From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id DC8EE3858CD1; Sat, 15 Jul 2023 06:36:16 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DC8EE3858CD1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1689402976; bh=YKG03P2+YddsPMohJbOdhJQK3AtWiTu7xRik3KN5AmM=; h=From:To:Subject:Date:From; b=IN25j8OMZTLRgtGVR1UrSjdRu5d8/VHNFVhinKcRFHLR5y7zwyXGxYlVrZE+bNe2D z7HAzLgQKYQIo2pHjQjjBWwyFDvnlN2QVdsHtD8nXaEw+v8Bm65c2BT0Mtb3viDimr nJh2sk/mMvWUV4gtDwjmsfrwU9X1k/ecLf3Ql+Ss= From: "sihan2021 at iscas dot ac.cn" To: gdb-prs@sourceware.org Subject: =?UTF-8?B?W0J1ZyBnZGIvMzA2NDFdIE5ldzogQWRkcmVzc1Nhbml0aXplcjog?= =?UTF-8?B?aGVhcC1idWZmZXItb3ZlcmZsb3cgL2hvbWUvcm9vdC9zcC9EYXRhc2V0L0Jp?= =?UTF-8?B?bnV0aWxzL2JpbnV0aWxzX2FmbHBwL2dkYi9jb2ZmLXBlLXJlYWQuYzoyODQ6?= =?UTF-8?B?MTAgaW4gcGVfYXMxNih2b2lkKik=?= Date: Sat, 15 Jul 2023 06:36:16 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gdb X-Bugzilla-Component: gdb X-Bugzilla-Version: 13.1 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: sihan2021 at iscas dot ac.cn X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D30641 Bug ID: 30641 Summary: AddressSanitizer: heap-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff -pe-read.c:284:10 in pe_as16(void*) Product: gdb Version: 13.1 Status: UNCONFIRMED Severity: normal Priority: P2 Component: gdb Assignee: unassigned at sourceware dot org Reporter: sihan2021 at iscas dot ac.cn Target Milestone: --- Created attachment 14971 --> https://sourceware.org/bugzilla/attachment.cgi?id=3D14971&action=3Ded= it crash seed Hello GDB developers, We recently conducted a fuzzing test on GDB and discovered a heap-use-after-free bug. We would like to provide a detailed description of= the bug and seek your assistance in addressing it. version: gdb:GNU gdb (GDB) 13.0.50.20220805-git gcc:gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1) ubuntu: 20.04 command to reproduce: gdb -x command.gdb hbo hbo is attached to this report. command.gdb is attached to the first comment. ASAN report: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D2662511=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fa83b269800 at pc 0x000000b13b4e bp 0x7ffdba8a9480 sp 0x7ffdba8a9478 READ of size 1 at 0x7fa83b269800 thread T0 #0 0xb13b4d in pe_as16(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:284:10 #1 0xb11af1 in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:513:31 #2 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #3 0xb1abd0 in coff_symfile_read(objfile*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #4 0x1bf6a0e in read_symbols(objfile*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #5 0x1c19531 in syms_from_objfile_1(objfile*, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #6 0x1c180fd in syms_from_objfile(objfile*, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #7 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #8 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #9 0x1be7459 in symbol_file_add(char const*, enum_flags, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #10 0x1be873e in symbol_file_add_main_1(char const*, enum_flags, enum_flags, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #11 0x1be82ea in symbol_file_add_main(char const*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #12 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #13 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #14 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #15 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #16 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #17 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #18 0x7fa86dd0f082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #19 0x433ebd in _start (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x= 433ebd) 0x7fa83b269800 is located 0 bytes to the right of 262144-byte region [0x7fa83b229800,0x7fa83b269800) allocated by thread T0 here: #0 0x4e242d in operator new(unsigned long) (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x= 4e242d) #1 0x627d92 in __gnu_cxx::new_allocator::allocate(unsign= ed long, void const*) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocat= or.h:115:27 #2 0x627ca1 in std::allocator_traits > >::allocate(gdb::default_init_allocator >&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_trai= ts.h:314:20 #3 0x627661 in std::_Vector_base > >::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector= .h:346:20 #4 0x6b7121 in std::_Vector_base > >::_M_create_storage(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector= .h:361:33 #5 0x6b6dd9 in std::_Vector_base > >::_Vector_base(unsigned long, gdb::default_init_allocator > const&) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector= .h:305:9 #6 0xa9ea40 in std::vector > >::vector(unsigned long, gdb::default_init_allocator > const&) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector= .h:511:9 #7 0xb1106b in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:469:34 #8 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #9 0xb1abd0 in coff_symfile_read(objfile*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #10 0x1bf6a0e in read_symbols(objfile*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #11 0x1c19531 in syms_from_objfile_1(objfile*, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #12 0x1c180fd in syms_from_objfile(objfile*, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #13 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #14 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags, std::vector >*, enum_flags, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #15 0x1be7459 in symbol_file_add(char const*, enum_flags, std::vector >*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #16 0x1be873e in symbol_file_add_main_1(char const*, enum_flags, enum_flags, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #17 0x1be82ea in symbol_file_add_main(char const*, enum_flags) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #18 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #19 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #20 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #21 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #22 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #23 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #24 0x7fa86dd0f082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:284:10 in pe_as16(void*) Shadow bytes around the buggy address: 0x0ff5876452b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff5876452c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff5876452d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff5876452e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff5876452f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D>0x0ff587645300:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0ff587645310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0ff587645320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0ff587645330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0ff587645340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0ff587645350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07=20 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb =3D=3D2662511=3D=3DABORTING Thank you for your attention and support. Best regards, Michael Zhang. --=20 You are receiving this mail because: You are on the CC list for the bug.=