This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
[patch] Fix crash on reading stabs
- From: Jan Kratochvil <jan dot kratochvil at redhat dot com>
- To: gdb-patches at sourceware dot org
- Cc: Joost van der Sluis <joost at cnoc dot nl>
- Date: Tue, 17 Nov 2009 17:29:58 +0100
- Subject: [patch] Fix crash on reading stabs
Hi,
there is a crash on reading stabs fpc binary:
https://bugzilla.redhat.com/show_bug.cgi?id=537837
Program received signal SIGSEGV, Segmentation fault.
0x000000000069db3d in read_dbx_symtab (objfile=0x1daf5f0) at dbxread.c:1369
1369 if ((namestring[0] == '-' && namestring[1] == 'l')
(gdb) p/x nlist.n_strx
$7 = 0xfffffff8
(gdb) p sizeof(nlist.n_strx)
$10 = 8
Below the patch context is:
namestring = (nlist->n_strx + file_string_table_offset
+ DBX_STRINGTAB (objfile));
so IMO the `(unsigned)' cast is excessive as it does not match the expression
below. Such cast is there since the GDB "Initial revision" (1999).
`n_strx' type:
struct internal_nlist
{
unsigned long n_strx; /* Index into string table of name. */
...
};
Regression tested on {x86_64,x86_64-m32,i686}-fedora12-linux-gnu which does not
mean anything with the default DWARF debug info. It was hanging for stabs so
tried just a large part of gdb.base/*.exp on x86_64-m32 - `unix/-gstabs+/-m32'.
If it isn't obviously approved please feel free to drop it as one should not
use STABS in the first place.
Regards,
Jan
gdb/
2009-11-17 Jan Kratochvil <jan.kratochvil@redhat.com>
* dbxread.c (set_namestring): Remove cast to unsigned. Check N_STRX
overflow.
--- a/gdb/dbxread.c
+++ b/gdb/dbxread.c
@@ -965,8 +965,9 @@ set_namestring (struct objfile *objfile, const struct internal_nlist *nlist)
{
char *namestring;
- if (((unsigned) nlist->n_strx + file_string_table_offset)
- >= DBX_STRINGTAB_SIZE (objfile))
+ if (nlist->n_strx + file_string_table_offset
+ >= DBX_STRINGTAB_SIZE (objfile)
+ || nlist->n_strx + file_string_table_offset < nlist->n_strx)
{
complaint (&symfile_complaints, _("bad string table offset in symbol %d"),
symnum);