Created attachment 14968 [details]
input file of -x option

input file of -x option

The supplied executable does not segfault gdb in the reported location:

$ ./gdb -nx -q --data-directory data-directory UAF_2
Reading symbols from UAF_2...


Fatal signal: Segmentation fault
----- Backtrace -----
0x599064 gdb_internal_backtrace_1
	../../src/gdb/bt-utils.c:122
0x599107 _Z22gdb_internal_backtracev
	../../src/gdb/bt-utils.c:168
0x782fd4 handle_fatal_signal
	../../src/gdb/event-top.c:889
0x783140 handle_sigsegv
	../../src/gdb/event-top.c:962
0x7fe5a7d7eb6f ???
0x6107a5 process_coff_symbol
	../../src/gdb/coffread.c:1572
0x60f847 coff_symtab_read
	../../src/gdb/coffread.c:1190
0x60e0dd coff_read_minsyms
	../../src/gdb/coffread.c:549
0x60e629 coff_symfile_read
	../../src/gdb/coffread.c:698
0xbd975e read_symbols
	../../src/gdb/symfile.c:772
0xbd9e0b syms_from_objfile_1
	../../src/gdb/symfile.c:966
0xbd9ecf syms_from_objfile
	../../src/gdb/symfile.c:983
0xbda3aa symbol_file_add_with_addrs
	../../src/gdb/symfile.c:1086
0xbda6eb _Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_flagEP7objfile
	../../src/gdb/symfile.c:1166
0xbda73a _Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaIS5_EES1_I12objfile_flagE
	../../src/gdb/symfile.c:1179
0xbda7ff symbol_file_add_main_1
	../../src/gdb/symfile.c:1203
0xbda7a6 _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE
	../../src/gdb/symfile.c:1194
0x90b1d7 symbol_file_add_main_adapter
	../../src/gdb/main.c:549
0x90b0ed catch_command_errors
	../../src/gdb/main.c:518
0x90c20e captured_main_1
	../../src/gdb/main.c:1203
0x90c820 captured_main
	../../src/gdb/main.c:1310
0x90c8bf _Z8gdb_mainP18captured_main_args
	../../src/gdb/main.c:1339
0x418c3c main
	../../src/gdb/gdb.c:32
---------------------
A fatal error internal to GDB has been detected, further
debugging is not possible.  GDB will now terminate.

This is a bug, please report it.  For instructions, see:
<https://www.gnu.org/software/gdb/bugs/>.

Segmentation fault (core dumped)

Did you attach the correct binary to this bug?

(In reply to Keith Seitz from comment #2)
> The supplied executable does not segfault gdb in the reported location:
> 
> $ ./gdb -nx -q --data-directory data-directory UAF_2
> Reading symbols from UAF_2...
> 
> 
> Fatal signal: Segmentation fault
> ----- Backtrace -----
> 0x599064 gdb_internal_backtrace_1
> 	../../src/gdb/bt-utils.c:122
> 0x599107 _Z22gdb_internal_backtracev
> 	../../src/gdb/bt-utils.c:168
> 0x782fd4 handle_fatal_signal
> 	../../src/gdb/event-top.c:889
> 0x783140 handle_sigsegv
> 	../../src/gdb/event-top.c:962
> 0x7fe5a7d7eb6f ???
> 0x6107a5 process_coff_symbol
> 	../../src/gdb/coffread.c:1572
> 0x60f847 coff_symtab_read
> 	../../src/gdb/coffread.c:1190
> 0x60e0dd coff_read_minsyms
> 	../../src/gdb/coffread.c:549
> 0x60e629 coff_symfile_read
> 	../../src/gdb/coffread.c:698
> 0xbd975e read_symbols
> 	../../src/gdb/symfile.c:772
> 0xbd9e0b syms_from_objfile_1
> 	../../src/gdb/symfile.c:966
> 0xbd9ecf syms_from_objfile
> 	../../src/gdb/symfile.c:983
> 0xbda3aa symbol_file_add_with_addrs
> 	../../src/gdb/symfile.c:1086
> 0xbda6eb
> _Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10en
> um_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_
> flagEP7objfile
> 	../../src/gdb/symfile.c:1166
> 0xbda73a
> _Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sect
> ionsSaIS5_EES1_I12objfile_flagE
> 	../../src/gdb/symfile.c:1179
> 0xbda7ff symbol_file_add_main_1
> 	../../src/gdb/symfile.c:1203
> 0xbda7a6 _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE
> 	../../src/gdb/symfile.c:1194
> 0x90b1d7 symbol_file_add_main_adapter
> 	../../src/gdb/main.c:549
> 0x90b0ed catch_command_errors
> 	../../src/gdb/main.c:518
> 0x90c20e captured_main_1
> 	../../src/gdb/main.c:1203
> 0x90c820 captured_main
> 	../../src/gdb/main.c:1310
> 0x90c8bf _Z8gdb_mainP18captured_main_args
> 	../../src/gdb/main.c:1339
> 0x418c3c main
> 	../../src/gdb/gdb.c:32
> ---------------------
> A fatal error internal to GDB has been detected, further
> debugging is not possible.  GDB will now terminate.
> 
> This is a bug, please report it.  For instructions, see:
> <https://www.gnu.org/software/gdb/bugs/>.
> 
> Segmentation fault (core dumped)
> 
> Did you attach the correct binary to this bug?

To reproduce this bug, please use the following command: gdb -x command.gdb UAF_2. The necessary files for this command are as follows: command.gdb (attachment_14968) and UAF_2 (attachment_14967). You can find command.gdb attached to the first comment, and UAF_2 attached as attachment_14967. If you encounter any issues during the reproduction process, please feel free to let me know.

Created attachment 15019 [details]
UAF_2

Created attachment 15020 [details]
command.gdb

I uploaded the command.gdb and UAF_2 file in the comment below.

For me this crashes in read_pe_truncate_name because
read_pe_exported_syms seems to make a pointer to invalid memory.
If there's a crash in the Ada decoder, that isn't a case of GIGO,
what I'd really like to know is the name being decoded.

My apologies, this DOES reproduce (as Tom notes). The thing I
ignored was ASAN. [The crash I reported was recently fixed by
Alan Modra's "gdb: warn unused result for bfd IO functions".]

[Probably TMI for Tom, but for anyone following along...]

In process_coff_symbol, we are processing a symbol with name "44",
i.e, just digits. The language of this objfile is language_unknown.

process_coff_symbol calls general_symbol_info::compute_and_set_names.
This eventually calls symbol_find_demangled_name with linkage_name_copy
set to "44". Since the objfile's language is unknown, symbol_find_linkage_name
iterates over all languages, calling the language's sniff_from_mangled_name
method. This does nothing for all the languages until it hits language_ada.

ada_language::sniff_from_mangled immediately calls ada_decode.

The code here essentially skips to the last block which attempts to
remove trailing digits:

1370   /* Remove trailing __{digit}+ or trailing ${digit}+.  */
1371
1372   if (len0 > 1 && isdigit (encoded[len0 - 1]))
1373     {
1374       i = len0 - 2;
1375       while ((i >= 0 && isdigit (encoded[i]))
1376              || (i >= 1 && encoded[i] == '_' && isdigit (encoded[i - 1])))
1377         i -= 1;
1378       if (i > 1 && encoded[i] == '_' && encoded[i - 1] == '_')
1379         len0 = i - 1;
1380       else if (encoded[i] == '$')
1381         len0 = i;
1382     }

When we get to 1372, len0 is strlen("44") which is 2. encoded[2 - 1] = "4" is
a digit, and we set i = len0 - 2 = 0.

Now the while loop: i == 0 and encoded[0] is "4", so that passes the first
test, and we subtract 1 from i, setting it to -1. Now i is no longer >= 0
or >= 1, so the while loop escapes. Finally, we hit the final "else if"
encoded[-1] == '$' on line 1380, which causes the observed buffer overflow.

Thanks for the analysis, Keith.
I'll send a patch soon.

The master branch has been updated by Tom Tromey <tromey@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=033bc52bb6190393c8eed80925fa78cc35b40c6d

commit 033bc52bb6190393c8eed80925fa78cc35b40c6d
Author: Tom Tromey <tromey@adacore.com>
Date:   Wed Aug 16 11:29:19 2023 -0600

    Avoid buffer overflow in ada_decode
    
    A bug report pointed out a buffer overflow in ada_decode, which Keith
    helpfully analyzed.  ada_decode had a logic error when the input was
    all digits.  While this isn't valid -- and would probably only appear
    in fuzzer tests -- it still should be handled properly.
    
    This patch adds a missing bounds check.  Tested with the self-tests in
    an asan build.
    
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30639
    Reviewed-by: Keith Seitz <keiths@redhat.com>

Fixed.