public inbox for gdb-prs@sourceware.org help / color / mirror / Atom feed
From: "sihan2021 at iscas dot ac.cn" <sourceware-bugzilla@sourceware.org> To: gdb-prs@sourceware.org Subject: [Bug gdb/30640] New: AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 Date: Sat, 15 Jul 2023 06:32:27 +0000 [thread overview] Message-ID: <bug-30640-4717@http.sourceware.org/bugzilla/> (raw) https://sourceware.org/bugzilla/show_bug.cgi?id=30640 Bug ID: 30640 Summary: AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff -pe-read.c:137:27 Product: gdb Version: 13.1 Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdb Assignee: unassigned at sourceware dot org Reporter: sihan2021 at iscas dot ac.cn Target Milestone: --- Created attachment 14969 --> https://sourceware.org/bugzilla/attachment.cgi?id=14969&action=edit crash seed Hello GDB developers, We recently conducted a fuzzing test on GDB and discovered a heap-use-after-free bug. We would like to provide a detailed description of the bug and seek your assistance in addressing it. version: gdb:GNU gdb (GDB) 13.0.50.20220805-git gcc:gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1) ubuntu: 20.04 command to reproduce: gdb -x command.gdb UAF_2 UAF_2 is attached to this report. command.gdb is attached to the first comment. ASAN report: ================================================================= ==2662213==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f8e47c31800 at pc 0x000000b15103 bp 0x7fff91766210 sp 0x7fff91766208 READ of size 1 at 0x7f8e47c31800 thread T0 #0 0xb15102 in add_pe_exported_sym(minimal_symbol_reader&, char const*, unsigned long, int, read_pe_section_data const*, char const*, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 #1 0xb12287 in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:558:8 #2 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #3 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #4 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #5 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #6 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #7 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #8 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #9 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #10 0x1be873e in symbol_file_add_main_1(char const*, enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #11 0x1be82ea in symbol_file_add_main(char const*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #12 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #13 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #14 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #15 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #16 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #17 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #18 0x7f8e7a7b7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #19 0x433ebd in _start (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x433ebd) 0x7f8e47c31800 is located 442368 bytes inside of 786432-byte region [0x7f8e47bc5800,0x7f8e47c85800) freed by thread T0 here: #0 0x4e2c8d in operator delete(void*) (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x4e2c8d) #1 0xb182c1 in __gnu_cxx::new_allocator<read_pe_section_data>::deallocate(read_pe_section_data*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:133:2 #2 0xb18269 in std::allocator_traits<std::allocator<read_pe_section_data> >::deallocate(std::allocator<read_pe_section_data>&, read_pe_section_data*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:492:13 #3 0xb18203 in std::_Vector_base<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_deallocate(read_pe_section_data*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:354:4 #4 0xb1882d in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_default_append(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/vector.tcc:675:8 #5 0xb13487 in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::resize(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:940:4 #6 0xb10b1d in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:451:17 #7 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #8 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #9 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #10 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #11 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #12 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #13 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #14 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #15 0x1be873e in symbol_file_add_main_1(char const*, enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #16 0x1be82ea in symbol_file_add_main(char const*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #17 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #18 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #19 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #20 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #21 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #22 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #23 0x7f8e7a7b7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 previously allocated by thread T0 here: #0 0x4e242d in operator new(unsigned long) (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x4e242d) #1 0xb17b62 in __gnu_cxx::new_allocator<read_pe_section_data>::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:115:27 #2 0xb17a71 in std::allocator_traits<std::allocator<read_pe_section_data> >::allocate(std::allocator<read_pe_section_data>&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:460:20 #3 0xb179d1 in std::_Vector_base<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:346:20 #4 0xb185b7 in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_default_append(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/vector.tcc:635:34 #5 0xb13487 in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::resize(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:940:4 #6 0xb10b1d in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:451:17 #7 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #8 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #9 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #10 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #11 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #12 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #13 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #14 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #15 0x1be873e in symbol_file_add_main_1(char const*, enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #16 0x1be82ea in symbol_file_add_main(char const*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #17 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #18 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #19 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #20 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #21 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #22 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #23 0x7f8e7a7b7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 SUMMARY: AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 in add_pe_exported_sym(minimal_symbol_reader&, char const*, unsigned long, int, read_pe_section_data const*, char const*, objfile*) Shadow bytes around the buggy address: 0x0ff248f7e2b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0ff248f7e300:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2662213==ABORTING Thank you for your attention and support. Best regards, Michael Zhang. -- You are receiving this mail because: You are on the CC list for the bug.
next reply other threads:[~2023-07-15 6:32 UTC|newest] Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-07-15 6:32 sihan2021 at iscas dot ac.cn [this message] 2023-07-15 6:32 ` [Bug gdb/30640] " sihan2021 at iscas dot ac.cn 2023-07-26 19:44 ` keiths at redhat dot com 2023-07-29 5:42 ` sihan2021 at iscas dot ac.cn 2023-07-29 5:43 ` sihan2021 at iscas dot ac.cn 2023-07-29 5:44 ` sihan2021 at iscas dot ac.cn 2023-07-29 6:07 ` sihan2021 at iscas dot ac.cn 2023-09-28 14:47 ` keiths at redhat dot com 2023-09-28 19:07 ` keiths at redhat dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-30640-4717@http.sourceware.org/bugzilla/ \ --to=sourceware-bugzilla@sourceware.org \ --cc=gdb-prs@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).