Bug 22209 - invalid memory read in find_abstract_instance_name
Summary: invalid memory read in find_abstract_instance_name
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.30
: P2 normal
Target Milestone: 2.30
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-26 06:48 UTC by Agostino Sarubbo
Modified: 2017-09-26 13:06 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2017-09-26 00:00:00


Attachments
stacktrace (720 bytes, text/plain)
2017-09-26 06:49 UTC, Agostino Sarubbo
Details
testcase (10.19 KB, application/x-object)
2017-09-26 06:49 UTC, Agostino Sarubbo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo 2017-09-26 06:48:52 UTC
On master at 1da5c9a485f3dcac4c45e96ef4b7dae5948314b5:
# nm -V
GNU nm (Gentoo git) 2.29.51.20170925


Command to reproduce:
# nm -A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D $FILE
Comment 1 Agostino Sarubbo 2017-09-26 06:49:07 UTC
Created attachment 10482 [details]
stacktrace
Comment 2 Agostino Sarubbo 2017-09-26 06:49:36 UTC
Created attachment 10483 [details]
testcase
Comment 3 Alan Modra 2017-09-26 10:43:19 UTC
The testcase doesn't segfault for me, but I can see why it might.
Comment 4 cvs-commit@gcc.gnu.org 2017-09-26 12:49:38 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1b86808a86077722ee4f42ff97f836b12420bb2a

commit 1b86808a86077722ee4f42ff97f836b12420bb2a
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Sep 26 21:47:24 2017 +0930

    PR22209, invalid memory read in find_abstract_instance_name
    
    This patch adds bounds checking for DW_FORM_ref_addr die refs, and
    calculates them relative to the first .debug_info section.  See the
    big comment for why calculating relative to the current .debug_info
    section was wrong for relocatable object files.
    
    	PR 22209
    	* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
    	(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
    	to stash->info_ptr_memory, and check die_ref is within that memory.
    	Set info_ptr_end correctly when another CU is refd.  Check die_ref
    	for DW_FORM_ref4 etc. is within CU.
Comment 5 Alan Modra 2017-09-26 13:06:26 UTC
Fixed