[Bug gdb/30640] New: AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[Bug gdb/30640] New: AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[sihan2021 at iscas dot ac.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

            Bug ID: 30640
           Summary: AddressSanitizer: heap-use-after-free
                    /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff
                    -pe-read.c:137:27
           Product: gdb
           Version: 13.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: sihan2021 at iscas dot ac.cn
  Target Milestone: ---

Created attachment 14969
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14969&action=edit
crash seed

Hello GDB developers,
We recently conducted a fuzzing test on GDB and discovered a
heap-use-after-free bug. We would like to provide a detailed description of the
bug and seek your assistance in addressing it.

version:
gdb:GNU gdb (GDB) 13.0.50.20220805-git
gcc:gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)
ubuntu: 20.04

command to reproduce:
gdb -x command.gdb UAF_2
UAF_2 is attached to this report.
command.gdb is attached to the first comment.


ASAN report:
=================================================================
==2662213==ERROR: AddressSanitizer: heap-use-after-free on address
0x7f8e47c31800 at pc 0x000000b15103 bp 0x7fff91766210 sp 0x7fff91766208
READ of size 1 at 0x7f8e47c31800 thread T0
    #0 0xb15102 in add_pe_exported_sym(minimal_symbol_reader&, char const*,
unsigned long, int, read_pe_section_data const*, char const*, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27
    #1 0xb12287 in read_pe_exported_syms(minimal_symbol_reader&, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:558:8
    #2 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7
    #3 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3
    #4 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3
    #5 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3
    #6 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3
    #7 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3
    #8 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10
    #9 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>,
std::vector<other_sections, std::allocator<other_sections> >*,
enum_flags<objfile_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10
    #10 0x1be873e in symbol_file_add_main_1(char const*,
enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29
    #11 0x1be82ea in symbol_file_add_main(char const*,
enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3
    #12 0x15c8b73 in symbol_file_add_main_adapter(char const*, int)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3
    #13 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char
const*, int, bool)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7
    #14 0x15c433a in captured_main_1(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8
    #15 0x15be28d in captured_main(void*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3
    #16 0x15be058 in gdb_main(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7
    #17 0x4e4f12 in main
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10
    #18 0x7f8e7a7b7082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #19 0x433ebd in _start
(/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x433ebd)

0x7f8e47c31800 is located 442368 bytes inside of 786432-byte region
[0x7f8e47bc5800,0x7f8e47c85800)
freed by thread T0 here:
    #0 0x4e2c8d in operator delete(void*)
(/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x4e2c8d)
    #1 0xb182c1 in
__gnu_cxx::new_allocator<read_pe_section_data>::deallocate(read_pe_section_data*,
unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:133:2
    #2 0xb18269 in std::allocator_traits<std::allocator<read_pe_section_data>
>::deallocate(std::allocator<read_pe_section_data>&, read_pe_section_data*,
unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:492:13
    #3 0xb18203 in std::_Vector_base<read_pe_section_data,
std::allocator<read_pe_section_data> >::_M_deallocate(read_pe_section_data*,
unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:354:4
    #4 0xb1882d in std::vector<read_pe_section_data,
std::allocator<read_pe_section_data> >::_M_default_append(unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/vector.tcc:675:8
    #5 0xb13487 in std::vector<read_pe_section_data,
std::allocator<read_pe_section_data> >::resize(unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:940:4
    #6 0xb10b1d in read_pe_exported_syms(minimal_symbol_reader&, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:451:17
    #7 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7
    #8 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3
    #9 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3
    #10 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3
    #11 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3
    #12 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3
    #13 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10
    #14 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>,
std::vector<other_sections, std::allocator<other_sections> >*,
enum_flags<objfile_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10
    #15 0x1be873e in symbol_file_add_main_1(char const*,
enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29
    #16 0x1be82ea in symbol_file_add_main(char const*,
enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3
    #17 0x15c8b73 in symbol_file_add_main_adapter(char const*, int)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3
    #18 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char
const*, int, bool)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7
    #19 0x15c433a in captured_main_1(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8
    #20 0x15be28d in captured_main(void*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3
    #21 0x15be058 in gdb_main(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7
    #22 0x4e4f12 in main
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10
    #23 0x7f8e7a7b7082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x4e242d in operator new(unsigned long)
(/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x4e242d)
    #1 0xb17b62 in
__gnu_cxx::new_allocator<read_pe_section_data>::allocate(unsigned long, void
const*)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:115:27
    #2 0xb17a71 in std::allocator_traits<std::allocator<read_pe_section_data>
>::allocate(std::allocator<read_pe_section_data>&, unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:460:20
    #3 0xb179d1 in std::_Vector_base<read_pe_section_data,
std::allocator<read_pe_section_data> >::_M_allocate(unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:346:20
    #4 0xb185b7 in std::vector<read_pe_section_data,
std::allocator<read_pe_section_data> >::_M_default_append(unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/vector.tcc:635:34
    #5 0xb13487 in std::vector<read_pe_section_data,
std::allocator<read_pe_section_data> >::resize(unsigned long)
/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:940:4
    #6 0xb10b1d in read_pe_exported_syms(minimal_symbol_reader&, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:451:17
    #7 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7
    #8 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3
    #9 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3
    #10 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3
    #11 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3
    #12 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3
    #13 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*,
enum_flags<symfile_add_flag>, std::vector<other_sections,
std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10
    #14 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>,
std::vector<other_sections, std::allocator<other_sections> >*,
enum_flags<objfile_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10
    #15 0x1be873e in symbol_file_add_main_1(char const*,
enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29
    #16 0x1be82ea in symbol_file_add_main(char const*,
enum_flags<symfile_add_flag>)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3
    #17 0x15c8b73 in symbol_file_add_main_adapter(char const*, int)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3
    #18 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char
const*, int, bool)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7
    #19 0x15c433a in captured_main_1(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8
    #20 0x15be28d in captured_main(void*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3
    #21 0x15be058 in gdb_main(captured_main_args*)
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7
    #22 0x4e4f12 in main
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10
    #23 0x7f8e7a7b7082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free
/home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 in
add_pe_exported_sym(minimal_symbol_reader&, char const*, unsigned long, int,
read_pe_section_data const*, char const*, objfile*)
Shadow bytes around the buggy address:
  0x0ff248f7e2b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e2c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e2d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e2e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e2f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0ff248f7e300:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff248f7e350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2662213==ABORTING

Thank you for your attention and support.
Best regards,
Michael Zhang.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[sihan2021 at iscas dot ac.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

--- Comment #1 from 熊吉思汗 <sihan2021 at iscas dot ac.cn> ---
Created attachment 14970
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14970&action=edit
input file of -x option

input file of -x option

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[keiths at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

Keith Seitz <keiths at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |keiths at redhat dot com

--- Comment #2 from Keith Seitz <keiths at redhat dot com> ---
Can you confirm the location on origin/master with the provided binary?
The provided backtrace does not appear to be the same, i.e.,
add_pe_exported_sym
does not appear at all in my backtrace:

$ ./gdb -nx -q --data-directory data-directory UAF_2
Reading symbols from UAF_2...


Fatal signal: Segmentation fault
----- Backtrace -----
0x599064 gdb_internal_backtrace_1
        ../../src/gdb/bt-utils.c:122
0x599107 _Z22gdb_internal_backtracev
        ../../src/gdb/bt-utils.c:168
0x782fd4 handle_fatal_signal
        ../../src/gdb/event-top.c:889
0x783140 handle_sigsegv
        ../../src/gdb/event-top.c:962
0x7f0dc145fb6f ???
0x7f0dc1581c11 ???
0x60b27a read_pe_truncate_name
        ../../src/gdb/coff-pe-read.c:249
0x60c019 _Z21read_pe_exported_symsR21minimal_symbol_readerP7objfile
        ../../src/gdb/coff-pe-read.c:498
0x60e0bb coff_read_minsyms
        ../../src/gdb/coffread.c:543
0x60e629 coff_symfile_read
        ../../src/gdb/coffread.c:698
0xbd975e read_symbols
        ../../src/gdb/symfile.c:772
0xbd9e0b syms_from_objfile_1
        ../../src/gdb/symfile.c:966
0xbd9ecf syms_from_objfile
        ../../src/gdb/symfile.c:983
0xbda3aa symbol_file_add_with_addrs
        ../../src/gdb/symfile.c:1086
0xbda6eb
_Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_flagEP7objfile
        ../../src/gdb/symfile.c:1166
0xbda73a
_Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaIS5_EES1_I12objfile_flagE
        ../../src/gdb/symfile.c:1179
0xbda7ff symbol_file_add_main_1
        ../../src/gdb/symfile.c:1203
0xbda7a6 _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE
        ../../src/gdb/symfile.c:1194
0x90b1d7 symbol_file_add_main_adapter
        ../../src/gdb/main.c:549
0x90b0ed catch_command_errors
        ../../src/gdb/main.c:518
0x90c20e captured_main_1
        ../../src/gdb/main.c:1203
0x90c820 captured_main
        ../../src/gdb/main.c:1310
0x90c8bf _Z8gdb_mainP18captured_main_args
        ../../src/gdb/main.c:1339
0x418c3c main
        ../../src/gdb/gdb.c:32
---------------------
A fatal error internal to GDB has been detected, further
debugging is not possible.  GDB will now terminate.

This is a bug, please report it.  For instructions, see:
<https://www.gnu.org/software/gdb/bugs/>.

Segmentation fault (core dumped)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[sihan2021 at iscas dot ac.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

--- Comment #3 from 熊吉思汗 <sihan2021 at iscas dot ac.cn> ---
Created attachment 15017
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15017&action=edit
hbo

hbo

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[sihan2021 at iscas dot ac.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

--- Comment #4 from 熊吉思汗 <sihan2021 at iscas dot ac.cn> ---
Created attachment 15018
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15018&action=edit
command.gdb

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[sihan2021 at iscas dot ac.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

--- Comment #5 from 熊吉思汗 <sihan2021 at iscas dot ac.cn> ---
(In reply to Keith Seitz from comment #2)
> Can you confirm the location on origin/master with the provided binary?
> The provided backtrace does not appear to be the same, i.e.,
> add_pe_exported_sym
> does not appear at all in my backtrace:
> 
> $ ./gdb -nx -q --data-directory data-directory UAF_2
> Reading symbols from UAF_2...
> 
> 
> Fatal signal: Segmentation fault
> ----- Backtrace -----
> 0x599064 gdb_internal_backtrace_1
> 	../../src/gdb/bt-utils.c:122
> 0x599107 _Z22gdb_internal_backtracev
> 	../../src/gdb/bt-utils.c:168
> 0x782fd4 handle_fatal_signal
> 	../../src/gdb/event-top.c:889
> 0x783140 handle_sigsegv
> 	../../src/gdb/event-top.c:962
> 0x7f0dc145fb6f ???
> 0x7f0dc1581c11 ???
> 0x60b27a read_pe_truncate_name
> 	../../src/gdb/coff-pe-read.c:249
> 0x60c019 _Z21read_pe_exported_symsR21minimal_symbol_readerP7objfile
> 	../../src/gdb/coff-pe-read.c:498
> 0x60e0bb coff_read_minsyms
> 	../../src/gdb/coffread.c:543
> 0x60e629 coff_symfile_read
> 	../../src/gdb/coffread.c:698
> 0xbd975e read_symbols
> 	../../src/gdb/symfile.c:772
> 0xbd9e0b syms_from_objfile_1
> 	../../src/gdb/symfile.c:966
> 0xbd9ecf syms_from_objfile
> 	../../src/gdb/symfile.c:983
> 0xbda3aa symbol_file_add_with_addrs
> 	../../src/gdb/symfile.c:1086
> 0xbda6eb
> _Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10en
> um_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_
> flagEP7objfile
> 	../../src/gdb/symfile.c:1166
> 0xbda73a
> _Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sect
> ionsSaIS5_EES1_I12objfile_flagE
> 	../../src/gdb/symfile.c:1179
> 0xbda7ff symbol_file_add_main_1
> 	../../src/gdb/symfile.c:1203
> 0xbda7a6 _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE
> 	../../src/gdb/symfile.c:1194
> 0x90b1d7 symbol_file_add_main_adapter
> 	../../src/gdb/main.c:549
> 0x90b0ed catch_command_errors
> 	../../src/gdb/main.c:518
> 0x90c20e captured_main_1
> 	../../src/gdb/main.c:1203
> 0x90c820 captured_main
> 	../../src/gdb/main.c:1310
> 0x90c8bf _Z8gdb_mainP18captured_main_args
> 	../../src/gdb/main.c:1339
> 0x418c3c main
> 	../../src/gdb/gdb.c:32
> ---------------------
> A fatal error internal to GDB has been detected, further
> debugging is not possible.  GDB will now terminate.
> 
> This is a bug, please report it.  For instructions, see:
> <https://www.gnu.org/software/gdb/bugs/>.
> 
> Segmentation fault (core dumped)

I am sorry that I did not descripe well. I uploaded the hbo binary file and
command.gdb file again in the comment. 
No relevant search results found.
To reproduce this bug, please use the following command: gdb -x command.gdb
hbo.
If you encounter any issues during the reproduction process, please feel free
to let me know.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[sihan2021 at iscas dot ac.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

--- Comment #6 from 熊吉思汗 <sihan2021 at iscas dot ac.cn> ---
(In reply to 熊吉思汗 from comment #3)
> Created attachment 15017 [details]
> hbo
> 
> hbo

I am sorry, please ignore this file.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[keiths at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

Keith Seitz <keiths at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-09-28
             Status|UNCONFIRMED                 |NEW

--- Comment #7 from Keith Seitz <keiths at redhat dot com> ---
I think this was fixed by

https://inbox.sourceware.org/gdb-patches/20230822152335.231921-1-keiths@redhat.com/

and the follow-up patches from Mark.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/30640] AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27

[keiths at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30640

Keith Seitz <keiths at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Keith Seitz <keiths at redhat dot com> ---
Fixed by 58abdf88782 (and follow-up patches from mjw).

-- 
You are receiving this mail because:
You are on the CC list for the bug.