[Bug cli/15827] New: Segfault on reading symbols from a fuzzed (corrupted) binary

["jutaky at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=15827

            Bug ID: 15827
           Summary: Segfault on reading symbols from a fuzzed (corrupted)
                    binary
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: cli
          Assignee: unassigned at sourceware dot org
          Reporter: jutaky at gmail dot com

I am performing fuzzing against gdb and checking how it behaves on different
kind of input. Here is the first finding.

Segmentation fault on reading symbols from a fuzzed binary.

gdb version 7.6.50.20130809-cvs.

Test case: http://jutaky.com/fuzzing/gdb_case_6958_4981.bin

Reading symbols from /home/jutaky/fuzzing/gdb_case_6958_4981.bin...
Program received signal SIGSEGV, Segmentation fault.
0x00000000005e891c in read_unsigned_leb128 (abfd=0xd3d4a0, buf=0x76e73134
<Address 0x76e73134 out of bounds>, bytes_read_ptr=0x7fffffffde64) at
dwarf2read.c:15166
15166          byte = bfd_get_8 (abfd, buf);
(gdb) bt
#0  0x00000000005e891c in read_unsigned_leb128 (abfd=0xd3d4a0, buf=0x76e73134
<Address 0x76e73134 out of bounds>, bytes_read_ptr=0x7fffffffde64) at
dwarf2read.c:15166
#1  0x00000000005d4ff8 in peek_die_abbrev (info_ptr=0x76e73134 <Address
0x76e73134 out of bounds>, bytes_read=0x7fffffffde64, cu=0xd5b1c0) at
dwarf2read.c:6669
#2  0x00000000005e6020 in load_partial_dies (reader=0x7fffffffe0c0,
info_ptr=0x76e73134 <Address 0x76e73134 out of bounds>, building_psymtab=1) at
dwarf2read.c:13945
#3  0x00000000005d2d38 in process_psymtab_comp_unit_reader
(reader=0x7fffffffe0c0, info_ptr=0xd62f9d "\002\060\a", comp_unit_die=0xd689a0,
has_children=1, data=0x7fffffffe190) at dwarf2read.c:5710
#4  0x00000000005d1a6d in init_cutu_and_read_dies (this_cu=0xd593c0,
abbrev_table=0x0, use_existing_cu=0, keep=0, die_reader_func=0x5d2a1f
<process_psymtab_comp_unit_reader>, data=0x7fffffffe190)
    at dwarf2read.c:5143
#5  0x00000000005d320d in process_psymtab_comp_unit (this_cu=0xd593c0,
want_partial_unit=0, pretend_language=language_minimal) at dwarf2read.c:5797
#6  0x00000000005d3923 in dwarf2_build_psymtabs_hard (objfile=0xd47750) at
dwarf2read.c:5977
#7  0x00000000005ce7ac in dwarf2_build_psymtabs (objfile=0xd47750) at
dwarf2read.c:3839
#8  0x00000000004b1f05 in read_psyms (objfile=0xd47750) at elfread.c:1473
#9  0x000000000053aee2 in require_partial_symbols (objfile=0xd47750, verbose=0)
at psymtab.c:92
#10 0x0000000000540c3d in read_symbols (objfile=0xd47750, add_flags=6) at
symfile.c:847
#11 0x000000000054107e in syms_from_objfile_1 (objfile=0xd47750,
addrs=0xd519e0, add_flags=6) at symfile.c:998
#12 0x00000000005410c1 in syms_from_objfile (objfile=0xd47750, addrs=0x0,
add_flags=6) at symfile.c:1014
#13 0x00000000005412b3 in symbol_file_add_with_addrs (abfd=0xd3d4a0,
add_flags=6, addrs=0x0, flags=0, parent=0x0) at symfile.c:1109
#14 0x0000000000541493 in symbol_file_add_from_bfd (abfd=0xd3d4a0, add_flags=6,
addrs=0x0, flags=0, parent=0x0) at symfile.c:1196
#15 0x00000000005414e7 in symbol_file_add (name=0x7fffffffeb26
"gdb_case_6958_4981.bin", add_flags=6, addrs=0x0, flags=0) at symfile.c:1210
#16 0x0000000000541576 in symbol_file_add_main_1 (args=0x7fffffffeb26
"gdb_case_6958_4981.bin", from_tty=1, flags=0) at symfile.c:1235
#17 0x0000000000541522 in symbol_file_add_main (args=0x7fffffffeb26
"gdb_case_6958_4981.bin", from_tty=1) at symfile.c:1226
#18 0x0000000000571fa8 in catch_command_errors (command=0x5414fd
<symbol_file_add_main>, arg=0x7fffffffeb26 "gdb_case_6958_4981.bin",
from_tty=1, mask=6) at exceptions.c:551
#19 0x0000000000575b3a in captured_main (data=0x7fffffffe710) at main.c:946
#20 0x0000000000571ed6 in catch_errors (func=0x574d53 <captured_main>,
func_args=0x7fffffffe710, errstring=0x828fd4 "", mask=6) at exceptions.c:524
#21 0x0000000000575eca in gdb_main (args=0x7fffffffe710) at main.c:1062
#22 0x0000000000406c9e in main (argc=2, argv=0x7fffffffe818) at gdb.c:34

--
Juha KylmÃnen
Research Assistant, OUSPG

-- 
You are receiving this mail because:
You are on the CC list for the bug.