public inbox for gdb-prs@sourceware.org
help / color / mirror / Atom feed
* [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section
@ 2020-03-25 16:55 vries at gcc dot gnu.org
2020-03-25 17:04 ` [Bug gdb/25723] " vries at gcc dot gnu.org
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: vries at gcc dot gnu.org @ 2020-03-25 16:55 UTC (permalink / raw)
To: gdb-prs
https://sourceware.org/bugzilla/show_bug.cgi?id=25723
Bug ID: 25723
Summary: AddressSanitizer: heap-buffer-overflow in
fixup_section
Product: gdb
Version: HEAD
Status: NEW
Severity: normal
Priority: P2
Component: gdb
Assignee: unassigned at sourceware dot org
Reporter: vries at gcc dot gnu.org
Target Milestone: ---
[ Could be related to PR25479: "AddressSanitizer: heap-buffer-overflow in
lookup_minimal_symbol_by_pc_name" . Also there there's fixup_section in the
call stack. ]
When building gdb with -fsanitize=address and running
gdb.base/readline-ask.exp, I run into:
...
(gdb) PASS: gdb.base/readline-ask.exp: set height 3
p symbol_0=================================================================
==28590==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60b00009b970 at pc 0x000001457d33 bp 0x
7ffe906679c0 sp 0x7ffe906679b8
READ of size 8 at 0x60b00009b970 thread T0
#0 0x1457d32 in fixup_section(general_symbol_info*, unsigned long,
objfile*) /data/gdb_versions/devel/src/gdb/
symtab.c:1720
#1 0x14585cb in fixup_symbol_section(symbol*, objfile*)
/data/gdb_versions/devel/src/gdb/symtab.c:1778
#2 0xd484ca in var_decode_location
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:20507
#3 0xd49ce9 in new_symbol
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:20699
#4 0xd138fc in read_variable
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:13481
#5 0xcfc8dc in process_die
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:9924
#6 0xd0137a in read_file_scope
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:10826
#7 0xcfc347 in process_die
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:9837
#8 0xcfa9d5 in process_full_comp_unit
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:9594
#9 0xcf0b69 in process_queue
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:8881
#10 0xcc7679 in dw2_do_instantiate_symtab
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:2374
#11 0xcf0e17 in dwarf2_psymtab::expand_psymtab(objfile*)
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:8908
#12 0xcf0286 in dwarf2_psymtab::read_symtab(objfile*)
/data/gdb_versions/devel/src/gdb/dwarf2/read.c:8764
#13 0x12021fb in psymtab_to_symtab
/data/gdb_versions/devel/src/gdb/psymtab.c:768
#14 0x120612c in psym_expand_symtabs_matching
/data/gdb_versions/devel/src/gdb/psymtab.c:1351
#15 0x142f6eb in expand_symtabs_matching(gdb::function_view<bool (char
const*, bool)>, lookup_name_info const&
, gdb::function_view<bool (char const*)>, gdb::function_view<void
(compunit_symtab*)>, search_domain) /data/gdb_ve
rsions/devel/src/gdb/symfile.c:3788
#16 0x147739f in
default_collect_symbol_completion_matches_break_on(completion_tracker&,
complete_symbol_mode,
symbol_name_match_type, char const*, char const*, char const*, type_code)
/data/gdb_versions/devel/src/gdb/symtab
.c:5692
#17 0x14782b4 in
default_collect_symbol_completion_matches(completion_tracker&,
complete_symbol_mode, symbol_n
ame_match_type, char const*, char const*, type_code)
/data/gdb_versions/devel/src/gdb/symtab.c:5795
#18 0x1478343 in collect_symbol_completion_matches(completion_tracker&,
complete_symbol_mode, symbol_name_matc
h_type, char const*, char const*)
/data/gdb_versions/devel/src/gdb/symtab.c:5810
#19 0xb91c1e in complete_files_symbols
/data/gdb_versions/devel/src/gdb/completer.c:608
#20 0xb94b74 in complete_expression(completion_tracker&, char const*, char
const*) /data/gdb_versions/devel/sr
c/gdb/completer.c:1176
#21 0xb94ce7 in expression_completer(cmd_list_element*,
completion_tracker&, char const*, char const*) /data/g
db_versions/devel/src/gdb/completer.c:1188
#22 0x11d6052 in print_command_completer(cmd_list_element*,
completion_tracker&, char const*, char const*) /da
ta/gdb_versions/devel/src/gdb/printcmd.c:1238
#23 0xb94ecd in complete_line_internal_normal_command
/data/gdb_versions/devel/src/gdb/completer.c:1306
#24 0xb95b49 in complete_line_internal_1
/data/gdb_versions/devel/src/gdb/completer.c:1531
#25 0xb95bf8 in complete_line_internal
/data/gdb_versions/devel/src/gdb/completer.c:1550
#26 0xb97f43 in gdb_completion_word_break_characters_throw
/data/gdb_versions/devel/src/gdb/completer.c:1996
#27 0xb98200 in gdb_completion_word_break_characters()
/data/gdb_versions/devel/src/gdb/completer.c:2034
#28 0x16e7e3f in _rl_find_completion_word
/data/gdb_versions/devel/src/readline/readline/complete.c:1076
#29 0x16ec93d in rl_complete_internal
/data/gdb_versions/devel/src/readline/readline/complete.c:2007
#30 0x16e5b35 in rl_complete
/data/gdb_versions/devel/src/readline/readline/complete.c:438
#31 0x16d1bf2 in _rl_dispatch_subseq
/data/gdb_versions/devel/src/readline/readline/readline.c:852
#32 0x16d17d0 in _rl_dispatch
/data/gdb_versions/devel/src/readline/readline/readline.c:798
#33 0x16d100e in readline_internal_char
/data/gdb_versions/devel/src/readline/readline/readline.c:632
#34 0x171e274 in rl_callback_read_char
/data/gdb_versions/devel/src/readline/readline/callback.c:262
#35 0xdddde0 in gdb_rl_callback_read_char_wrapper_noexcept
/data/gdb_versions/devel/src/gdb/event-top.c:176
#36 0xdddfc0 in gdb_rl_callback_read_char_wrapper
/data/gdb_versions/devel/src/gdb/event-top.c:193
#37 0xddf1c2 in stdin_event_handler(int, void*)
/data/gdb_versions/devel/src/gdb/event-top.c:515
#38 0xdd9456 in handle_file_event
/data/gdb_versions/devel/src/gdb/event-loop.c:701
#39 0xdd9d5e in gdb_wait_for_event
/data/gdb_versions/devel/src/gdb/event-loop.c:827
#40 0xdd7b41 in gdb_do_one_event()
/data/gdb_versions/devel/src/gdb/event-loop.c:313
#41 0xdd7be1 in start_event_loop()
/data/gdb_versions/devel/src/gdb/event-loop.c:337
#42 0x109bde5 in captured_command_loop
/data/gdb_versions/devel/src/gdb/main.c:360
#43 0x109f30b in captured_main /data/gdb_versions/devel/src/gdb/main.c:1198
#44 0x109f39b in gdb_main(captured_main_args*)
/data/gdb_versions/devel/src/gdb/main.c:1213
#45 0x8c288a in main /data/gdb_versions/devel/src/gdb/gdb.c:32
#46 0x7fd7d12cef89 in __libc_start_main (/lib64/libc.so.6+0x20f89)
#47 0x8c2699 in _start (/data/gdb_versions/devel/build/gdb/gdb+0x8c2699)
0x60b00009b970 is located 0 bytes to the right of 112-byte region
[0x60b00009b900,0x60b00009b970)
allocated by thread T0 here:
#0 0x7fd7d4238c20 in operator new(unsigned long)
(/usr/lib64/libasan.so.4+0xddc20)
#1 0xca0634 in __gnu_cxx::new_allocator<unsigned long>::allocate(unsigned
long, void const*) /usr/include/c++/
7/ext/new_allocator.h:111
#2 0xca05ab in std::allocator_traits<std::allocator<unsigned long>
>::allocate(std::allocator<unsigned long>&,
unsigned long) /usr/include/c++/7/bits/alloc_traits.h:436
#3 0xca0181 in std::_Vector_base<unsigned long, std::allocator<unsigned
long> >::_M_allocate(unsigned long) /u
sr/include/c++/7/bits/stl_vector.h:172
#4 0x1438292 in std::vector<unsigned long, std::allocator<unsigned long>
>::_M_default_append(unsigned long) /
usr/include/c++/7/bits/vector.tcc:571
#5 0x14349b0 in std::vector<unsigned long, std::allocator<unsigned long>
>::resize(unsigned long) /usr/include
/c++/7/bits/stl_vector.h:692
#6 0x141ca49 in default_symfile_offsets(objfile*,
std::vector<other_sections, std::allocator<other_sections> >
const&) /data/gdb_versions/devel/src/gdb/symfile.c:638
#7 0x141e53d in syms_from_objfile_1
/data/gdb_versions/devel/src/gdb/symfile.c:979
#8 0x141e735 in syms_from_objfile
/data/gdb_versions/devel/src/gdb/symfile.c:998
#9 0x141f353 in symbol_file_add_with_addrs
/data/gdb_versions/devel/src/gdb/symfile.c:1099
#10 0x14200c8 in symbol_file_add_from_bfd(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_s
ections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/data/gdb_versions/devel/src/gdb/s
ymfile.c:1181
#11 0x14201d7 in symbol_file_add(char const*, enum_flags<symfile_add_flag>,
std::vector<other_sections, std::a
llocator<other_sections> >*, enum_flags<objfile_flag>)
/data/gdb_versions/devel/src/gdb/symfile.c:1194
#12 0x14204e3 in symbol_file_add_main_1
/data/gdb_versions/devel/src/gdb/symfile.c:1217
#13 0x1422c1c in symbol_file_command(char const*, int)
/data/gdb_versions/devel/src/gdb/symfile.c:1661
#14 0xde6506 in file_command /data/gdb_versions/devel/src/gdb/exec.c:536
#15 0xaf9725 in do_const_cfunc
/data/gdb_versions/devel/src/gdb/cli/cli-decode.c:107
#16 0xb01361 in cmd_func(cmd_list_element*, char const*, int)
/data/gdb_versions/devel/src/gdb/cli/cli-decode.
c:1952
#17 0x1527385 in execute_command(char const*, int)
/data/gdb_versions/devel/src/gdb/top.c:655
#18 0xddf604 in command_handler(char const*)
/data/gdb_versions/devel/src/gdb/event-top.c:587
#19 0xddff12 in command_line_handler(std::unique_ptr<char,
gdb::xfree_deleter<char> >&&) /data/gdb_versions/de
vel/src/gdb/event-top.c:772
#20 0xdde235 in gdb_rl_callback_handler
/data/gdb_versions/devel/src/gdb/event-top.c:218
#21 0x171e465 in rl_callback_read_char
/data/gdb_versions/devel/src/readline/readline/callback.c:281
#22 0xdddde0 in gdb_rl_callback_read_char_wrapper_noexcept
/data/gdb_versions/devel/src/gdb/event-top.c:176
#23 0xdddfc0 in gdb_rl_callback_read_char_wrapper
/data/gdb_versions/devel/src/gdb/event-top.c:193
#24 0xddf1c2 in stdin_event_handler(int, void*)
/data/gdb_versions/devel/src/gdb/event-top.c:515
#25 0xdd9456 in handle_file_event
/data/gdb_versions/devel/src/gdb/event-loop.c:701
#26 0xdd9d5e in gdb_wait_for_event
/data/gdb_versions/devel/src/gdb/event-loop.c:827
#27 0xdd7b41 in gdb_do_one_event()
/data/gdb_versions/devel/src/gdb/event-loop.c:313
#28 0xdd7be1 in start_event_loop()
/data/gdb_versions/devel/src/gdb/event-loop.c:337
#29 0x109bde5 in captured_command_loop
/data/gdb_versions/devel/src/gdb/main.c:360
SUMMARY: AddressSanitizer: heap-buffer-overflow
/data/gdb_versions/devel/src/gdb/symtab.c:1720 in fixup_section(ge
neral_symbol_info*, unsigned long, objfile*)
Shadow bytes around the buggy address:
0x0c168000b6d0: 00 00 00 00 00 00
fa fa fa fa fa fa fa f
a 00 00
0x0c168000b6e0: 00 00 00 00 00 00
00 00 00 00 00 fa fa fa
fa fa
0x0c168000b6f0: fa fa fa fa 00 00
00 00 00 00 00 00 00 00
00 00
0x0c168000b700: 00 fa fa fa fa fa
fa fa fa fa fd fd fd
fd fd fd
0x0c168000b710: fd fd fd fd fd fd
fd fd fa fa fa fa fa
mfa fa fa
=>0x0c168000b720: 00 00 00 00 00 00
00 00 00 00 00 00 00 00[
fa]fa
0x0c168000b730: fa fa fa fa fa fa
fd fd fd fd fd fd fd
fd fd fd
0x0c168000b740: fd fd fd fa fa fa
fa fa fa fa fa fa fd
fd fd fd
0x0c168000b750: fd fd fd fd fd fd
fd fd fd fd fa fa fa
fa fa fa
0x0c168000b760: fa fa 00 00 00 00
00 00 00 00 00 00 00 00
00 00
0x0c168000b770: fa fa fa fa fa fa
fa fa 00 00 00 00 00 0
0 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06
07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==28590==ABORTING
...
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug gdb/25723] AddressSanitizer: heap-buffer-overflow in fixup_section
2020-03-25 16:55 [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section vries at gcc dot gnu.org
@ 2020-03-25 17:04 ` vries at gcc dot gnu.org
2020-03-25 18:42 ` vries at gcc dot gnu.org
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: vries at gcc dot gnu.org @ 2020-03-25 17:04 UTC (permalink / raw)
To: gdb-prs
https://sourceware.org/bugzilla/show_bug.cgi?id=25723
--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
Also spotted with gdb.dwarf2/dw2-icc-opaque.exp.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug gdb/25723] AddressSanitizer: heap-buffer-overflow in fixup_section
2020-03-25 16:55 [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section vries at gcc dot gnu.org
2020-03-25 17:04 ` [Bug gdb/25723] " vries at gcc dot gnu.org
@ 2020-03-25 18:42 ` vries at gcc dot gnu.org
2020-03-25 18:43 ` vries at gcc dot gnu.org
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: vries at gcc dot gnu.org @ 2020-03-25 18:42 UTC (permalink / raw)
To: gdb-prs
https://sourceware.org/bugzilla/show_bug.cgi?id=25723
--- Comment #2 from Tom de Vries <vries at gcc dot gnu.org> ---
(In reply to Tom de Vries from comment #0)
> [ Could be related to PR25479: "AddressSanitizer: heap-buffer-overflow in
> lookup_minimal_symbol_by_pc_name" . Also there there's fixup_section in the
> call stack. ]
>
Both gdb.base/readline-ask.exp and gdb.dwarf2/dw2-icc-opaque.exp bisect to
commit 6a053cb1ff6, same as PR25479.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug gdb/25723] AddressSanitizer: heap-buffer-overflow in fixup_section
2020-03-25 16:55 [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section vries at gcc dot gnu.org
2020-03-25 17:04 ` [Bug gdb/25723] " vries at gcc dot gnu.org
2020-03-25 18:42 ` vries at gcc dot gnu.org
@ 2020-03-25 18:43 ` vries at gcc dot gnu.org
2022-06-29 13:12 ` vries at gcc dot gnu.org
2022-06-30 11:20 ` vries at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: vries at gcc dot gnu.org @ 2020-03-25 18:43 UTC (permalink / raw)
To: gdb-prs
https://sourceware.org/bugzilla/show_bug.cgi?id=25723
Tom de Vries <vries at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |tromey at sourceware dot org
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug gdb/25723] AddressSanitizer: heap-buffer-overflow in fixup_section
2020-03-25 16:55 [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section vries at gcc dot gnu.org
` (2 preceding siblings ...)
2020-03-25 18:43 ` vries at gcc dot gnu.org
@ 2022-06-29 13:12 ` vries at gcc dot gnu.org
2022-06-30 11:20 ` vries at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: vries at gcc dot gnu.org @ 2022-06-29 13:12 UTC (permalink / raw)
To: gdb-prs
https://sourceware.org/bugzilla/show_bug.cgi?id=25723
--- Comment #3 from Tom de Vries <vries at gcc dot gnu.org> ---
(In reply to Tom de Vries from comment #1)
> Also spotted with gdb.dwarf2/dw2-icc-opaque.exp.
Filed as PR29295.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug gdb/25723] AddressSanitizer: heap-buffer-overflow in fixup_section
2020-03-25 16:55 [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section vries at gcc dot gnu.org
` (3 preceding siblings ...)
2022-06-29 13:12 ` vries at gcc dot gnu.org
@ 2022-06-30 11:20 ` vries at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: vries at gcc dot gnu.org @ 2022-06-30 11:20 UTC (permalink / raw)
To: gdb-prs
https://sourceware.org/bugzilla/show_bug.cgi?id=25723
Tom de Vries <vries at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |DUPLICATE
Status|NEW |RESOLVED
--- Comment #4 from Tom de Vries <vries at gcc dot gnu.org> ---
Assert from PR 29295 also triggers for gdb.base/readline-ask.exp.
*** This bug has been marked as a duplicate of bug 29295 ***
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-06-30 11:20 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-25 16:55 [Bug gdb/25723] New: AddressSanitizer: heap-buffer-overflow in fixup_section vries at gcc dot gnu.org
2020-03-25 17:04 ` [Bug gdb/25723] " vries at gcc dot gnu.org
2020-03-25 18:42 ` vries at gcc dot gnu.org
2020-03-25 18:43 ` vries at gcc dot gnu.org
2022-06-29 13:12 ` vries at gcc dot gnu.org
2022-06-30 11:20 ` vries at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).