public inbox for gdb-prs@sourceware.org
help / color / mirror / Atom feed
From: "sihan2021 at iscas dot ac.cn" <sourceware-bugzilla@sourceware.org>
To: gdb-prs@sourceware.org
Subject: [Bug gdb/30639] New: AddressSanitizer: dynamic-stack-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:1388:16 in ada_decode[abi:cxx11](char const*, bool, bool)
Date: Sat, 15 Jul 2023 06:26:30 +0000 [thread overview]
Message-ID: <bug-30639-4717@http.sourceware.org/bugzilla/> (raw)
https://sourceware.org/bugzilla/show_bug.cgi?id=30639
Bug ID: 30639
Summary: AddressSanitizer: dynamic-stack-buffer-overflow
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-
lang.c:1388:16 in ada_decode[abi:cxx11](char const*,
bool, bool)
Product: gdb
Version: 13.1
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: gdb
Assignee: unassigned at sourceware dot org
Reporter: sihan2021 at iscas dot ac.cn
Target Milestone: ---
Created attachment 14967
--> https://sourceware.org/bugzilla/attachment.cgi?id=14967&action=edit
crash seed
Hello GDB developers,
We recently conducted a fuzzing test on GDB and discovered a
dynamic-stack-buffer-overflow bug. We would like to provide a detailed
description of the bug and seek your assistance in addressing it.
version:
gdb:GNU gdb (GDB) 13.0.50.20220805-git
gcc:gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)
ubuntu: 20.04
command to reproduce:
gdb -x command.gdb UAF_2
UAF_2 is attached to this report.
command.gdb is attached to the first comment.
ASAN report:
=================================================================
==2661699==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address
0x7ffe5c3013ff at pc 0x00000057b9bd bp 0x7ffe5c300910 sp 0x7ffe5c300908
READ of size 1 at 0x7ffe5c3013ff thread T0
#0 0x57b9bc in ada_decode[abi:cxx11](char const*, bool, bool)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:1388:16
#1 0x61bbd1 in ada_language::sniff_from_mangled_name(char const*,
std::unique_ptr<char, gdb::xfree_deleter<char> >*) const
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:13574:29
#2 0x1c46d7d in symbol_find_demangled_name(general_symbol_info*, char
const*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symtab.c:892:17
#3 0x1c47e70 in
general_symbol_info::compute_and_set_names(gdb::basic_string_view<char,
std::char_traits<char> >, bool, objfile_per_bfd_storage*,
gdb::optional<unsigned int>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symtab.c:980:7
#4 0xb2919d in process_coff_symbol(coff_symbol*, internal_auxent*,
objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:1571:8
#5 0xb2604b in coff_symtab_read(minimal_symbol_reader&, long, unsigned int,
objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:1183:4
#6 0xb1d5ea in coff_read_minsyms(long, unsigned int, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:554:7
#7 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3
#8 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3
#9 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3
#10 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3
#11 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3
#12 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10
#13 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>,
std::vector<other_sections, std::allocator<other_sections> >*,
enum_flags<objfile_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10
#14 0x1be873e in symbol_file_add_main_1(char const*,
enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29
#15 0x1be82ea in symbol_file_add_main(char const*,
enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3
#16 0x15c8b73 in symbol_file_add_main_adapter(char const*, int)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3
#17 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char
const*, int, bool)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7
#18 0x15c433a in captured_main_1(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8
#19 0x15be28d in captured_main(void*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3
#20 0x15be058 in gdb_main(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7
#21 0x4e4f12 in main
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10
#22 0x7f63cb655082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#23 0x433ebd in _start
(/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x433ebd)
Address 0x7ffe5c3013ff is located in stack of thread T0 at offset 479 in frame
#0 0x1c4685f in symbol_find_demangled_name(general_symbol_info*, char
const*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symtab.c:872
This frame has 1 object(s):
[32, 40) 'demangled' (line 873) <== Memory access at offset 479 overflows
this variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:1388:16 in
ada_decode[abi:cxx11](char const*, bool, bool)
Shadow bytes around the buggy address:
0x10004b858220: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x10004b858230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10004b858240: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00
0x10004b858250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10004b858260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10004b858270: 00 00 00 00 00 00 00 00 00 00 00 00 ca ca ca[ca]
0x10004b858280: 03 cb cb cb cb cb cb cb f1 f1 f1 f1 00 00 f2 f2
0x10004b858290: 00 00 00 00 f2 f2 f2 f2 00 00 f2 f2 f8 f2 00 f2
0x10004b8582a0: f2 f2 00 00 f2 f2 f8 f8 f2 f2 00 f2 f2 f2 00 00
0x10004b8582b0: f2 f2 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x10004b8582c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2661699==ABORTING
Thank you for your attention and support.
Best regards,
Michael Zhang.
--
You are receiving this mail because:
You are on the CC list for the bug.
next reply other threads:[~2023-07-15 6:26 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-15 6:26 sihan2021 at iscas dot ac.cn [this message]
2023-07-15 6:27 ` [Bug gdb/30639] " sihan2021 at iscas dot ac.cn
2023-07-26 19:15 ` keiths at redhat dot com
2023-07-29 5:35 ` sihan2021 at iscas dot ac.cn
2023-07-29 5:49 ` sihan2021 at iscas dot ac.cn
2023-07-29 5:49 ` sihan2021 at iscas dot ac.cn
2023-07-29 5:50 ` sihan2021 at iscas dot ac.cn
2023-07-29 15:15 ` tromey at sourceware dot org
2023-08-15 18:11 ` keiths at redhat dot com
2023-08-16 16:44 ` [Bug ada/30639] " tromey at sourceware dot org
2023-08-16 19:08 ` cvs-commit at gcc dot gnu.org
2023-08-16 19:11 ` tromey at sourceware dot org
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-30639-4717@http.sourceware.org/bugzilla/ \
--to=sourceware-bugzilla@sourceware.org \
--cc=gdb-prs@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).