[Bug shlibs/30663] Segfault when reading malformed PT_INTERP header

["bgray at linux dot ibm.com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30663

Benjamin Gray <bgray at linux dot ibm.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bgray at linux dot ibm.com

--- Comment #1 from Benjamin Gray <bgray at linux dot ibm.com> ---
Ran into this myself and came here to report it. My binary has a `.interp`
section, but it has size 0. The following section in gdb/solib-svr4.c
enable_break()

    std::optional<gdb::byte_vector> interp_name_holder
      = find_program_interpreter ();
    if (interp_name_holder)
      {
        const char *interp_name = (const char *) interp_name_holder->data ();

Only checks that a vector is present, not that it has allocated anything. So
interp_name is possibly a null pointer. This is propagated down the chain

solib_bfd_open()
  solib_find()
    solib_find_1()
      xstrdup()

which ultimately segfaults on the null pointer.

find_program_interpreter() itself is correctly locating the zero sized
`.interp` section, creating a gdb::byte_vector with size 0. This wraps the
std::vector type, which avoids an allocation for zero vectors. The
bfd_get_section_contents() call trivially returns true because it's 'found' the
contents of this zero sized section, so never touches the data buffer. 
(actually, it _might_ call memset() on the buffer, which is undefined behaviour
as far as I can tell after a quick search).

-- 
You are receiving this mail because:
You are on the CC list for the bug.