[PATCH] gdb/solib-svr4.c: Fix segfault caused by NULL pointer

[PATCH] gdb/solib-svr4.c: Fix segfault caused by NULL pointer

[Mikael Szreder]

Inside the function 'enable_break' there is a call to 'find_program_interpreter'.
This function returns an empty vector when an ELF file does not contain
an interpreter because the function 'read_program_header' header
returns an empty vector on failure.

The call to 'interp_name_holder->data()' then returns NULL for an empty vector.
This causes a segmentation fault down the line.
---
 gdb/solib-svr4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdb/solib-svr4.c b/gdb/solib-svr4.c
index 69f2991f5e6..18bd712e061 100644
--- a/gdb/solib-svr4.c
+++ b/gdb/solib-svr4.c
@@ -2204,7 +2204,7 @@ enable_break (struct svr4_info *info, int from_tty)
      into the old breakpoint at symbol code.  */
   gdb::optional<gdb::byte_vector> interp_name_holder
     = find_program_interpreter ();
-  if (interp_name_holder)
+  if (interp_name_holder && interp_name_holder->size() != 0)
     {
       const char *interp_name = (const char *) interp_name_holder->data ();
       CORE_ADDR load_addr = 0;
-- 
2.35.1

Re: [PATCH] gdb/solib-svr4.c: Fix segfault caused by NULL pointer

[Bruno Larsen]

Hi Mikael

Thanks for looking into this.

On 3/4/22 07:54, Mikael Szreder via Gdb-patches wrote:
> Inside the function 'enable_break' there is a call to 'find_program_interpreter'.
> This function returns an empty vector when an ELF file does not contain
> an interpreter because the function 'read_program_header' header
> returns an empty vector on failure.
> 
> The call to 'interp_name_holder->data()' then returns NULL for an empty vector.
> This causes a segmentation fault down the line.

I see that interp_name_holder is a gdb::optional type. This makes me wonder, is there a good reason for find_name_program to return an instantiated empty byte_vector, instead of returning a non-instantiated gdb::optional? I could be missing something, but to me it seems to make gdb::optional redundant.

I'd also ask that the title be changed to something like "gdb/solib-svr4.c: Fix segfault caused by NULL pointer in function enable_break", as the current name is a bit generic.

> ---
>   gdb/solib-svr4.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/gdb/solib-svr4.c b/gdb/solib-svr4.c
> index 69f2991f5e6..18bd712e061 100644
> --- a/gdb/solib-svr4.c
> +++ b/gdb/solib-svr4.c
> @@ -2204,7 +2204,7 @@ enable_break (struct svr4_info *info, int from_tty)
>        into the old breakpoint at symbol code.  */
>     gdb::optional<gdb::byte_vector> interp_name_holder
>       = find_program_interpreter ();
> -  if (interp_name_holder)
> +  if (interp_name_holder && interp_name_holder->size() != 0)
>       {
>         const char *interp_name = (const char *) interp_name_holder->data ();
>         CORE_ADDR load_addr = 0;


-- 
Cheers!
Bruno Larsen

Re: [PATCH] gdb/solib-svr4.c: Fix segfault caused by NULL pointer

[Tom Tromey]

>>>>> "Mikael" == Mikael Szreder via Gdb-patches <gdb-patches@sourceware.org> writes:

Mikael> Inside the function 'enable_break' there is a call to 'find_program_interpreter'.
Mikael> This function returns an empty vector when an ELF file does not contain
Mikael> an interpreter because the function 'read_program_header' header
Mikael> returns an empty vector on failure.

read_program_header also returns a gdb::optional, so it seems to me that
something else must be going on here.  Like, maybe the data that is read
from the target has 0 length?

I think the patch is basically ok, with one nit:

+  if (interp_name_holder && interp_name_holder->size() != 0)

... gdb style is a space before the "(".

However, I'd like to understand the underlying issue correctly first, so
at least the commit message can be updated -- or perhaps a test case added.

thanks,
Tom

Re: [PATCH] gdb/solib-svr4.c: Fix segfault caused by NULL pointer

[Pedro Alves]

On 2022-03-04 10:54, Mikael Szreder via Gdb-patches wrote:
> +  if (interp_name_holder && interp_name_holder->size() != 0)

It's preferred to write '!empty ()'  instead of 'size () != 0'.