public inbox for gdb-patches@sourceware.org
 help / color / mirror / Atom feed
* [PATCH 1/1] gdb: Fix segfault with a negative .dynamic section size
@ 2023-11-10  9:16 Felix Willgerodt
  2023-11-10 19:00 ` Keith Seitz
  2023-11-13 17:16 ` Tom Tromey
  0 siblings, 2 replies; 10+ messages in thread
From: Felix Willgerodt @ 2023-11-10  9:16 UTC (permalink / raw)
  To: gdb-patches

Consider a binary with an erroneous size of the .dynamic section:

$ readelf a.out
...
  [24] .dynamic          DYNAMIC          0000000000004c20  00003c20
       000000fffffffa40  0000000000000010  WA       7     0     8
...

This binary causes a segfault in GDB, because we pass a negative
value to alloca in gdb_bfd_scan_elf_dyntag.  Alloca accepts size_t though,
so it is really a big size that we pass.  I changed the code to heap
allocation, as the size of the .dynamic section could be "too big" in a
correct binary as well.  That way GDB will assert on a negative size value.

There should be no user visible change after this.
---
 gdb/solib.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gdb/solib.c b/gdb/solib.c
index b9fb911a810..45a5309d199 100644
--- a/gdb/solib.c
+++ b/gdb/solib.c
@@ -1546,7 +1546,8 @@ gdb_bfd_scan_elf_dyntag (const int desired_dyntag, bfd *abfd, CORE_ADDR *ptr,
   /* Read in .dynamic from the BFD.  We will get the actual value
      from memory later.  */
   sect_size = bfd_section_size (sect);
-  buf = bufstart = (gdb_byte *) alloca (sect_size);
+  gdb::byte_vector buffer (sect_size);
+  buf = bufstart = buffer.data ();
   if (!bfd_get_section_contents (abfd, sect,
 				 buf, 0, sect_size))
     return 0;
-- 
2.34.1

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de <http://www.intel.de>
Managing Directors: Christin Eisenschmid, Sharon Heck, Tiffany Doon Silva  
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2023-11-15 14:52 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-11-10  9:16 [PATCH 1/1] gdb: Fix segfault with a negative .dynamic section size Felix Willgerodt
2023-11-10 19:00 ` Keith Seitz
2023-11-13  9:58   ` Willgerodt, Felix
2023-11-13 17:15     ` Tom Tromey
2023-11-14 15:41       ` Willgerodt, Felix
2023-11-14 16:29         ` Tom Tromey
2023-11-15  8:51           ` Willgerodt, Felix
2023-11-15 14:52             ` Tom Tromey
2023-11-13 15:59   ` Willgerodt, Felix
2023-11-13 17:16 ` Tom Tromey

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).