mirrors/binutils-gdb
0
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2024-11-27 03:54:41 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

gdb: Fix segfault with a big .dynamic section size

Browse Source 
Consider a binary with an erroneous size of the .dynamic section:

$ readelf -S a.out
...
  [24] .dynamic          DYNAMIC          0000000000004c20  00003c20
       000000fffffffa40  0000000000000010  WA       7     0     8
...

This binary causes a segfault in GDB.  GDB is trying to write the .dynamic
section into memory allocated on the stack with alloca().  However, the
allocation silently fails and the subsequent access to the memory is
causing the segfault. (On my node at least.)

Stack allocation is a bad idea for something of variable size that GDB has
no control over.  So I changed the code to heap allocation.

In addition, I changed the type of sect_size to the type that bfd actually
returns.

There should be no user visible change after this.

Approved-By: Tom Tromey <tom@tromey.com>
This commit is contained in:
Felix Willgerodt 2023-11-09 14:08:10 +01:00
parent 5a6c54baa4
commit 4be3bbe89f
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
gdb/solib.c
View File

@ -1501,7 +1501,8 @@ int
gdb_bfd_scan_elf_dyntag (const int desired_dyntag, bfd *abfd, CORE_ADDR *ptr,
CORE_ADDR *ptr_addr)
{
int arch_size, step, sect_size;
int arch_size, step;
bfd_size_type sect_size;
long current_dyntag;
CORE_ADDR dyn_ptr, dyn_addr;
gdb_byte *bufend, *bufstart, *buf;
@ -1546,7 +1547,8 @@ gdb_bfd_scan_elf_dyntag (const int desired_dyntag, bfd *abfd, CORE_ADDR *ptr,
/* Read in .dynamic from the BFD. We will get the actual value
from memory later. */
sect_size = bfd_section_size (sect);
buf = bufstart = (gdb_byte *) alloca (sect_size);
gdb::byte_vector buffer (sect_size);
buf = bufstart = buffer.data ();
if (!bfd_get_section_contents (abfd, sect,
buf, 0, sect_size))
return 0;