| Summary: | AddressSanitizer: heap-buffer-overflow in sort_cmp | ||
|---|---|---|---|
| Product: | gdb | Reporter: | Tom de Vries <vries> |
| Component: | gdb | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | normal | CC: | tromey |
| Priority: | P2 | ||
| Version: | HEAD | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
When building gdb with -fsanitizer=address and running gdb.base/symbol-without-target_section.exp, I run into: ... (gdb) PASS: gdb.base/symbol-without-target_section.exp: add-symbol-file list main ================================================================= ==6232==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00009b970 at pc 0x000001189bc7 bp 0x7 ffe7eb5ca90 sp 0x7ffe7eb5ca88 READ of size 8 at 0x60b00009b970 thread T0 #0 0x1189bc6 in sort_cmp /data/gdb_versions/devel/src/gdb/objfiles.c:939 #1 0x1191950 in bool __gnu_cxx::__ops::_Iter_comp_iter<bool (*)(obj_section const*, obj_section const*)>::oper ator()<obj_section**, obj_section**>(obj_section**, obj_section**) (/data/gdb_versions/devel/build/gdb/gdb+0x11919 50) #2 0x1191aa9 in obj_section** std::__unguarded_partition<obj_section**, __gnu_cxx::__ops::_Iter_comp_iter<bool (*)(obj_section const*, obj_section const*)> >(obj_section**, obj_section**, obj_section**, __gnu_cxx::__ops::_It er_comp_iter<bool (*)(obj_section const*, obj_section const*)>) (/data/gdb_versions/devel/build/gdb/gdb+0x1191aa9) #3 0x11912af in obj_section** std::__unguarded_partition_pivot<obj_section**, __gnu_cxx::__ops::_Iter_comp_ite r<bool (*)(obj_section const*, obj_section const*)> >(obj_section**, obj_section**, __gnu_cxx::__ops::_Iter_comp_i ter<bool (*)(obj_section const*, obj_section const*)>) (/data/gdb_versions/devel/build/gdb/gdb+0x11912af) #4 0x1190f49 in void std::__introsort_loop<obj_section**, long, __gnu_cxx::__ops::_Iter_comp_iter<bool (*)(obj _section const*, obj_section const*)> >(obj_section**, obj_section**, long, __gnu_cxx::__ops::_Iter_comp_iter<bool (*)(obj_section const*, obj_section const*)>) (/data/gdb_versions/devel/build/gdb/gdb+0x1190f49) #5 0x1190b1b in void std::__sort<obj_section**, __gnu_cxx::__ops::_Iter_comp_iter<bool (*)(obj_section const*, obj_section const*)> >(obj_section**, obj_section**, __gnu_cxx::__ops::_Iter_comp_iter<bool (*)(obj_section const *, obj_section const*)>) /usr/include/c++/7/bits/stl_algo.h:1968 #6 0x118fe99 in void std::sort<obj_section**, bool (*)(obj_section const*, obj_section const*)>(obj_section**, obj_section**, bool (*)(obj_section const*, obj_section const*)) /usr/include/c++/7/bits/stl_algo.h:4868 #7 0x118c594 in update_section_map /data/gdb_versions/devel/src/gdb/objfiles.c:1202 #8 0x118cdc4 in find_pc_section(unsigned long) /data/gdb_versions/devel/src/gdb/objfiles.c:1249 #9 0x1142426 in lookup_minimal_symbol_by_pc_section(unsigned long, obj_section*, lookup_msym_prefer, bound_min imal_symbol*) /data/gdb_versions/devel/src/gdb/minsyms.c:698 #10 0x1143b34 in lookup_minimal_symbol_by_pc(unsigned long) /data/gdb_versions/devel/src/gdb/minsyms.c:934 #11 0x1462162 in find_pc_sect_line(unsigned long, obj_section*, int) /data/gdb_versions/devel/src/gdb/symtab.c :3130 #12 0x1465cd6 in find_function_start_sal_1 /data/gdb_versions/devel/src/gdb/symtab.c:3617 #13 0x146638b in find_function_start_sal(symbol*, bool) /data/gdb_versions/devel/src/gdb/symtab.c:3675 #14 0x1004288 in symbol_to_sal /data/gdb_versions/devel/src/gdb/linespec.c:4457 #15 0xff3396 in convert_linespec_to_sals /data/gdb_versions/devel/src/gdb/linespec.c:2314 #16 0xff5f99 in parse_linespec /data/gdb_versions/devel/src/gdb/linespec.c:2695 #17 0xff9196 in event_location_to_sals /data/gdb_versions/devel/src/gdb/linespec.c:3152 #18 0xffa02d in decode_line_1(event_location const*, int, program_space*, symtab*, int) /data/gdb_versions/dev el/src/gdb/linespec.c:3282 #19 0xaeac97 in list_command /data/gdb_versions/devel/src/gdb/cli/cli-cmds.c:1189 #20 0xaf9725 in do_const_cfunc /data/gdb_versions/devel/src/gdb/cli/cli-decode.c:107 #21 0xb01361 in cmd_func(cmd_list_element*, char const*, int) /data/gdb_versions/devel/src/gdb/cli/cli-decode. c:1952 #22 0x1527385 in execute_command(char const*, int) /data/gdb_versions/devel/src/gdb/top.c:655 #23 0xddf604 in command_handler(char const*) /data/gdb_versions/devel/src/gdb/event-top.c:587 #24 0xddff12 in command_line_handler(std::unique_ptr<char, gdb::xfree_deleter<char> >&&) /data/gdb_versions/de vel/src/gdb/event-top.c:772 #25 0xdde235 in gdb_rl_callback_handler /data/gdb_versions/devel/src/gdb/event-top.c:218 #26 0x171e465 in rl_callback_read_char /data/gdb_versions/devel/src/readline/readline/callback.c:281 #27 0xdddde0 in gdb_rl_callback_read_char_wrapper_noexcept /data/gdb_versions/devel/src/gdb/event-top.c:176 #28 0xdddfc0 in gdb_rl_callback_read_char_wrapper /data/gdb_versions/devel/src/gdb/event-top.c:193 #29 0xddf1c2 in stdin_event_handler(int, void*) /data/gdb_versions/devel/src/gdb/event-top.c:515 #30 0xdd9456 in handle_file_event /data/gdb_versions/devel/src/gdb/event-loop.c:701 #31 0xdd9d5e in gdb_wait_for_event /data/gdb_versions/devel/src/gdb/event-loop.c:827 #32 0xdd7b41 in gdb_do_one_event() /data/gdb_versions/devel/src/gdb/event-loop.c:313 #33 0xdd7be1 in start_event_loop() /data/gdb_versions/devel/src/gdb/event-loop.c:337 #34 0x109bde5 in captured_command_loop /data/gdb_versions/devel/src/gdb/main.c:360 #35 0x109f30b in captured_main /data/gdb_versions/devel/src/gdb/main.c:1198 #36 0x109f39b in gdb_main(captured_main_args*) /data/gdb_versions/devel/src/gdb/main.c:1213 #37 0x8c288a in main /data/gdb_versions/devel/src/gdb/gdb.c:32 #38 0x7fa17c0cff89 in __libc_start_main (/lib64/libc.so.6+0x20f89) #39 0x8c2699 in _start (/data/gdb_versions/devel/build/gdb/gdb+0x8c2699) 0x60b00009b970 is located 0 bytes to the right of 112-byte region [0x60b00009b900,0x60b00009b970) allocated by thread T0 here: #0 0x7fa17f039c20 in operator new(unsigned long) (/usr/lib64/libasan.so.4+0xddc20) #1 0xca0634 in __gnu_cxx::new_allocator<unsigned long>::allocate(unsigned long, void const*) /usr/include/c++/ 7/ext/new_allocator.h:111 #2 0xca05ab in std::allocator_traits<std::allocator<unsigned long> >::allocate(std::allocator<unsigned long>&, unsigned long) /usr/include/c++/7/bits/alloc_traits.h:436 #3 0xca0181 in std::_Vector_base<unsigned long, std::allocator<unsigned long> >::_M_allocate(unsigned long) /u sr/include/c++/7/bits/stl_vector.h:172 #4 0x1438292 in std::vector<unsigned long, std::allocator<unsigned long> >::_M_default_append(unsigned long) / usr/include/c++/7/bits/vector.tcc:571 #5 0x14349b0 in std::vector<unsigned long, std::allocator<unsigned long> >::resize(unsigned long) /usr/include /c++/7/bits/stl_vector.h:692 #6 0x141ca49 in default_symfile_offsets(objfile*, std::vector<other_sections, std::allocator<other_sections> > const&) /data/gdb_versions/devel/src/gdb/symfile.c:638 #7 0x141e53d in syms_from_objfile_1 /data/gdb_versions/devel/src/gdb/symfile.c:979 #8 0x141e735 in syms_from_objfile /data/gdb_versions/devel/src/gdb/symfile.c:998 #9 0x141f353 in symbol_file_add_with_addrs /data/gdb_versions/devel/src/gdb/symfile.c:1099 #10 0x14200c8 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_s ections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /data/gdb_versions/devel/src/gdb/s ymfile.c:1181 #11 0x14201d7 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::a llocator<other_sections> >*, enum_flags<objfile_flag>) /data/gdb_versions/devel/src/gdb/symfile.c:1194 #12 0x14204e3 in symbol_file_add_main_1 /data/gdb_versions/devel/src/gdb/symfile.c:1217 #13 0x1422c1c in symbol_file_command(char const*, int) /data/gdb_versions/devel/src/gdb/symfile.c:1661 #14 0xde6506 in file_command /data/gdb_versions/devel/src/gdb/exec.c:536 #15 0xaf9725 in do_const_cfunc /data/gdb_versions/devel/src/gdb/cli/cli-decode.c:107 #16 0xb01361 in cmd_func(cmd_list_element*, char const*, int) /data/gdb_versions/devel/src/gdb/cli/cli-decode. c:1952 #17 0x1527385 in execute_command(char const*, int) /data/gdb_versions/devel/src/gdb/top.c:655 #18 0xddf604 in command_handler(char const*) /data/gdb_versions/devel/src/gdb/event-top.c:587 #19 0xddff12 in command_line_handler(std::unique_ptr<char, gdb::xfree_deleter<char> >&&) /data/gdb_versions/de vel/src/gdb/event-top.c:772 #20 0xdde235 in gdb_rl_callback_handler /data/gdb_versions/devel/src/gdb/event-top.c:218 #21 0x171e465 in rl_callback_read_char /data/gdb_versions/devel/src/readline/readline/callback.c:281 #22 0xdddde0 in gdb_rl_callback_read_char_wrapper_noexcept /data/gdb_versions/devel/src/gdb/event-top.c:176 #23 0xdddfc0 in gdb_rl_callback_read_char_wrapper /data/gdb_versions/devel/src/gdb/event-top.c:193 #24 0xddf1c2 in stdin_event_handler(int, void*) /data/gdb_versions/devel/src/gdb/event-top.c:515 #25 0xdd9456 in handle_file_event /data/gdb_versions/devel/src/gdb/event-loop.c:701 #26 0xdd9d5e in gdb_wait_for_event /data/gdb_versions/devel/src/gdb/event-loop.c:827 #27 0xdd7b41 in gdb_do_one_event() /data/gdb_versions/devel/src/gdb/event-loop.c:313 #28 0xdd7be1 in start_event_loop() /data/gdb_versions/devel/src/gdb/event-loop.c:337 #29 0x109bde5 in captured_command_loop /data/gdb_versions/devel/src/gdb/main.c:360 SUMMARY: AddressSanitizer: heap-buffer-overflow /data/gdb_versions/devel/src/gdb/objfiles.c:939 in sort_cmp Shadow bytes around the buggy address: 0x0c168000b6d0: 00 00 00 00 00 00 fa fa fa fa fa fa fa f a 00 00 0x0c168000b6e0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 0x0c168000b6f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 0x0c168000b700: 00 fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd 0x0c168000b710: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa =>0x0c168000b720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[ fa]fa 0x0c168000b730: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00 0x0c168000b740: 00 00 00 fa fa fa fa fa fa fa fa fa fd fd fd fd 0x0c168000b750: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0c168000b760: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c168000b770: fa fa fa fa fa fa fa fa 00 00 00 00 00 0 0 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==6232==ABORTING ...