Created attachment 13841 [details] Corrupt core file Reproducer from Bug 28666 $ valgrind -q eu-stack --core ./poc2 ==500881== Invalid read of size 8 ==500881== at 0x4851268: __GI_memmove (vg_replace_strmem.c:1271) ==500881== by 0x48994CB: elf32_xlatetom (in /usr/lib/aarch64-linux-gnu/libelf-0.183.so) ==500881== by 0x49232D3: ??? (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x4924977: dwfl_core_file_report (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x10AAB7: ??? (in /usr/bin/eu-stack) ==500881== by 0x4C2ABAF: group_parse (argp-parse.c:257) ==500881== by 0x4C2ABAF: parser_finalize (argp-parse.c:604) ==500881== by 0x4C2ABAF: argp_parse (argp-parse.c:922) ==500881== by 0x10A273: ??? (in /usr/bin/eu-stack) ==500881== by 0x4B6C217: (below main) (libc-start.c:308) ==500881== Address 0x4034000 is 0 bytes after the brk data segment limit 0x4034000 ==500881== ==500881== Invalid read of size 8 ==500881== at 0x4851278: __GI_memmove (vg_replace_strmem.c:1271) ==500881== by 0x48994CB: elf32_xlatetom (in /usr/lib/aarch64-linux-gnu/libelf-0.183.so) ==500881== by 0x49232D3: ??? (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x4924977: dwfl_core_file_report (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x10AAB7: ??? (in /usr/bin/eu-stack) ==500881== by 0x4C2ABAF: group_parse (argp-parse.c:257) ==500881== by 0x4C2ABAF: parser_finalize (argp-parse.c:604) ==500881== by 0x4C2ABAF: argp_parse (argp-parse.c:922) ==500881== by 0x10A273: ??? (in /usr/bin/eu-stack) ==500881== by 0x4B6C217: (below main) (libc-start.c:308) ==500881== Address 0x4034008 is 8 bytes after the brk data segment limit 0x4034000 ==500881== ==500881== Invalid read of size 8 ==500881== at 0x4851280: __GI_memmove (vg_replace_strmem.c:1271) ==500881== by 0x48994CB: elf32_xlatetom (in /usr/lib/aarch64-linux-gnu/libelf-0.183.so) ==500881== by 0x49232D3: ??? (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x4924977: dwfl_core_file_report (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x10AAB7: ??? (in /usr/bin/eu-stack) ==500881== by 0x4C2ABAF: group_parse (argp-parse.c:257) ==500881== by 0x4C2ABAF: parser_finalize (argp-parse.c:604) ==500881== by 0x4C2ABAF: argp_parse (argp-parse.c:922) ==500881== by 0x10A273: ??? (in /usr/bin/eu-stack) ==500881== by 0x4B6C217: (below main) (libc-start.c:308) ==500881== Address 0x4034010 is 16 bytes after the brk data segment limit 0x4034000 ==500881== ==500881== Invalid read of size 8 ==500881== at 0x4851288: __GI_memmove (vg_replace_strmem.c:1271) ==500881== by 0x48994CB: elf32_xlatetom (in /usr/lib/aarch64-linux-gnu/libelf-0.183.so) ==500881== by 0x49232D3: ??? (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x4924977: dwfl_core_file_report (in /usr/lib/aarch64-linux-gnu/libdw-0.183.so) ==500881== by 0x10AAB7: ??? (in /usr/bin/eu-stack) ==500881== by 0x4C2ABAF: group_parse (argp-parse.c:257) ==500881== by 0x4C2ABAF: parser_finalize (argp-parse.c:604) ==500881== by 0x4C2ABAF: argp_parse (argp-parse.c:922) ==500881== by 0x10A273: ??? (in /usr/bin/eu-stack) ==500881== by 0x4B6C217: (below main) (libc-start.c:308) ==500881== Address 0x4034018 is 24 bytes after the brk data segment limit 0x4034000
Proposed patch: https://sourceware.org/pipermail/elfutils-devel/2021q4/004507.html
(In reply to Mark Wielaard from comment #1) > Proposed patch: > https://sourceware.org/pipermail/elfutils-devel/2021q4/004507.html With that patch applied I can no longer reproduce the issue. Thanks!
Thanks for testing. Applied as: commit 78ecba0926216e0ad90b71f789636d1e0a9777ca Author: Mark Wielaard <mark@klomp.org> Date: Thu Dec 9 21:24:18 2021 +0100 libdwfl: Don't try to convert too many dyns in dwfl_link_map_report When trying to read (corrupt) dynamic entries from a core file we only want to read and convert the entries we could read. Also make sure we don't try to allocate too bug a buffer. Signed-off-by: Mark Wielaard <mark@klomp.org>