* Fix gdb crash during .debug_line parsing
@ 2008-11-05 12:53 Andreas Schwab
2008-11-09 17:25 ` Joel Brobecker
0 siblings, 1 reply; 5+ messages in thread
From: Andreas Schwab @ 2008-11-05 12:53 UTC (permalink / raw)
To: gdb-patches
gdb should not crash when the line number program has been corrupted.
Andreas.
2008-11-05 Andreas Schwab <schwab@suse.de>
* dwarf2read.c (dwarf_decode_lines): Add checks for corrupted line
number programs.
Index: dwarf2read.c
===================================================================
RCS file: /cvs/src/src/gdb/dwarf2read.c,v
retrieving revision 1.290
diff -u -a -p -u -p -a -r1.290 dwarf2read.c
--- dwarf2read.c 24 Oct 2008 18:21:00 -0000 1.290
+++ dwarf2read.c 5 Nov 2008 12:44:15 -0000
@@ -7072,7 +7072,7 @@ dwarf_decode_lines (struct line_header *
int basic_block = 0;
int end_sequence = 0;
- if (!decode_for_pst_p && lh->num_file_names >= file)
+ if (!decode_for_pst_p && file != 0 && lh->num_file_names >= file)
{
/* Start a subfile for the current file of the state machine. */
/* lh->include_dirs and lh->file_names are 0-based, but the
@@ -7090,6 +7090,13 @@ dwarf_decode_lines (struct line_header *
/* Decode the table. */
while (!end_sequence)
{
+ if (line_ptr >= line_end)
+ {
+ complaint (&symfile_complaints,
+ _("mangled .debug_line section"));
+ break;
+ }
+
op_code = read_1_byte (abfd, line_ptr);
line_ptr += 1;
@@ -7102,7 +7109,7 @@ dwarf_decode_lines (struct line_header *
line += lh->line_base + (adj_opcode % lh->line_range);
if (lh->num_file_names < file)
dwarf2_debug_line_missing_file_complaint ();
- else
+ else if (file != 0)
{
lh->file_names[file - 1].included_p = 1;
if (!decode_for_pst_p)
@@ -7135,7 +7142,7 @@ dwarf_decode_lines (struct line_header *
if (lh->num_file_names < file)
dwarf2_debug_line_missing_file_complaint ();
- else
+ else if (file != 0)
{
lh->file_names[file - 1].included_p = 1;
if (!decode_for_pst_p)
@@ -7184,7 +7191,7 @@ dwarf_decode_lines (struct line_header *
case DW_LNS_copy:
if (lh->num_file_names < file)
dwarf2_debug_line_missing_file_complaint ();
- else
+ else if (file != 0)
{
lh->file_names[file - 1].included_p = 1;
if (!decode_for_pst_p)
@@ -7220,7 +7227,7 @@ dwarf_decode_lines (struct line_header *
file = read_unsigned_leb128 (abfd, line_ptr, &bytes_read);
line_ptr += bytes_read;
- if (lh->num_file_names < file)
+ if (file == 0 || lh->num_file_names < file)
dwarf2_debug_line_missing_file_complaint ();
else
{
--
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: Fix gdb crash during .debug_line parsing
2008-11-05 12:53 Fix gdb crash during .debug_line parsing Andreas Schwab
@ 2008-11-09 17:25 ` Joel Brobecker
2008-11-09 18:32 ` Andreas Schwab
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Joel Brobecker @ 2008-11-09 17:25 UTC (permalink / raw)
To: Andreas Schwab; +Cc: gdb-patches
[-- Attachment #1: Type: text/plain, Size: 1582 bytes --]
> 2008-11-05 Andreas Schwab <schwab@suse.de>
>
> * dwarf2read.c (dwarf_decode_lines): Add checks for corrupted line
> number programs.
Funny, we had a very similar problem not very long ago...
> - if (!decode_for_pst_p && lh->num_file_names >= file)
> + if (!decode_for_pst_p && file != 0 && lh->num_file_names >= file)
I believe that this hunk is useless, since this check is at the
beginning of the while loop where file is initialized to 1, so
file can never be zero at this point.
> @@ -7102,7 +7109,7 @@ dwarf_decode_lines (struct line_header *
> line += lh->line_base + (adj_opcode % lh->line_range);
> if (lh->num_file_names < file)
> dwarf2_debug_line_missing_file_complaint ();
> - else
> + else if (file != 0)
> {
> lh->file_names[file - 1].included_p = 1;
> if (!decode_for_pst_p)
The problem I see with your approach is taht we don't get to
issue a complaint if file is zero.
Attached is the patch that we have checked in our tree. It handles
the incorrect file number as well as a missing endÂsequence. Could
you test it on your side to see if it fixes your problem(s)?
2008-11-09 Jerome Guitton <guitton@adacore.com>
* dwarf2read.c (dwarf2_debug_line_missing_end_sequence_complaint):
New function.
(dwarf_decode_lines): Detect null file numbers. Detect the end of
the line program sequence when no end sequence is emitted.
If it works for you, then I'll do a round of testing and commit
(I might have to fix some space-vs-tabs issues as well, sigh...).
--
Joel
[-- Attachment #2: jerome.diff --]
[-- Type: text/plain, Size: 2788 bytes --]
Index: dwarf2read.c
===================================================================
--- dwarf2read.c (revision 134708)
+++ dwarf2read.c (revision 134718)
@@ -695,6 +695,13 @@ dwarf2_debug_line_missing_file_complaint
}
static void
+dwarf2_debug_line_missing_end_sequence_complaint (void)
+{
+ complaint (&symfile_complaints,
+ _(".debug_line section has line program sequence without an end"));
+}
+
+static void
dwarf2_complex_location_expr_complaint (void)
{
complaint (&symfile_complaints, _("location expression too complex"));
@@ -7253,6 +7260,11 @@ dwarf_decode_lines (struct line_header *
{
op_code = read_1_byte (abfd, line_ptr);
line_ptr += 1;
+ if (line_ptr > line_end)
+ {
+ dwarf2_debug_line_missing_end_sequence_complaint ();
+ break;
+ }
if (op_code >= lh->opcode_base)
{
@@ -7261,7 +7273,7 @@ dwarf_decode_lines (struct line_header *
address += (adj_opcode / lh->line_range)
* lh->minimum_instruction_length;
line += lh->line_base + (adj_opcode % lh->line_range);
- if (lh->num_file_names < file)
+ if (lh->num_file_names < file || file == 0)
dwarf2_debug_line_missing_file_complaint ();
else
{
@@ -7293,15 +7305,6 @@ dwarf_decode_lines (struct line_header *
{
case DW_LNE_end_sequence:
end_sequence = 1;
-
- if (lh->num_file_names < file)
- dwarf2_debug_line_missing_file_complaint ();
- else
- {
- lh->file_names[file - 1].included_p = 1;
- if (!decode_for_pst_p)
- record_line (current_subfile, 0, address);
- }
break;
case DW_LNE_set_address:
address = read_address (abfd, line_ptr, cu, &bytes_read);
@@ -7343,7 +7346,7 @@ dwarf_decode_lines (struct line_header *
}
break;
case DW_LNS_copy:
- if (lh->num_file_names < file)
+ if (lh->num_file_names < file || file == 0)
dwarf2_debug_line_missing_file_complaint ();
else
{
@@ -7381,7 +7384,7 @@ dwarf_decode_lines (struct line_header *
file = read_unsigned_leb128 (abfd, line_ptr, &bytes_read);
line_ptr += bytes_read;
- if (lh->num_file_names < file)
+ if (lh->num_file_names < file || file == 0)
dwarf2_debug_line_missing_file_complaint ();
else
{
@@ -7432,6 +7435,14 @@ dwarf_decode_lines (struct line_header *
}
}
}
+ if (lh->num_file_names < file || file == 0)
+ dwarf2_debug_line_missing_file_complaint ();
+ else
+ {
+ lh->file_names[file - 1].included_p = 1;
+ if (!decode_for_pst_p)
+ record_line (current_subfile, 0, address);
+ }
}
if (decode_for_pst_p)
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: Fix gdb crash during .debug_line parsing
2008-11-09 17:25 ` Joel Brobecker
@ 2008-11-09 18:32 ` Andreas Schwab
2008-11-10 19:05 ` Joel Brobecker
2008-11-16 8:18 ` Joel Brobecker
2 siblings, 0 replies; 5+ messages in thread
From: Andreas Schwab @ 2008-11-09 18:32 UTC (permalink / raw)
To: Joel Brobecker; +Cc: gdb-patches
Joel Brobecker <brobecker@adacore.com> writes:
> Attached is the patch that we have checked in our tree. It handles
> the incorrect file number as well as a missing endÂsequence. Could
> you test it on your side to see if it fixes your problem(s)?
Looks good, and better than my patch anyway.
Andreas.
--
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Fix gdb crash during .debug_line parsing
2008-11-09 17:25 ` Joel Brobecker
2008-11-09 18:32 ` Andreas Schwab
@ 2008-11-10 19:05 ` Joel Brobecker
2008-11-16 8:18 ` Joel Brobecker
2 siblings, 0 replies; 5+ messages in thread
From: Joel Brobecker @ 2008-11-10 19:05 UTC (permalink / raw)
To: Andreas Schwab; +Cc: gdb-patches
> 2008-11-09 Jerome Guitton <guitton@adacore.com>
>
>
> * dwarf2read.c (dwarf2_debug_line_missing_end_sequence_complaint):
> New function.
> (dwarf_decode_lines): Detect null file numbers. Detect the end of
> the line program sequence when no end sequence is emitted.
Now re-tested on x86-linux, with no regression. Andreas confirmed that
it looks good to him too, so I will commit this in a couple of days
unless there are some objections.
Index: dwarf2read.c
===================================================================
--- dwarf2read.c (revision 134708)
+++ dwarf2read.c (revision 134718)
@@ -695,6 +695,13 @@ dwarf2_debug_line_missing_file_complaint
}
static void
+dwarf2_debug_line_missing_end_sequence_complaint (void)
+{
+ complaint (&symfile_complaints,
+ _(".debug_line section has line program sequence without an end"));
+}
+
+static void
dwarf2_complex_location_expr_complaint (void)
{
complaint (&symfile_complaints, _("location expression too complex"));
@@ -7253,6 +7260,11 @@ dwarf_decode_lines (struct line_header *
{
op_code = read_1_byte (abfd, line_ptr);
line_ptr += 1;
+ if (line_ptr > line_end)
+ {
+ dwarf2_debug_line_missing_end_sequence_complaint ();
+ break;
+ }
if (op_code >= lh->opcode_base)
{
@@ -7261,7 +7273,7 @@ dwarf_decode_lines (struct line_header *
address += (adj_opcode / lh->line_range)
* lh->minimum_instruction_length;
line += lh->line_base + (adj_opcode % lh->line_range);
- if (lh->num_file_names < file)
+ if (lh->num_file_names < file || file == 0)
dwarf2_debug_line_missing_file_complaint ();
else
{
@@ -7293,15 +7305,6 @@ dwarf_decode_lines (struct line_header *
{
case DW_LNE_end_sequence:
end_sequence = 1;
-
- if (lh->num_file_names < file)
- dwarf2_debug_line_missing_file_complaint ();
- else
- {
- lh->file_names[file - 1].included_p = 1;
- if (!decode_for_pst_p)
- record_line (current_subfile, 0, address);
- }
break;
case DW_LNE_set_address:
address = read_address (abfd, line_ptr, cu, &bytes_read);
@@ -7343,7 +7346,7 @@ dwarf_decode_lines (struct line_header *
}
break;
case DW_LNS_copy:
- if (lh->num_file_names < file)
+ if (lh->num_file_names < file || file == 0)
dwarf2_debug_line_missing_file_complaint ();
else
{
@@ -7381,7 +7384,7 @@ dwarf_decode_lines (struct line_header *
file = read_unsigned_leb128 (abfd, line_ptr, &bytes_read);
line_ptr += bytes_read;
- if (lh->num_file_names < file)
+ if (lh->num_file_names < file || file == 0)
dwarf2_debug_line_missing_file_complaint ();
else
{
@@ -7432,6 +7435,14 @@ dwarf_decode_lines (struct line_header *
}
}
}
+ if (lh->num_file_names < file || file == 0)
+ dwarf2_debug_line_missing_file_complaint ();
+ else
+ {
+ lh->file_names[file - 1].included_p = 1;
+ if (!decode_for_pst_p)
+ record_line (current_subfile, 0, address);
+ }
}
if (decode_for_pst_p)
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: Fix gdb crash during .debug_line parsing
2008-11-09 17:25 ` Joel Brobecker
2008-11-09 18:32 ` Andreas Schwab
2008-11-10 19:05 ` Joel Brobecker
@ 2008-11-16 8:18 ` Joel Brobecker
2 siblings, 0 replies; 5+ messages in thread
From: Joel Brobecker @ 2008-11-16 8:18 UTC (permalink / raw)
To: Andreas Schwab; +Cc: gdb-patches
> 2008-11-09 Jerome Guitton <guitton@adacore.com>
>
> * dwarf2read.c (dwarf2_debug_line_missing_end_sequence_complaint):
> New function.
> (dwarf_decode_lines): Detect null file numbers. Detect the end of
> the line program sequence when no end sequence is emitted.
I just checked that one in. Andreas, let me know if you still observe
your crash.
--
Joel
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2008-11-15 18:51 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2008-11-05 12:53 Fix gdb crash during .debug_line parsing Andreas Schwab
2008-11-09 17:25 ` Joel Brobecker
2008-11-09 18:32 ` Andreas Schwab
2008-11-10 19:05 ` Joel Brobecker
2008-11-16 8:18 ` Joel Brobecker
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox