deletions(-) diff --git a/gdb/symtab.c b/gdb/symtab.c index 86603dfebc3..0c126d99cd4 100644 --- a/gdb/symtab.c +++ b/gdb/symtab.c @@ -4166,10 +4166,14 @@ find_epilogue_using_linetable (CORE_ADDR func_addr) = unrelocated_addr (end_pc - objfile->text_section_offset ()); const linetable *linetable = sal.symtab->linetable (); - /* This should find the last linetable entry of the current function. - It is probably where the epilogue begins, but since the DWARF 5 - spec doesn't guarantee it, we iterate backwards through the function - until we either find it or are sure that it doesn't exist. */ + if (linetable->nitems == 0) + { + /* Empty line table. */ + return {}; + } + + /* Find the first linetable entry after the current function. Note that + this also may be an end_sequence entry. */ auto it = std::lower_bound (linetable->item, linetable->item + linetable->nitems, unrel_end, [] (const linetable_entry <e, unrelocated_addr pc) @@ -4177,13 +4181,74 @@ find_epilogue_using_linetable (CORE_ADDR func_addr) return lte.unrelocated_pc () < pc; }); - while (it->unrelocated_pc () >= unrel_start) - { - if (it->epilogue_begin) - return {it->pc (objfile)}; - it --; - } + if (it == linetable->item + linetable->nitems) + { + /* We couldn't find either: + - a linetable entry starting the function after the current + function, or + - an end_sequence entry that terminates the current function + at unrel_end. + This can happen when the linetable doesn't describe the full + extent of the function. Even though this is a corner case, which + may not happen other than in dwarf assembly test-cases, let's + handle this. + + Move to the last entry in the linetable, and check that it's an + end_sequence terminating the current function. */ + gdb_assert (it != &linetable->item[0]); + it--; + if (!(it->line == 0 + && unrel_start <= it->unrelocated_pc () + && it->unrelocated_pc () < unrel_end)) + return {}; + } + else + gdb_assert (unrel_end <= it->unrelocated_pc ()); + + /* Move to the last linetable entry of the current function. */ + if (it == &linetable->item[0]) + { + /* Doing it-- would introduce undefined behaviour, avoid it by + explicitly handling this case. */ + return {}; + } + it--; + if (it->unrelocated_pc () < unrel_start) + { + /* Not in the current function. */ + return {}; + } + gdb_assert (it->unrelocated_pc () < unrel_end); + + /* We're at the the last linetable entry of the current function. This + is probably where the epilogue begins, but since the DWARF 5 spec + doesn't guarantee it, we iterate backwards through the current + function until we either find the epilogue beginning, or are sure + that it doesn't exist. */ + for (; it >= &linetable->item[0]; it--) + { + if (it->unrelocated_pc () < unrel_start) + { + /* No longer in the current function. */ + break; + } + + if (it->epilogue_begin) + { + /* Found the beginning of the epilogue. */ + return {it->pc (objfile)}; + } + + if (it == &linetable->item[0]) + { + /* No more entries in the current function. + Doing it-- would introduce undefined behaviour, avoid it by + explicitly handling this case. */ + break; + } + } } + return {}; } base-commit: c0419c024bf922128131671e40de0aed736e38ed -- 2.35.3