Bug 12640 - Gold accesses vector out of range
Summary: Gold accesses vector out of range
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: gold (show other bugs)
Version: 2.22
: P2 normal
Target Milestone: ---
Assignee: Ian Lance Taylor
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-04-05 17:35 UTC by Paul Pluzhnikov
Modified: 2011-04-05 19:26 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Paul Pluzhnikov 2011-04-05 17:35:15 UTC
If current HEAD is built with -D_GLIBCXX_DEBUG, then debug_msg test case fails with:

    error: attempt to subscript container with out-of-bounds index 0, but     
    container only holds 0 elements.

Objects involved in the operation:
sequence "this" @ 0x0x7fffffff68d8 {
  type = NSt7__debug6vectorIhSaIhEEE;
}

This is happening here:


#0  0x00007ffff70b89f5 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff70bc413 in abort () at abort.c:92
#2  0x00007ffff790a70d in __gnu_debug::_Error_formatter::_M_error() const ()
   from /usr/lib64/libstdc++.so.6
#3  0x00000000006cd5ac in std::__debug::vector<unsigned char, std::allocator<unsigned char> >::operator[] (this=0x7fffffff68d8, __n=0)
    at ../lib/gcc/x86_64-unknown-linux-gnu/4.4.3/../../../../include/c++/4.4.3/debug/vector:265
#4  0x00000000007d070f in gold::Sized_dwarf_line_info<64, false>::read_header_prolog (this=0x7fffffff68a0, lineptr=0x7ffff7ff8315 "")
    at ../../src/gold/dwarf_reader.cc:192
#5  0x00000000007d0188 in gold::Sized_dwarf_line_info<64, false>::read_line_mappings (this=0x7fffffff68a0, object=0xaa5f40, 
    shndx=4294967295) at ../../src/gold/dwarf_reader.cc:576
#6  0x00000000007caf24 in gold::Sized_dwarf_line_info<64, false>::Sized_dwarf_line_info (this=0x7fffffff68a0, object=0xaa5f40, 
    read_shndx=4294967295) at ../../src/gold/dwarf_reader.cc:139
#7  0x00000000005e7f3b in gold::Relocate_info<64, false>::location (
    this=0x7fffffff6df0, offset=37) at ../../src/gold/object.cc:2608
#8  0x000000000056f2fc in gold::gold_undefined_symbol_at_location<64, false> (sym=0xaaa9b0, relinfo=0x7fffffff6df0, relnum=2, reloffset=37)
    at ../../src/gold/errors.cc:296
#9  0x000000000044e29a in gold::relocate_section<64, false, <unnamed>::Target_x86_64, 4, <unnamed>::Target_x86_64::Relocate>(const gold::Relocate_info<64, false> *, (anonymous namespace)::Target_x86_64 *, const unsigned char *, size_t, gold::Output_section *, bool, unsigned char *, uint64_t, gold::section_size_type, const gold::Reloc_symbol_changes *) (relinfo=0x7fffffff6df0, target=0xaa5e50, 
    prelocs=0x7ffff7ff8ae0 "%", reloc_count=8, 
    output_section=0xaa70b0, needs_special_offset_handling=false, 
    view=0x7ffff6294460 "1\355\350(", view_address=4195424, 
    view_size=132, reloc_symbol_changes=0x0)
    at ../../src/gold/target-reloc.h:354
#10 0x000000000044bde5 in (anonymous namespace)::Target_x86_64::relocate_section (this=0xaa5e50, relinfo=0x7fffffff6df0, sh_type=4, 
    prelocs=0x7ffff7ff8ab0 "\027", reloc_count=8, 
    output_section=0xaa70b0, needs_special_offset_handling=false, 
    view=0x7ffff6294460 "1\355\350(", address=4195424, 
    view_size=132, reloc_symbol_changes=0x0)
    at ../../src/gold/x86_64.cc:3014
#11 0x00000000006d5988 in gold::Sized_relobj<64, false>::do_relocate_sections (this=0xaa5f40, symtab=0x7fffffffc720, 
    layout=0x7fffffffc220, pshdrs=0x7ffff7ff8530 "", of=0xaa9b00, 
    pviews=0x7fffffff6f80) at ../../src/gold/reloc.cc:993
#12 0x00000000005de4da in gold::Sized_relobj<64, false>::relocate_sections (this=0xaa5f40, symtab=0x7fffffffc720, layout=0x7fffffffc220, 
    pshdrs=0x7ffff7ff8530 "", of=0xaa9b00, pviews=0x7fffffff6f80)
    at ../../src/gold/object.h:2086
#13 0x00000000006d3ea4 in gold::Sized_relobj<64, false>::do_relocate
    (this=0xaa5f40, symtab=0x7fffffffc720, layout=0x7fffffffc220, 
    of=0xaa9b00) at ../../src/gold/reloc.cc:661
#14 0x00000000006cf654 in gold::Relobj::relocate (this=0xaa5f40, 
    symtab=0x7fffffffc720, layout=0x7fffffffc220, of=0xaa9b00)
    at ../../src/gold/object.h:833
#15 0x00000000006cf2ac in gold::Relocate_task::run (this=0xca21a0)
    at ../../src/gold/reloc.cc:233
#16 0x00000000007abe49 in gold::Workqueue::find_and_run_task (
    this=0x7fffffffcdb0, thread_number=0)
    at ../../src/gold/workqueue.cc:319
#17 0x00000000007ac492 in gold::Workqueue::process (
    this=0x7fffffffcdb0, thread_number=0)
    at ../../src/gold/workqueue.cc:495
#18 0x0000000000406382 in main (argc=37, argv=0x7fffffffcfe8)
    at ../../src/gold/main.cc:247

(gdb) fr 4
#4  0x00000000007d070f in gold::Sized_dwarf_line_info<64, false>::read_header_prolog (this=0x7fffffff68a0, lineptr=0x7ffff7ff8315 "")
    at ../../src/gold/dwarf_reader.cc:192
192       header_.std_opcode_lengths[0] = 0;
(gdb) p header_.std_opcode_lengths
$1 = std::__debug::vector of length 0, capacity 14
(gdb)
Comment 1 Paul Pluzhnikov 2011-04-05 17:53:51 UTC
The fix appears trivial:

Index: dwarf_reader.cc
===================================================================
RCS file: /cvs/src/src/gold/dwarf_reader.cc,v
retrieving revision 1.32
diff -u -p -r1.32 dwarf_reader.cc
--- dwarf_reader.cc     10 Mar 2011 01:31:32 -0000      1.32
+++ dwarf_reader.cc     5 Apr 2011 17:40:17 -0000
@@ -188,7 +188,7 @@ Sized_dwarf_line_info<size, big_endian>:
   header_.opcode_base = *lineptr;
   lineptr += 1;
 
-  header_.std_opcode_lengths.reserve(header_.opcode_base + 1);
+  header_.std_opcode_lengths.resize(header_.opcode_base + 1);
   header_.std_opcode_lengths[0] = 0;
   for (int i = 1; i < header_.opcode_base; i++)
     {

This makes all the small tests pass.
(Building ld1, ld2, etc. with _GLIBCXX_DEBUG'd gold takes forever.)
Comment 2 Sourceware Commits 2011-04-05 19:19:45 UTC
CVSROOT:	/cvs/src
Module name:	src
Changes by:	ppluzhnikov@sourceware.org	2011-04-05 19:19:43

Modified files:
	gold           : ChangeLog dwarf_reader.cc 

Log message:
	2011-04-05  Paul Pluzhnikov  <ppluzhnikov@google.com>
	
	PR gold/12640
	* dwarf_reader.cc (Sized_dwarf_line_info): Fix vector bounds
	violation.

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/src/gold/ChangeLog.diff?cvsroot=src&r1=1.714&r2=1.715
http://sourceware.org/cgi-bin/cvsweb.cgi/src/gold/dwarf_reader.cc.diff?cvsroot=src&r1=1.32&r2=1.33
Comment 3 Paul Pluzhnikov 2011-04-05 19:26:19 UTC
Fixed by above commit.