Suspected bug in DW_OP_addr handling

Yichao Yu yyc1992@gmail.com
Sat May 7 03:54:19 GMT 2022


I noticed that gdb unwind failed with read of invalid memory address
when I used `DW_OP_addr` in my unwind info. Upon checking, it seems
that the handling of this operation in the dwarf interpreter is very
suspicious.

The interpreter for the op code has a comment[1] sayijng,

> Some versions of GCC emit DW_OP_addr before
> DW_OP_GNU_push_tls_address. In this case the value is an
> index, not an address.

However, the code appears to check for exactly the opposite condition
`op_ptr >= op_end || *op_ptr != DW_OP_GNU_push_tls_address` to decide
whether the result should be used as index. This was added 12 years
ago in commit ac56253ddece [2].

Am I missing something or is this a long-standing bug?

Yichao


[1] https://github.com/bminor/binutils-gdb/blob/2392dc0f8e243a4f5f9d0db6cee64a1698886e56/gdb/dwarf2/expr.c#L1574-L1585
[2] https://github.com/bminor/binutils-gdb/commit/ac56253ddece35aff4402b848f88ba40856102b1#diff-9c28445d6bd87cff9dcb11dc4b58ff0e605a078b08ceb37da22d8d2c7b866f6aR406


More information about the Gdb mailing list