Created attachment 14969 [details] crash seed Hello GDB developers, We recently conducted a fuzzing test on GDB and discovered a heap-use-after-free bug. We would like to provide a detailed description of the bug and seek your assistance in addressing it. version: gdb:GNU gdb (GDB) 13.0.50.20220805-git gcc:gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1) ubuntu: 20.04 command to reproduce: gdb -x command.gdb UAF_2 UAF_2 is attached to this report. command.gdb is attached to the first comment. ASAN report: ================================================================= ==2662213==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f8e47c31800 at pc 0x000000b15103 bp 0x7fff91766210 sp 0x7fff91766208 READ of size 1 at 0x7f8e47c31800 thread T0 #0 0xb15102 in add_pe_exported_sym(minimal_symbol_reader&, char const*, unsigned long, int, read_pe_section_data const*, char const*, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 #1 0xb12287 in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:558:8 #2 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #3 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #4 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #5 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #6 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #7 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #8 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #9 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #10 0x1be873e in symbol_file_add_main_1(char const*, enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #11 0x1be82ea in symbol_file_add_main(char const*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #12 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #13 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #14 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #15 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #16 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #17 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #18 0x7f8e7a7b7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #19 0x433ebd in _start (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x433ebd) 0x7f8e47c31800 is located 442368 bytes inside of 786432-byte region [0x7f8e47bc5800,0x7f8e47c85800) freed by thread T0 here: #0 0x4e2c8d in operator delete(void*) (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x4e2c8d) #1 0xb182c1 in __gnu_cxx::new_allocator<read_pe_section_data>::deallocate(read_pe_section_data*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:133:2 #2 0xb18269 in std::allocator_traits<std::allocator<read_pe_section_data> >::deallocate(std::allocator<read_pe_section_data>&, read_pe_section_data*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:492:13 #3 0xb18203 in std::_Vector_base<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_deallocate(read_pe_section_data*, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:354:4 #4 0xb1882d in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_default_append(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/vector.tcc:675:8 #5 0xb13487 in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::resize(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:940:4 #6 0xb10b1d in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:451:17 #7 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #8 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #9 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #10 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #11 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #12 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #13 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #14 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #15 0x1be873e in symbol_file_add_main_1(char const*, enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #16 0x1be82ea in symbol_file_add_main(char const*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #17 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #18 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #19 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #20 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #21 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #22 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #23 0x7f8e7a7b7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 previously allocated by thread T0 here: #0 0x4e242d in operator new(unsigned long) (/home/root/sp/Fuzz/aflpp_fuzz/Binutils/document_group/batch_x/gdb_1/gdb+0x4e242d) #1 0xb17b62 in __gnu_cxx::new_allocator<read_pe_section_data>::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/ext/new_allocator.h:115:27 #2 0xb17a71 in std::allocator_traits<std::allocator<read_pe_section_data> >::allocate(std::allocator<read_pe_section_data>&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/alloc_traits.h:460:20 #3 0xb179d1 in std::_Vector_base<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:346:20 #4 0xb185b7 in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::_M_default_append(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/vector.tcc:635:34 #5 0xb13487 in std::vector<read_pe_section_data, std::allocator<read_pe_section_data> >::resize(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/stl_vector.h:940:4 #6 0xb10b1d in read_pe_exported_syms(minimal_symbol_reader&, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:451:17 #7 0xb1d543 in coff_read_minsyms(long, unsigned int, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:548:7 #8 0xb1abd0 in coff_symfile_read(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coffread.c:702:3 #9 0x1bf6a0e in read_symbols(objfile*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:772:3 #10 0x1c19531 in syms_from_objfile_1(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:968:3 #11 0x1c180fd in syms_from_objfile(objfile*, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:985:3 #12 0x1be663c in symbol_file_add_with_addrs(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1088:3 #13 0x1be70b3 in symbol_file_add_from_bfd(bfd*, char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>, objfile*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1168:10 #14 0x1be7459 in symbol_file_add(char const*, enum_flags<symfile_add_flag>, std::vector<other_sections, std::allocator<other_sections> >*, enum_flags<objfile_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1181:10 #15 0x1be873e in symbol_file_add_main_1(char const*, enum_flags<symfile_add_flag>, enum_flags<objfile_flag>, unsigned long) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1205:29 #16 0x1be82ea in symbol_file_add_main(char const*, enum_flags<symfile_add_flag>) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/symfile.c:1196:3 #17 0x15c8b73 in symbol_file_add_main_adapter(char const*, int) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:540:3 #18 0x15c6d2c in catch_command_errors(void (*)(char const*, int), char const*, int, bool) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:513:7 #19 0x15c433a in captured_main_1(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1212:8 #20 0x15be28d in captured_main(void*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1319:3 #21 0x15be058 in gdb_main(captured_main_args*) /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/main.c:1344:7 #22 0x4e4f12 in main /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/gdb.c:32:10 #23 0x7f8e7a7b7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 SUMMARY: AddressSanitizer: heap-use-after-free /home/root/sp/Dataset/Binutils/binutils_aflpp/gdb/coff-pe-read.c:137:27 in add_pe_exported_sym(minimal_symbol_reader&, char const*, unsigned long, int, read_pe_section_data const*, char const*, objfile*) Shadow bytes around the buggy address: 0x0ff248f7e2b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e2f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0ff248f7e300:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff248f7e350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2662213==ABORTING Thank you for your attention and support. Best regards, Michael Zhang.
Created attachment 14970 [details] input file of -x option input file of -x option
Can you confirm the location on origin/master with the provided binary? The provided backtrace does not appear to be the same, i.e., add_pe_exported_sym does not appear at all in my backtrace: $ ./gdb -nx -q --data-directory data-directory UAF_2 Reading symbols from UAF_2... Fatal signal: Segmentation fault ----- Backtrace ----- 0x599064 gdb_internal_backtrace_1 ../../src/gdb/bt-utils.c:122 0x599107 _Z22gdb_internal_backtracev ../../src/gdb/bt-utils.c:168 0x782fd4 handle_fatal_signal ../../src/gdb/event-top.c:889 0x783140 handle_sigsegv ../../src/gdb/event-top.c:962 0x7f0dc145fb6f ??? 0x7f0dc1581c11 ??? 0x60b27a read_pe_truncate_name ../../src/gdb/coff-pe-read.c:249 0x60c019 _Z21read_pe_exported_symsR21minimal_symbol_readerP7objfile ../../src/gdb/coff-pe-read.c:498 0x60e0bb coff_read_minsyms ../../src/gdb/coffread.c:543 0x60e629 coff_symfile_read ../../src/gdb/coffread.c:698 0xbd975e read_symbols ../../src/gdb/symfile.c:772 0xbd9e0b syms_from_objfile_1 ../../src/gdb/symfile.c:966 0xbd9ecf syms_from_objfile ../../src/gdb/symfile.c:983 0xbda3aa symbol_file_add_with_addrs ../../src/gdb/symfile.c:1086 0xbda6eb _Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_flagEP7objfile ../../src/gdb/symfile.c:1166 0xbda73a _Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaIS5_EES1_I12objfile_flagE ../../src/gdb/symfile.c:1179 0xbda7ff symbol_file_add_main_1 ../../src/gdb/symfile.c:1203 0xbda7a6 _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE ../../src/gdb/symfile.c:1194 0x90b1d7 symbol_file_add_main_adapter ../../src/gdb/main.c:549 0x90b0ed catch_command_errors ../../src/gdb/main.c:518 0x90c20e captured_main_1 ../../src/gdb/main.c:1203 0x90c820 captured_main ../../src/gdb/main.c:1310 0x90c8bf _Z8gdb_mainP18captured_main_args ../../src/gdb/main.c:1339 0x418c3c main ../../src/gdb/gdb.c:32 --------------------- A fatal error internal to GDB has been detected, further debugging is not possible. GDB will now terminate. This is a bug, please report it. For instructions, see: <https://www.gnu.org/software/gdb/bugs/>. Segmentation fault (core dumped)
Created attachment 15017 [details] hbo hbo
Created attachment 15018 [details] command.gdb
(In reply to Keith Seitz from comment #2) > Can you confirm the location on origin/master with the provided binary? > The provided backtrace does not appear to be the same, i.e., > add_pe_exported_sym > does not appear at all in my backtrace: > > $ ./gdb -nx -q --data-directory data-directory UAF_2 > Reading symbols from UAF_2... > > > Fatal signal: Segmentation fault > ----- Backtrace ----- > 0x599064 gdb_internal_backtrace_1 > ../../src/gdb/bt-utils.c:122 > 0x599107 _Z22gdb_internal_backtracev > ../../src/gdb/bt-utils.c:168 > 0x782fd4 handle_fatal_signal > ../../src/gdb/event-top.c:889 > 0x783140 handle_sigsegv > ../../src/gdb/event-top.c:962 > 0x7f0dc145fb6f ??? > 0x7f0dc1581c11 ??? > 0x60b27a read_pe_truncate_name > ../../src/gdb/coff-pe-read.c:249 > 0x60c019 _Z21read_pe_exported_symsR21minimal_symbol_readerP7objfile > ../../src/gdb/coff-pe-read.c:498 > 0x60e0bb coff_read_minsyms > ../../src/gdb/coffread.c:543 > 0x60e629 coff_symfile_read > ../../src/gdb/coffread.c:698 > 0xbd975e read_symbols > ../../src/gdb/symfile.c:772 > 0xbd9e0b syms_from_objfile_1 > ../../src/gdb/symfile.c:966 > 0xbd9ecf syms_from_objfile > ../../src/gdb/symfile.c:983 > 0xbda3aa symbol_file_add_with_addrs > ../../src/gdb/symfile.c:1086 > 0xbda6eb > _Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10en > um_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_ > flagEP7objfile > ../../src/gdb/symfile.c:1166 > 0xbda73a > _Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sect > ionsSaIS5_EES1_I12objfile_flagE > ../../src/gdb/symfile.c:1179 > 0xbda7ff symbol_file_add_main_1 > ../../src/gdb/symfile.c:1203 > 0xbda7a6 _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE > ../../src/gdb/symfile.c:1194 > 0x90b1d7 symbol_file_add_main_adapter > ../../src/gdb/main.c:549 > 0x90b0ed catch_command_errors > ../../src/gdb/main.c:518 > 0x90c20e captured_main_1 > ../../src/gdb/main.c:1203 > 0x90c820 captured_main > ../../src/gdb/main.c:1310 > 0x90c8bf _Z8gdb_mainP18captured_main_args > ../../src/gdb/main.c:1339 > 0x418c3c main > ../../src/gdb/gdb.c:32 > --------------------- > A fatal error internal to GDB has been detected, further > debugging is not possible. GDB will now terminate. > > This is a bug, please report it. For instructions, see: > <https://www.gnu.org/software/gdb/bugs/>. > > Segmentation fault (core dumped) I am sorry that I did not descripe well. I uploaded the hbo binary file and command.gdb file again in the comment. No relevant search results found. To reproduce this bug, please use the following command: gdb -x command.gdb hbo. If you encounter any issues during the reproduction process, please feel free to let me know.
(In reply to 熊吉思汗 from comment #3) > Created attachment 15017 [details] > hbo > > hbo I am sorry, please ignore this file.
I think this was fixed by https://inbox.sourceware.org/gdb-patches/20230822152335.231921-1-keiths@redhat.com/ and the follow-up patches from Mark.
Fixed by 58abdf88782 (and follow-up patches from mjw).