[Bug gdb/30175] New: stack smashing detected

[Bug gdb/30175] New: stack smashing detected

[orgads at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30175

            Bug ID: 30175
           Summary: stack smashing detected
           Product: gdb
           Version: 13.1
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: orgads at gmail dot com
  Target Milestone: ---

I'm using gdb-multiarch on msys2/mingw32 (i686 host).

When I open a core dump, GDB crashes with "stack smashing detected" error
message.

With x86_64 build (mingw64), it runs fine.

My commands:
set sysroot C:/sysroot/linux
set osabi GNU/Linux
-file-exec-file "C:/Users/orgads/AppData/Local/Temp/Core/app"
-file-symbol-file "C:/Users/orgads/AppData/Local/Temp/Core/app"
target core C:/Users/orgads/AppData/Local/Temp/Core/core


Last words:
=library-loaded,id="/lib64/libresolv.so.2",target-name="/lib64/libresolv.so.2",host-name="C:/sysroot/linux/lib64/libresolv.so.2",symbols-loaded="0",thread-group="i1",ranges=[{from="0x00007f8393775d00",to="0x00007f8393781dbe"}]
=library-loaded,id="/lib64/libselinux.so.1",target-name="/lib64/libselinux.so.1",host-name="C:/sysroot/linux/lib64/libselinux.so.1",symbols-loaded="0",thread-group="i1",ranges=[{from="0x00007f839354eaa0",to="0x00007f83935668ff"}]
=library-loaded,id="/lib64/libpcre2-8.so.0",target-name="/lib64/libpcre2-8.so.0",host-name="C:/sysroot/linux/lib64/libpcre2-8.so.0",symbols-loaded="0",thread-group="i1",ranges=[{from="0x00007f83932c5380",to="0x00007f8393320933"}]
*** stack smashing detected ***: terminated

Looks like the next library it loads is libz.so.1

Full Backtrace:
Thread 1 (Thread 9876.0x5864):
#0  0x00e3f336 in bfd_check_format_matches (abfd=abfd@entry=0x1b5abae0,
format=format@entry=bfd_object, matching=matching@entry=0x0) at
../../gdb-13.1/bfd/format.c:365
        high_water = <optimized out>
        target = 0x1ea26e4 <_bfd_target_vector+548>
        matching_vector = 0x1cc05668
        save_targ = 0x1ea4540 <i386_pe_vec>
        right_targ = 0x1ec5120 <elf64_le_vec>
        ar_right_targ = <optimized out>
        match_targ = 0x1ec5120 <elf64_le_vec>
        match_count = <optimized out>
        best_count = 1
        best_match = 2
        ar_match_index = 260
        initial_section_id = 2591
        preserve = {marker = 0x4708c0c8, tdata = 0x0, flags = 32768, arch_info
= 0x1e9eb80 <bfd_default_arch_struct>, sections = 0x0, section_last = 0x0,
section_count = 0, section_id = 2591, section_htab = {table = 0x470940b0,
newfunc = 0xe43650 <bfd_section_hash_newfunc>, memory = 0x1b25a6c0, size = 13,
count = 0, entsize = 216, frozen = 0}, build_id = 0x0, cleanup = 0x0}
        preserve_match = {marker = 0x47098558, tdata = 0x4708c0d0, flags =
33104, arch_info = 0x1e9eb80 <bfd_default_arch_struct>, sections = 0x470950c8,
section_last = 0x4709b530, section_count = 24, section_id = 2615, section_htab
= {table = 0x470e7070, newfunc = 0xe43650 <bfd_section_hash_newfunc>, memory =
0x1b25a3d8, size = 4051, count = 24, entsize = 216, frozen = 0}, build_id =
0x4708cf78, cleanup = 0xe40b10 <_bfd_void_bfd>}
        cleanup = 0x0
        orig_error_handler = 0x99e2a0 <gdb_bfd_error_handler(char const*,
va_list)>
        in_check_format = 1
        list = <optimized out>
        one = <optimized out>
#1  0x00e3fd3f in bfd_check_format (abfd=0x1b5abae0, format=bfd_object) at
../../gdb-13.1/bfd/format.c:94
No locals.
#2  0x00a891aa in find_separate_debug_file_in_section
(objfile=objfile@entry=0x1cf7f9d0) at ../../gdb-13.1/gdb/minidebug.c:288
        section = <optimized out>
        abfd = {m_obj = 0x1b5abae0}
        shared = <optimized out>
        filename = {_M_dataplus = {<std::allocator<char>> =
{<std::__new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p =
0x470742b0 ".gnu_debugdata for C:/sysroot/linux/lib64/libz.so.1"},
_M_string_length = 59, {_M_local_buf = ";\000\000\000rintf\000t.plt",
_M_allocated_capacity = 59}}
#3  0x00c5933a in read_symbols (objfile=objfile@entry=0x1cf7f9d0,
add_flags=..., add_flags@entry=...) at ../../gdb-13.1/gdb/symfile.c:782
        abfd = {m_obj = 0xc58d25 <symbol_file_add_with_addrs(gdb_bfd_ref_ptr
const&, char const*, symfile_add_flags, section_addr_info*, objfile_flags,
objfile*)+485>}
#4  0x00c58d2f in syms_from_objfile_1 (add_flags=..., addrs=0x5ef8b4,
objfile=<optimized out>) at ../../gdb-13.1/gdb/symfile.c:968
        local_addr = {<std::_Vector_base<other_sections,
std::allocator<other_sections> >> = {_M_impl =
{<std::allocator<other_sections>> = {<std::__new_allocator<other_sections>> =
{<No data fields>}, <No data fields>}, <std::_Vector_base<other_sections,
std::allocator<other_sections> >::_Vector_impl_data> = {_M_start = 0x0,
_M_finish = 0x0, _M_end_of_storage = 0x0}, <No data fields>}}, <No data
fields>}
        mainline = 0
        defer_clear_users = {{m_dummy = {<No data fields>}, m_item =
{<scope_exit_base<detail::forward_scope_exit<void(enum_flags<symfile_add_flag>),
clear_symtab_users, void(enum_flags<symfile_add_flag>)> >> = {m_released =
false}, m_bind_function = {<std::_Weak_result_type<void
(*)(enum_flags<symfile_add_flag>)>> = {<std::_Weak_result_type_memfun<void
(*)(enum_flags<symfile_add_flag>), false>> = {<std::_Weak_result_type_impl<void
(*)(enum_flags<symfile_add_flag>)>> = {<No data fields>}, <No data fields>},
<No data fields>}, _M_f = 0x0, _M_bound_args = {<std::_Tuple_impl<0,
enum_flags<symfile_add_flag> >> = {<std::_Head_base<0,
enum_flags<symfile_add_flag>, false>> = {_M_head_impl = {m_enum_value = 0}},
<No data fields>}, <No data fields>}}}, dont_use = 0 '\000'}, m_instantiated =
false}
        objfile_holder = <optimized out>
        local_addr = <optimized out>
        mainline = <optimized out>
        defer_clear_users = <optimized out>
        objfile_holder = <optimized out>
        __func__ = <optimized out>
        num_sections = <optimized out>
#5  syms_from_objfile (add_flags=..., addrs=0x5ef8b4, objfile=<optimized out>)
at ../../gdb-13.1/gdb/symfile.c:985
No locals.
#6  symbol_file_add_with_addrs (abfd=..., name=0x4451a348
"C:/sysroot/linux/lib64/libz.so.1", add_flags=..., addrs=0x5ef8b4, flags=...,
parent=0x0) at ../../gdb-13.1/gdb/symfile.c:1088
        objfile = <optimized out>
        from_tty = <optimized out>
        mainline = <optimized out>
        always_confirm = <optimized out>
        should_print = <optimized out>
#7  0x00c5a27b in symbol_file_add_from_bfd (abfd=..., name=<optimized out>,
name@entry=0x4451a348 "C:/sysroot/linux/lib64/libz.so.1", add_flags=...,
add_flags@entry=..., addrs=addrs@entry=0x5ef8b4, flags=flags@entry=...,
parent=parent@entry=0x0) at ../../gdb-13.1/gdb/symfile.c:1168
No locals.
#8  0x00c1b35e in solib_read_symbols (so=so@entry=0x4451a140,
flags=flags@entry=...) at ../../gdb-13.1/gdb/../gdbsupport/enum-flags.h:143
        sap = {<std::_Vector_base<other_sections,
std::allocator<other_sections> >> = {_M_impl =
{<std::allocator<other_sections>> = {<std::__new_allocator<other_sections>> =
{<No data fields>}, <No data fields>}, <std::_Vector_base<other_sections,
std::allocator<other_sections> >::_Vector_impl_data> = {_M_start = 0x41e3ea08,
_M_finish = 0x41e3edc8, _M_end_of_storage = 0x41e3ef08}, <No data fields>}},
<No data fields>}
        tmp_bfd = {m_obj = 0x19485a98}
#9  0x00c1cc6e in solib_add (pattern=pattern@entry=0x0,
from_tty=from_tty@entry=0, readsyms=1) at ../../gdb-13.1/gdb/solib.c:1041
        add_this_solib = 1
        gdb = 0x4451a140
        __for_range = <optimized out>
        __for_begin = <optimized out>
        __for_end = <optimized out>
        any_matches = true
        loaded_any_symbols = false
        add_flags = <optimized out>
#10 0x009f6501 in post_create_inferior (from_tty=from_tty@entry=1) at
../../gdb-13.1/gdb/infcmd.c:300
        solib_add_generation = 1
        restore_in_initial_library_scan = <optimized out>
        thr = <optimized out>
#11 0x008cbbef in core_target_open (arg=0x1ce2287c
"C:/Users/orgads/AppData/Local/Temp/Core/core", from_tty=1) at
../../gdb-13.1/gdb/corelow.c:573
        p = <optimized out>
        siggy = <optimized out>
        scratch_chan = <optimized out>
        flags = <optimized out>
        filename = {_M_t = {<std::__uniq_ptr_impl<char,
gdb::xfree_deleter<char> >> = {_M_t = {<std::_Tuple_impl<0, char*,
gdb::xfree_deleter<char> >> = {<std::_Tuple_impl<1, gdb::xfree_deleter<char> >>
= {<std::_Head_base<1, gdb::xfree_deleter<char>, true>> = {_M_head_impl = {<No
data fields>}}, <No data fields>}, <std::_Head_base<0, char*, false>> =
{_M_head_impl = 0x195b0c40 "C:/Users/orgads/AppData/Local/Temp/Core/core"}, <No
data fields>}, <No data fields>}}, <No data fields>}}
        temp_bfd = {m_obj = 0x0}
        target = 0x1daad0b8
        target_holder = {_M_t = {<std::__uniq_ptr_impl<target_ops,
target_ops_deleter>> = {_M_t = {<std::_Tuple_impl<0, target_ops*,
target_ops_deleter>> = {<std::_Tuple_impl<1, target_ops_deleter>> =
{<std::_Head_base<1, target_ops_deleter, true>> = {_M_head_impl = {<No data
fields>}}, <No data fields>}, <std::_Head_base<0, target_ops*, false>> =
{_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}, <No data fields>}}
        reg_sect = 0x46ee1690
#12 0x00c95397 in open_target (args=0x1ce2287c
"C:/Users/orgads/AppData/Local/Temp/Core/core", from_tty=1, command=0x19442cb0)
at ../../gdb-13.1/gdb/target.c:853
        ti = 0x15e7908 <core_target_info>
        func = 0x8cb920 <core_target_open(char const*, int)>
#13 0x008983a5 in cmd_func (cmd=cmd@entry=0x19442cb0,
args=args@entry=0x1ce2287c "C:/Users/orgads/AppData/Local/Temp/Core/core",
from_tty=from_tty@entry=1) at ../../gdb-13.1/gdb/cli/cli-decode.c:2543
        restore_suppress = <optimized out>
#14 0x00ca5c6f in execute_command (p=<optimized out>, p@entry=0x1ce22870
"target core C:/Users/orgads/AppData/Local/Temp/Core/core", from_tty=1) at
../../gdb-13.1/gdb/top.c:688
        default_args_and_arg = {_M_dataplus = {<std::allocator<char>> =
{<std::__new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p =
0x5efba0 ""}, _M_string_length = 0, {_M_local_buf =
"\000b���\374^\000\034\375^\000\304{\333w", _M_allocated_capacity =
3807470080}}
        without_whitespace = {_M_dataplus = {<std::allocator<char>> =
{<std::__new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p =
0x5efbb8 ""}, _M_string_length = 0, {_M_local_buf =
"\000\364��\034\b\000\000\000\000\000\000\000\066\000\022",
_M_allocated_capacity = 483390464}}
        cmd2 = 0x2 <error: Cannot access memory at address 0x2>
        cmd = 0x1ce2287c "C:/Users/orgads/AppData/Local/Temp/Core/core"
        arg = 0x1ce2287c "C:/Users/orgads/AppData/Local/Temp/Core/core"
        default_args = {_M_dataplus = {<std::allocator<char>> =
{<std::__new_allocator<char>> = {<No data fields>}, <No data fields>}, _M_p =
0x5efbd0 ""}, _M_string_length = 0, {_M_local_buf =
"\000\364��\034\000\000�\027���\034\374\373^", _M_allocated_capacity =
483390464}}
        was_sync = 0
        save_repeat_args = <optimized out>
        args_pointer = 0x1ce2287c
"C:/Users/orgads/AppData/Local/Temp/Core/core"
        c = 0x19442cb0
        line = <optimized out>
        cmd_start = 0x1ce22870 "target core
C:/Users/orgads/AppData/Local/Temp/Core/core"
        cleanup_if_error = <optimized out>
        cleanup = {m_value = 0x0}
        __func__ = "execute_command"
#15 0x0089c769 in safe_execute_command (from_tty=1, command=0x1ce22870 "target
core C:/Users/orgads/AppData/Local/Temp/Core/core", command_uiout=<optimized
out>) at ../../gdb-13.1/gdb/cli/cli-interp.c:354
        e = <optimized out>
        saved_uiout = <optimized out>
        e = <optimized out>
        saved_uiout = <optimized out>
        exception = <optimized out>
#16 cli_interp::exec (this=0x1946a368, command_str=0x1ce22870 "target core
C:/Users/orgads/AppData/Local/Temp/Core/core") at
../../gdb-13.1/gdb/cli/cli-interp.c:331
        old_stream = 0x1918e878
        result = {reason = 0, error = GDB_NO_ERROR, message =
{<std::__shared_ptr<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> >, (__gnu_cxx::_Lock_policy)2>> =
{<std::__shared_ptr_access<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >, (__gnu_cxx::_Lock_policy)2,
false, false>> = {<No data fields>}, _M_ptr = 0x0, _M_refcount = {_M_pi =
0x0}}, <No data fields>}}
#17 0x00a162a8 in interp_exec (interp=interp@entry=0x1946a368,
command_str=0x1ce22870 "target core
C:/Users/orgads/AppData/Local/Temp/Core/core") at
../../gdb-13.1/gdb/interps.c:344
        ui_interp = <optimized out>
        save_command_interp = <optimized out>
#18 0x00a77bec in mi_cmd_interpreter_exec (command=command@entry=0x163fb48
<mi_valid_noargs(char const*, int, char**)::opts+6808> "-interpreter-exec",
argv=argv@entry=0x5efd38, argc=argc@entry=2) at
../../gdb-13.1/gdb/mi/mi-interp.c:244
        e = {reason = 0, error = GDB_NO_ERROR, message =
{<std::__shared_ptr<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> >, (__gnu_cxx::_Lock_policy)2>> =
{<std::__shared_ptr_access<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >, (__gnu_cxx::_Lock_policy)2,
false, false>> = {<No data fields>}, _M_ptr = 0x0, _M_refcount = {_M_pi =
0x0}}, <No data fields>}}
        interp_to_use = 0x1946a368
        i = 1
        scope_exit_237 =
{<scope_exit_base<scope_exit<mi_cmd_interpreter_exec(char const*, char**,
int)::<lambda()> > >> = {m_released = false}, m_exit_function = {<No data
fields>}}
#19 0x00a80bdf in captured_mi_execute_command (context=0x1b29f350,
uiout=0x1948ea38) at ../../gdb-13.1/gdb/mi/mi-main.c:1855
        argv = {0x163fb40 <mi_valid_noargs(char const*, int,
char**)::opts+6800> "console", 0x1ce22870 "target core
C:/Users/orgads/AppData/Local/Temp/Core/core"}
        mi = 0x1948f440
        save_token = <optimized out>
        mi = <optimized out>
        save_token = <optimized out>
        argv = <optimized out>
#20 mi_execute_command (cmd=0x46d747f8 "target core
C:/Users/orgads/AppData/Local/Temp/Core/core", from_tty=1) at
../../gdb-13.1/gdb/mi/mi-main.c:1941
        token = 0x1b29b520 ""
        command = {_M_t = {<std::__uniq_ptr_impl<mi_parse,
std::default_delete<mi_parse> >> = {_M_t = {<std::_Tuple_impl<0, mi_parse*,
std::default_delete<mi_parse> >> = {<std::_Tuple_impl<1,
std::default_delete<mi_parse> >> = {<std::_Head_base<1,
std::default_delete<mi_parse>, true>> = {_M_head_impl = {<No data fields>}},
<No data fields>}, <std::_Head_base<0, mi_parse*, false>> = {_M_head_impl =
0x1b29f350}, <No data fields>}, <No data fields>}}, <No data fields>}}
#21 0x00a7519c in mi_execute_command_wrapper (cmd=<optimized out>) at
../../gdb-13.1/gdb/mi/mi-interp.c:281
        ui = 0x190b9308
        ui = <optimized out>
#22 mi_execute_command_input_handler (cmd=...) at
../../gdb-13.1/gdb/mi/mi-interp.c:310
        mi = 0x1948f440
        ui = 0x190b9308
#23 0x009688d5 in gdb_readline_no_editing_callback (client_data=0x190b9308) at
../../gdb-13.1/gdb/event-top.c:917
        c = <optimized out>
        result = <optimized out>
        line_buffer = {buffer = 0x0, buffer_size = 0, used_size = 0}
        ui = 0x190b9308
        stream = <optimized out>
        __func__ = "gdb_readline_no_editing_callback"
#24 0x00968bf0 in stdin_event_handler (error=0, client_data=0x190b9308) at
../../gdb-13.1/gdb/event-top.c:541
        ui = 0x190b9308
#25 0x0125fe69 in handle_file_event (ready_mask=<optimized out>,
file_ptr=<optimized out>) at ../../gdb-13.1/gdbsupport/event-loop.cc:573
        mask = <optimized out>
        mask = <optimized out>
        __func__ = <optimized out>
#26 gdb_wait_for_event (block=block@entry=0) at
../../gdb-13.1/gdbsupport/event-loop.cc:716
        mask = <optimized out>
        file_ptr = 0x1951c8f8
        num_found = <optimized out>
#27 0x01260756 in gdb_wait_for_event (block=0) at
../../gdb-13.1/gdbsupport/event-loop.cc:593
        file_ptr = <optimized out>
        num_found = 0
        select_timeout = <optimized out>
        timeout_p = <optimized out>
        mask = <optimized out>
#28 gdb_do_one_event (mstimeout=mstimeout@entry=-1) at
../../gdb-13.1/gdbsupport/event-loop.cc:217
        res = <optimized out>
        event_source_head = 1
        number_of_sources = 3
        current = <optimized out>
        timer_id = {{m_dummy = {<No data fields>}, m_item = 0, dont_use = 0
'\000'}, m_instantiated = false}
        scope_exit_251 = <optimized out>
#29 0x00a5872c in start_event_loop () at ../../gdb-13.1/gdb/main.c:411
        result = 0
#30 captured_command_loop () at ../../gdb-13.1/gdb/main.c:471
        ui = 0x190b9308
#31 0x00a5a635 in captured_main (data=0x5efec4) at
../../gdb-13.1/gdb/main.c:1330
        context = 0x5efec4
        context = <optimized out>
        ex = <optimized out>
#32 gdb_main (args=args@entry=0x5efec4) at ../../gdb-13.1/gdb/main.c:1345
No locals.
#33 0x0139f100 in main (argc=3, argv=0x17a14d78) at ../../gdb-13.1/gdb/gdb.c:32
        args = {argc = 3, argv = 0x17a14d78, interpreter_p = 0x158a044
"console"}

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30175] stack smashing detected

[tromey at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30175

Tom Tromey <tromey at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tromey at sourceware dot org

--- Comment #1 from Tom Tromey <tromey at sourceware dot org> ---
It's hard to know what the problem is without more info.
It might depend on the particular files.

I don't remember any fixes in this area, but maybe if you
could try git gdb it would help.

-- 
You are receiving this mail because:
You are on the CC list for the bug.