Bug 22209 - invalid memory read in find_abstract_instance_name
Summary: invalid memory read in find_abstract_instance_name
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.30
: P2 normal
Target Milestone: 2.30
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-26 06:48 UTC by Agostino Sarubbo
Modified: 2017-09-26 13:06 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed: 2017-09-26 00:00:00

Attachments
stacktrace (720 bytes, text/plain)
2017-09-26 06:49 UTC, Agostino Sarubbo 		Details
testcase (10.19 KB, application/x-object)
2017-09-26 06:49 UTC, Agostino Sarubbo 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo 2017-09-26 06:48:52 UTC 
On master at 1da5c9a485f3dcac4c45e96ef4b7dae5948314b5:
# nm -V
GNU nm (Gentoo git) 2.29.51.20170925


Command to reproduce:
# nm -A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D $FILE
Comment 1 Agostino Sarubbo 2017-09-26 06:49:07 UTC 
Created attachment 10482 [details]
stacktrace
Comment 2 Agostino Sarubbo 2017-09-26 06:49:36 UTC 
Created attachment 10483 [details]
testcase
Comment 3 Alan Modra 2017-09-26 10:43:19 UTC 
The testcase doesn't segfault for me, but I can see why it might.
Comment 4 Sourceware Commits 2017-09-26 12:49:38 UTC 
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1b86808a86077722ee4f42ff97f836b12420bb2a

commit 1b86808a86077722ee4f42ff97f836b12420bb2a
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Sep 26 21:47:24 2017 +0930

    PR22209, invalid memory read in find_abstract_instance_name
    
    This patch adds bounds checking for DW_FORM_ref_addr die refs, and
    calculates them relative to the first .debug_info section.  See the
    big comment for why calculating relative to the current .debug_info
    section was wrong for relocatable object files.
    
    	PR 22209
    	* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
    	(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
    	to stash->info_ptr_memory, and check die_ref is within that memory.
    	Set info_ptr_end correctly when another CU is refd.  Check die_ref
    	for DW_FORM_ref4 etc. is within CU.
Comment 5 Alan Modra 2017-09-26 13:06:26 UTC 
Fixed