public inbox for gdb-testers@sourceware.org
help / color / mirror / Atom feed
* [binutils-gdb] Fix buffer overflow regression due to minsym malloc-ed instead of obstack-ed.
@ 2019-03-27 16:06 sergiodj+buildbot
  2019-03-27 16:03 ` Failures on RHEL-s390x-m64, branch master sergiodj+buildbot
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: sergiodj+buildbot @ 2019-03-27 16:06 UTC (permalink / raw)
  To: gdb-testers

*** TEST RESULTS FOR COMMIT 20dc7e9b059edff1d0fab3bd197c460c11cc7a06 ***

Author: Philippe Waroquiers <philippe.waroquiers@skynet.be>
Branch: master
Commit: 20dc7e9b059edff1d0fab3bd197c460c11cc7a06

Fix buffer overflow regression due to minsym malloc-ed instead of obstack-ed.

Valgrind detects the following error in a bunch of tests,
e.g. in gdb.base/foll-fork.exp.

==15155== VALGRIND_GDB_ERROR_BEGIN
==15155== Invalid read of size 8
==15155==    at 0x55BE04: minimal_symbol_upper_bound(bound_minimal_symbol) (minsyms.c:1504)
==15155==    by 0x3B2E9C: find_pc_partial_function(unsigned long, char const**, unsigned long*, unsigned long*, block const**) (blockframe.c:340)
==15155==    by 0x3B3135: find_function_entry_range_from_pc(unsigned long, char const**, unsigned long*, unsigned long*) (blockframe.c:385)
==15155==    by 0x4F5597: fill_in_stop_func(gdbarch*, execution_control_state*) [clone .part.16] (infrun.c:4124)
==15155==    by 0x4FBE01: fill_in_stop_func (infrun.c:7636)
==15155==    by 0x4FBE01: process_event_stop_test(execution_control_state*) (infrun.c:6279)
...
==15155==  Address 0x715bec8 is 0 bytes after a block of size 2,952 alloc'd
==15155==    at 0x4C2E2B3: realloc (vg_replace_malloc.c:836)
==15155==    by 0x405F2C: xrealloc (common-utils.c:62)
==15155==    by 0x55BA4E: xresizevec<minimal_symbol> (poison.h:170)
==15155==    by 0x55BA4E: minimal_symbol_reader::install() (minsyms.c:1399)
==15155==    by 0x4981C7: elf_read_minimal_symbols (elfread.c:1165)
...

This seems to be a regression created by:
    commit 042d75e42c5572f333e0e06dabd3c5c4afab486c
    Author:     Tom Tromey <tom@tromey.com>
    AuthorDate: Sat Mar 2 12:29:48 2019 -0700
    Commit:     Tom Tromey <tom@tromey.com>
    CommitDate: Fri Mar 15 16:02:10 2019 -0600

        Allocate minimal symbols with malloc

Before this commit, the array of 'struct minimal_symbol'
contained a last element that was a "null symbol".  The comment in
minimal_symbol_reader::install was:
      /* We also terminate the minimal symbol table with a "null symbol",
         which is *not* included in the size of the table.  This makes it
         easier to find the end of the table when we are handed a pointer
         to some symbol in the middle of it.  Zero out the fields in the
         "null symbol" allocated at the end of the array.  Note that the
         symbol count does *not* include this null symbol, which is why it
         is indexed by mcount and not mcount-1.  */

      memset (&msymbols[mcount], 0, sizeof (struct minimal_symbol));

However, minimal_symbol_upper_bound was still based on the assumption
that the array of minsym is terminated by a minsym with a null symbol:
it is looping with:
  for (i = 1; MSYMBOL_LINKAGE_NAME (msymbol + i) != NULL; i++)

Replace this NULL comparison by a logic that calculates how
many msymbol are following the msymbols from which we are starting from.

(Re-)tested on debian/amd64, natively and under valgrind.

gdb/ChangeLog
2019-03-24  Philippe Waroquiers  <philippe.waroquiers@skynet.be>
	    Tom Tromey  <tromey@adacore.com>

	* minsyms.c (minimal_symbol_upper_bound): Fix buffer overflow.


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2019-04-21 14:41 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-27 16:06 [binutils-gdb] Fix buffer overflow regression due to minsym malloc-ed instead of obstack-ed sergiodj+buildbot
2019-03-27 16:03 ` Failures on RHEL-s390x-m64, branch master sergiodj+buildbot
2019-03-28  3:40 ` Failures on Debian-s390x-native-extended-gdbserver-m64, " sergiodj+buildbot
2019-03-28  4:12 ` Failures on Debian-s390x-native-gdbserver-m64, " sergiodj+buildbot
2019-03-28  4:15 ` Failures on Debian-s390x-m64, " sergiodj+buildbot
2019-04-01  0:10 ` Failures on Fedora-x86_64-native-extended-gdbserver-m64, " sergiodj+buildbot
2019-04-01  1:18 ` Failures on Fedora-x86_64-m32, " sergiodj+buildbot
2019-04-12 14:10 ` *** COMPILATION FAILED *** Failures on NetBSD-x86_64-m64, branch master *** BREAKAGE *** sergiodj+buildbot
2019-04-21 15:16 ` Failures on Fedora-x86_64-native-extended-gdbserver-m32, branch master sergiodj+buildbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).