From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id C90713858CDB; Sat, 15 Jul 2023 06:26:30 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C90713858CDB DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1689402390; bh=GyKn16lSlM99YQpFvWAektQcbLoj56sS4KYLCC3EoFM=; h=From:To:Subject:Date:From; b=jqKs4QxntSquJGBIUyTNyEb1exVp5Dl2gI4U9VmAf6wP+/i/Kpqk3RlTFAh6BcbXo w452kxE0Hs966MYqAs9tEilJV8IsEIm+E4pfsMk4VRFgv6n3SiHnMc0q2gjIxQ3yZ5 pmOthJ/99VdpmvjSpk4HEi/QJ8Kp+M86vzQkoeAY= From: "sihan2021 at iscas dot ac.cn" To: gdb-prs@sourceware.org Subject: [Bug gdb/30639] New: AddressSanitizer: dynamic-stack-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:1388:16 in ada_decode[abi:cxx11](char const*, bool, bool) Date: Sat, 15 Jul 2023 06:26:30 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gdb X-Bugzilla-Component: gdb X-Bugzilla-Version: 13.1 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: sihan2021 at iscas dot ac.cn X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D30639 Bug ID: 30639 Summary: AddressSanitizer: dynamic-stack-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada- lang.c:1388:16 in ada_decode[abi:cxx11](char const*, bool, bool) Product: gdb Version: 13.1 Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdb Assignee: unassigned at sourceware dot org Reporter: sihan2021 at iscas dot ac.cn Target Milestone: --- Created attachment 14967 --> https://sourceware.org/bugzilla/attachment.cgi?id=3D14967&action=3Ded= it crash seed Hello GDB developers, We recently conducted a fuzzing test on GDB and discovered a dynamic-stack-buffer-overflow bug. We would like to provide a detailed description of the bug and seek your assistance in addressing it. version: gdb:GNU gdb (GDB) 13.0.50.20220805-git gcc:gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1) ubuntu: 20.04 command to reproduce: gdb -x command.gdb UAF_2 UAF_2 is attached to this report. command.gdb is attached to the first comment. ASAN report: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D2661699=3D=3DERROR: AddressSanitizer: dynamic-stack-buffer-overflow o= n address 0x7ffe5c3013ff at pc 0x00000057b9bd bp 0x7ffe5c300910 sp 0x7ffe5c300908 READ of size 1 at 0x7ffe5c3013ff thread T0 #0 0x57b9bc in ada_decode[abi:cxx11](char const*, bool, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:1388:16 #1 0x61bbd1 in ada_language::sniff_from_mangled_name(char const*, std::unique_ptr >*) const /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:13574:29 #2 0x1c46d7d in symbol_find_demangled_name(general_symbol_info*, char const*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symtab.c:892:17 #3 0x1c47e70 in general_symbol_info::compute_and_set_names(gdb::basic_string_view >, bool, objfile_per_bfd_storage*, gdb::optional) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symtab.c:980:7 #4 0xb2919d in process_coff_symbol(coff_symbol*, internal_auxent*, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:1571= :8 #5 0xb2604b in coff_symtab_read(minimal_symbol_reader&, long, unsigned = int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:1183= :4 #6 0xb1d5ea in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:554:7 #7 0xb1abd0 in coff_symfile_read(objfile*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #8 0x1bf6a0e in read_symbols(objfile*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #9 0x1c19531 in syms_from_objfile_1(objfile*, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #10 0x1c180fd in syms_from_objfile(objfile*, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #11 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #12 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #13 0x1be7459 in symbol_file_add(char const*, enum_flags, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #14 0x1be873e in symbol_file_add_main_1(char const*, enum_flags, enum_flags, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #15 0x1be82ea in symbol_file_add_main(char const*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #16 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #17 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #18 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #19 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #20 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #21 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #22 0x7f63cb655082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #23 0x433ebd in _start (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x= 433ebd) Address 0x7ffe5c3013ff is located in stack of thread T0 at offset 479 in fr= ame #0 0x1c4685f in symbol_find_demangled_name(general_symbol_info*, char const*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symtab.c:872 This frame has 1 object(s): [32, 40) 'demangled' (line 873) <=3D=3D Memory access at offset 479 ove= rflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/ada-lang.c:1388:16 in ada_decode[abi:cxx11](char const*, bool, bool) Shadow bytes around the buggy address: 0x10004b858220: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x10004b858230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10004b858240: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 0x10004b858250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10004b858260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D>0x10004b858270: 00 00 00 00 00 00 00 00 00 00 00 00 ca ca ca[ca] 0x10004b858280: 03 cb cb cb cb cb cb cb f1 f1 f1 f1 00 00 f2 f2 0x10004b858290: 00 00 00 00 f2 f2 f2 f2 00 00 f2 f2 f8 f2 00 f2 0x10004b8582a0: f2 f2 00 00 f2 f2 f8 f8 f2 f2 00 f2 f2 f2 00 00 0x10004b8582b0: f2 f2 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00 0x10004b8582c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07=20 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb =3D=3D2661699=3D=3DABORTING Thank you for your attention and support. Best regards, Michael Zhang. --=20 You are receiving this mail because: You are on the CC list for the bug.=