Bug 30410 - bug in rust analyzer
Summary: bug in rust analyzer
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: rust (show other bugs)
Version: HEAD
: P2 normal
Target Milestone: 14.1
Assignee: Tom Tromey
URL:
Keywords:
: 30660 (view as bug list)
Depends on:
Blocks:
 
Reported: 2023-05-01 12:09 UTC by 羿天阳
Modified: 2023-07-21 13:24 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
a ELF file wrote in rust (1.62 MB, application/x-sharedlib)
2023-05-01 12:09 UTC, 羿天阳
Details

Note You need to log in before you can comment on or make changes to this bug.
Description 羿天阳 2023-05-01 12:09:40 UTC
Created attachment 14858 [details]
a ELF file wrote in rust

Analyzing the elf file in attachment, input some invalid operation like "p [$rdi]" will cause a bug.

gdb output as the following.

$ ./gdb buggy
(gdb) p [$rdi]
rust-parse.c:1361: internal-error: parse_binop: Assertion `!required' failed.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
----- Backtrace -----
0x55788f1ddf80 gdb_internal_backtrace_1
        /home/yty/study/binutils-gdb/gdb/bt-utils.c:122
0x55788f1ddf80 _Z22gdb_internal_backtracev
        /home/yty/study/binutils-gdb/gdb/bt-utils.c:168
0x55788f5f2a74 internal_vproblem
        /home/yty/study/binutils-gdb/gdb/utils.c:401
0x55788f5f2d30 _Z15internal_verrorPKciS0_P13__va_list_tag
        /home/yty/study/binutils-gdb/gdb/utils.c:481
0x55788f7479f4 _Z18internal_error_locPKciS0_z
        /home/yty/study/binutils-gdb/gdbsupport/errors.cc:58
0x55788f4ee489 _ZN11rust_parser11parse_binopEb
        /home/yty/study/binutils-gdb/gdb/rust-parse.c:1361
0x55788f4ee7a6 _ZN11rust_parser11parse_rangeEv
        /home/yty/study/binutils-gdb/gdb/rust-parse.c:1483
0x55788f4f02d8 _ZN11rust_parser10parse_exprEv
        /home/yty/study/binutils-gdb/gdb/rust-parse.c:1509
0x55788f4f02d8 _ZN11rust_parser17parse_entry_pointEv
        /home/yty/study/binutils-gdb/gdb/rust-parse.c:274
0x55788f4f02d8 _ZNK13rust_language6parserEP12parser_state
        /home/yty/study/binutils-gdb/gdb/rust-parse.c:2141
0x55788f446ac0 parse_exp_in_context
        /home/yty/study/binutils-gdb/gdb/parse.c:433
0x55788f446e0a _Z16parse_expressionPKcP23innermost_block_trackerb
        /home/yty/study/binutils-gdb/gdb/parse.c:469
0x55788f44bd75 process_print_command_args
        /home/yty/study/binutils-gdb/gdb/printcmd.c:1318
0x55788f44c32f print_command_1
        /home/yty/study/binutils-gdb/gdb/printcmd.c:1332
0x55788f2134f4 _Z8cmd_funcP16cmd_list_elementPKci
        cli/cli-decode.c:2735
0x55788f584871 _Z15execute_commandPKci
        /home/yty/study/binutils-gdb/gdb/top.c:687
0x55788f306c34 _Z15command_handlerPKc
        /home/yty/study/binutils-gdb/gdb/event-top.c:619
0x55788f307f53 _Z20command_line_handlerOSt10unique_ptrIcN3gdb13xfree_deleterIcEEE
        /home/yty/study/binutils-gdb/gdb/event-top.c:855
0x55788f30769c gdb_rl_callback_handler
        /home/yty/study/binutils-gdb/gdb/event-top.c:249
0x55788f63ccc7 rl_callback_read_char
        /home/yty/study/binutils-gdb/readline/readline/callback.c:290
0x55788f3066cd gdb_rl_callback_read_char_wrapper_noexcept
        /home/yty/study/binutils-gdb/gdb/event-top.c:191
0x55788f307553 gdb_rl_callback_read_char_wrapper
        /home/yty/study/binutils-gdb/gdb/event-top.c:224
0x55788f305e9f stdin_event_handler
        /home/yty/study/binutils-gdb/gdb/event-top.c:544
0x55788f748455 gdb_wait_for_event
        /home/yty/study/binutils-gdb/gdbsupport/event-loop.cc:694
0x55788f748e85 gdb_wait_for_event
        /home/yty/study/binutils-gdb/gdbsupport/event-loop.cc:593
0x55788f748e85 _Z16gdb_do_one_eventi
        /home/yty/study/binutils-gdb/gdbsupport/event-loop.cc:264
0x55788f3e71b9 start_event_loop
        /home/yty/study/binutils-gdb/gdb/main.c:411
0x55788f3e71b9 captured_command_loop
        /home/yty/study/binutils-gdb/gdb/main.c:475
0x55788f3e8db4 captured_main
        /home/yty/study/binutils-gdb/gdb/main.c:1318
0x55788f3e8db4 _Z8gdb_mainP18captured_main_args
        /home/yty/study/binutils-gdb/gdb/main.c:1337
0x55788f12c0bf main
        /home/yty/study/binutils-gdb/gdb/gdb.c:32
---------------------
rust-parse.c:1361: internal-error: parse_binop: Assertion `!required' failed.
A problem internal to GDB has been detected,
further debugging may prove unreliable.

My enviroment is Ubuntu 22.04 LTS. My gdb version is:

$ gdb -v
GNU gdb (GDB) 14.0.50.20230501-git
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Besides, on release version 12.1, there is also the same bug.Firstly I found the bug on my release version, and test it on the HEAD version, found the same bug.

$ gdb -v
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

I don't have the soure code of the attachment. It is wrote in rust. It is a challange named "babyheap" in Aliyun CTF.
Comment 1 Tom Tromey 2023-05-01 16:01:03 UTC
I have a patch.
Comment 2 Sourceware Commits 2023-05-01 16:17:00 UTC
The master branch has been updated by Tom Tromey <tromey@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=87c84f07a0a1b7e12b6a0c9b21cc0e021e460786

commit 87c84f07a0a1b7e12b6a0c9b21cc0e021e460786
Author: Tom Tromey <tromey@adacore.com>
Date:   Mon May 1 10:10:29 2023 -0600

    Fix crash in Rust expression parser
    
    A user found that an array expression with just a single value (like
    "[23]") caused the Rust expression parser to crash.
    
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30410
Comment 3 Tom Tromey 2023-05-01 16:22:41 UTC
I don't think the file matters, it's just a bug in the
expression parser.
Comment 4 Tom Tromey 2023-07-21 13:24:29 UTC
*** Bug 30660 has been marked as a duplicate of this bug. ***