From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 2CE913877034; Wed, 25 Mar 2020 17:02:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 2CE913877034 From: "vries at gcc dot gnu.org" To: gdb-prs@sourceware.org Subject: [Bug gdb/25724] New: AddressSanitizer: heap-buffer-overflow in sort_cmp Date: Wed, 25 Mar 2020 17:02:13 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gdb X-Bugzilla-Component: gdb X-Bugzilla-Version: HEAD X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: vries at gcc dot gnu.org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gdb-prs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gdb-prs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Mar 2020 17:02:14 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D25724 Bug ID: 25724 Summary: AddressSanitizer: heap-buffer-overflow in sort_cmp Product: gdb Version: HEAD Status: NEW Severity: normal Priority: P2 Component: gdb Assignee: unassigned at sourceware dot org Reporter: vries at gcc dot gnu.org Target Milestone: --- When building gdb with -fsanitizer=3Daddress and running gdb.base/symbol-without-target_section.exp, I run into: ... (gdb) PASS: gdb.base/symbol-without-target_section.exp: add-symbol-file list main =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D6232=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0x= 60b00009b970 at pc 0x000001189bc7 bp 0x7 ffe7eb5ca90 sp 0x7ffe7eb5ca88 READ of size 8 at 0x60b00009b970 thread T0 #0 0x1189bc6 in sort_cmp /data/gdb_versions/devel/src/gdb/objfiles.c:939 #1 0x1191950 in bool __gnu_cxx::__ops::_Iter_comp_iter::oper ator()(obj_section**, obj_section**) (/data/gdb_versions/devel/build/gdb/gdb+0x11919 50) #2 0x1191aa9 in obj_section** std::__unguarded_partition >(obj_section**, obj_section*= *, obj_section**, __gnu_cxx::__ops::_It er_comp_iter) (/data/gdb_versions/devel/build/gdb/gdb+0x1191aa9) #3 0x11912af in obj_section** std::__unguarded_partition_pivot >(obj_section**, obj_section**, __gnu_cxx::__ops::_Iter_comp_i ter) (/data/gdb_versions/devel/build/gdb/gdb+0x11912af) #4 0x1190f49 in void std::__introsort_loop >(obj_section**, obj_section**, long, __gnu_cxx::__ops::_Iter_comp_iter) (/data/gdb_versions/devel/build/gdb/gdb+0x1190f49) #5 0x1190b1b in void std::__sort >(obj_section**, obj_section**, __gnu_cxx::__ops::_Iter_comp_iter) /usr/include/c++/7/bits/stl_algo.h:1968 #6 0x118fe99 in void std::sort(obj_section**, obj_section**, bool (*)(obj_section const*, obj_section const*)) /usr/include/c++/7/bits/stl_algo.h:4868 #7 0x118c594 in update_section_map /data/gdb_versions/devel/src/gdb/objfiles.c:1202 #8 0x118cdc4 in find_pc_section(unsigned long) /data/gdb_versions/devel/src/gdb/objfiles.c:1249 #9 0x1142426 in lookup_minimal_symbol_by_pc_section(unsigned long, obj_section*, lookup_msym_prefer, bound_min imal_symbol*) /data/gdb_versions/devel/src/gdb/minsyms.c:698 #10 0x1143b34 in lookup_minimal_symbol_by_pc(unsigned long) /data/gdb_versions/devel/src/gdb/minsyms.c:934 #11 0x1462162 in find_pc_sect_line(unsigned long, obj_section*, int) /data/gdb_versions/devel/src/gdb/symtab.c :3130 #12 0x1465cd6 in find_function_start_sal_1 /data/gdb_versions/devel/src/gdb/symtab.c:3617 #13 0x146638b in find_function_start_sal(symbol*, bool) /data/gdb_versions/devel/src/gdb/symtab.c:3675 #14 0x1004288 in symbol_to_sal /data/gdb_versions/devel/src/gdb/linespec.c:4457 #15 0xff3396 in convert_linespec_to_sals /data/gdb_versions/devel/src/gdb/linespec.c:2314 #16 0xff5f99 in parse_linespec /data/gdb_versions/devel/src/gdb/linespec.c:2695 #17 0xff9196 in event_location_to_sals /data/gdb_versions/devel/src/gdb/linespec.c:3152 #18 0xffa02d in decode_line_1(event_location const*, int, program_space= *, symtab*, int) /data/gdb_versions/dev el/src/gdb/linespec.c:3282 #19 0xaeac97 in list_command /data/gdb_versions/devel/src/gdb/cli/cli-cmds.c:1189 #20 0xaf9725 in do_const_cfunc /data/gdb_versions/devel/src/gdb/cli/cli-decode.c:107 #21 0xb01361 in cmd_func(cmd_list_element*, char const*, int) /data/gdb_versions/devel/src/gdb/cli/cli-decode. c:1952 #22 0x1527385 in execute_command(char const*, int) /data/gdb_versions/devel/src/gdb/top.c:655 #23 0xddf604 in command_handler(char const*) /data/gdb_versions/devel/src/gdb/event-top.c:587 #24 0xddff12 in command_line_handler(std::unique_ptr >&&) /data/gdb_versions/de vel/src/gdb/event-top.c:772 #25 0xdde235 in gdb_rl_callback_handler /data/gdb_versions/devel/src/gdb/event-top.c:218 #26 0x171e465 in rl_callback_read_char /data/gdb_versions/devel/src/readline/readline/callback.c:281 #27 0xdddde0 in gdb_rl_callback_read_char_wrapper_noexcept /data/gdb_versions/devel/src/gdb/event-top.c:176 #28 0xdddfc0 in gdb_rl_callback_read_char_wrapper /data/gdb_versions/devel/src/gdb/event-top.c:193 #29 0xddf1c2 in stdin_event_handler(int, void*) /data/gdb_versions/devel/src/gdb/event-top.c:515 #30 0xdd9456 in handle_file_event /data/gdb_versions/devel/src/gdb/event-loop.c:701 #31 0xdd9d5e in gdb_wait_for_event /data/gdb_versions/devel/src/gdb/event-loop.c:827 #32 0xdd7b41 in gdb_do_one_event() /data/gdb_versions/devel/src/gdb/event-loop.c:313 #33 0xdd7be1 in start_event_loop() /data/gdb_versions/devel/src/gdb/event-loop.c:337 #34 0x109bde5 in captured_command_loop /data/gdb_versions/devel/src/gdb/main.c:360 #35 0x109f30b in captured_main /data/gdb_versions/devel/src/gdb/main.c:= 1198 #36 0x109f39b in gdb_main(captured_main_args*) /data/gdb_versions/devel/src/gdb/main.c:1213 #37 0x8c288a in main /data/gdb_versions/devel/src/gdb/gdb.c:32 #38 0x7fa17c0cff89 in __libc_start_main (/lib64/libc.so.6+0x20f89) #39 0x8c2699 in _start (/data/gdb_versions/devel/build/gdb/gdb+0x8c2699) 0x60b00009b970 is located 0 bytes to the right of 112-byte region [0x60b00009b900,0x60b00009b970) allocated by thread T0 here: #0 0x7fa17f039c20 in operator new(unsigned long) (/usr/lib64/libasan.so.4+0xddc20) #1 0xca0634 in __gnu_cxx::new_allocator::allocate(unsign= ed long, void const*) /usr/include/c++/ 7/ext/new_allocator.h:111 #2 0xca05ab in std::allocator_traits >::allocate(std::allocator&, unsigned long) /usr/include/c++/7/bits/alloc_traits.h:436 #3 0xca0181 in std::_Vector_base >::_M_allocate(unsigned long) /u sr/include/c++/7/bits/stl_vector.h:172 #4 0x1438292 in std::vector >::_M_default_append(unsigned long) / usr/include/c++/7/bits/vector.tcc:571 #5 0x14349b0 in std::vector >::resize(unsigned long) /usr/include /c++/7/bits/stl_vector.h:692 #6 0x141ca49 in default_symfile_offsets(objfile*, std::vector > const&) /data/gdb_versions/devel/src/gdb/symfile.c:638 #7 0x141e53d in syms_from_objfile_1 /data/gdb_versions/devel/src/gdb/symfile.c:979 #8 0x141e735 in syms_from_objfile /data/gdb_versions/devel/src/gdb/symfile.c:998 #9 0x141f353 in symbol_file_add_with_addrs /data/gdb_versions/devel/src/gdb/symfile.c:1099 #10 0x14200c8 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfi= le*) /data/gdb_versions/devel/src/gdb/s ymfile.c:1181 #11 0x14201d7 in symbol_file_add(char const*, enum_flags, std::vector >*, enum_flags) /data/gdb_versions/devel/src/gdb/symfile.c:1194 #12 0x14204e3 in symbol_file_add_main_1 /data/gdb_versions/devel/src/gdb/symfile.c:1217 #13 0x1422c1c in symbol_file_command(char const*, int) /data/gdb_versions/devel/src/gdb/symfile.c:1661 #14 0xde6506 in file_command /data/gdb_versions/devel/src/gdb/exec.c:536 #15 0xaf9725 in do_const_cfunc /data/gdb_versions/devel/src/gdb/cli/cli-decode.c:107 #16 0xb01361 in cmd_func(cmd_list_element*, char const*, int) /data/gdb_versions/devel/src/gdb/cli/cli-decode. c:1952 #17 0x1527385 in execute_command(char const*, int) /data/gdb_versions/devel/src/gdb/top.c:655 #18 0xddf604 in command_handler(char const*) /data/gdb_versions/devel/src/gdb/event-top.c:587 #19 0xddff12 in command_line_handler(std::unique_ptr >&&) /data/gdb_versions/de vel/src/gdb/event-top.c:772 #20 0xdde235 in gdb_rl_callback_handler /data/gdb_versions/devel/src/gdb/event-top.c:218 #21 0x171e465 in rl_callback_read_char /data/gdb_versions/devel/src/readline/readline/callback.c:281 #22 0xdddde0 in gdb_rl_callback_read_char_wrapper_noexcept /data/gdb_versions/devel/src/gdb/event-top.c:176 #23 0xdddfc0 in gdb_rl_callback_read_char_wrapper /data/gdb_versions/devel/src/gdb/event-top.c:193 #24 0xddf1c2 in stdin_event_handler(int, void*) /data/gdb_versions/devel/src/gdb/event-top.c:515 #25 0xdd9456 in handle_file_event /data/gdb_versions/devel/src/gdb/event-loop.c:701 #26 0xdd9d5e in gdb_wait_for_event /data/gdb_versions/devel/src/gdb/event-loop.c:827 #27 0xdd7b41 in gdb_do_one_event() /data/gdb_versions/devel/src/gdb/event-loop.c:313 #28 0xdd7be1 in start_event_loop() /data/gdb_versions/devel/src/gdb/event-loop.c:337 #29 0x109bde5 in captured_command_loop /data/gdb_versions/devel/src/gdb/main.c:360 SUMMARY: AddressSanitizer: heap-buffer-overflow /data/gdb_versions/devel/src/gdb/objfiles.c:939 in sort_cmp Shadow bytes around the buggy address: 0x0c168000b6d0: 00 00 00 00 00 00=20 fa fa fa fa fa fa fa f a 00 00 0x0c168000b6e0: 00 00 00 00 00 00=20 00 00 00 00 00 fa fa fa fa fa 0x0c168000b6f0: fa fa fa fa 00 00=20 00 00 00 00 00 00 00 00 00 00 0x0c168000b700: 00 fa fa fa fa fa=20 fa fa fa fa fd fd fd=20 fd fd fd 0x0c168000b710: fd fd fd fd fd fd=20 fd fd fa fa fa fa fa=20 fa fa fa =3D>0x0c168000b720: 00 00 00 00 00 00=20 00 00 00 00 00 00 00 00[ fa]fa 0x0c168000b730: fa fa fa fa fa fa=20 00 00 00 00 00 00 00 00 00 00 0x0c168000b740: 00 00 00 fa fa fa=20 fa fa fa fa fa fa fd=20 fd fd fd 0x0c168000b750: fd fd fd fd fd fd=20 fd fd fd fa fa fa fa=20 fa fa fa 0x0c168000b760: fa fa fd fd fd fd=20 fd fd fd fd fd fd fd=20 fd fd fd 0x0c168000b770: fa fa fa fa fa fa=20 fa fa 00 00 00 00 00 0 0 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07=20 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb =3D=3D6232=3D=3DABORTING ... --=20 You are receiving this mail because: You are on the CC list for the bug.=