[patch] Fix crash on reading stabs

Jan Kratochvil
2009-11-17T16:31:15Z

Hi,

there is a crash on reading stabs fpc binary:
https://bugzilla.redhat.com/show_bug.cgi?id=537837

Program received signal SIGSEGV, Segmentation fault.
0x000000000069db3d in read_dbx_symtab (objfile=0x1daf5f0) at dbxread.c:1369
1369 if ((namestring[0] == '-' && namestring[1] == 'l')

(gdb) p/x nlist.n_strx
$7 = 0xfffffff8
(gdb) p sizeof(nlist.n_strx)
$10 = 8

Below the patch context is:
namestring = (nlist->n_strx + file_string_table_offset
+ DBX_STRINGTAB (objfile));

so IMO the `(unsigned)' cast is excessive as it does not match the expression
below. Such cast is there since the GDB "Initial revision" (1999).

`n_strx' type:
struct internal_nlist
{
unsigned long n_strx; /* Index into string table of name. */
...
};

Regression tested on {x86_64,x86_64-m32,i686}-fedora12-linux-gnu which does not
mean anything with the default DWARF debug info. It was hanging for stabs so
tried just a large part of gdb.base/*.exp on x86_64-m32 - `unix/-gstabs+/-m32'.

If it isn't obviously approved please feel free to drop it as one should not
use STABS in the first place.

Regards,
Jan

gdb/
2009-11-17 Jan Kratochvil <jan.kratochvil@redhat.com>

* dbxread.c (set_namestring): Remove cast to unsigned. Check N_STRX
overflow.

--- a/gdb/dbxread.c
+++ b/gdb/dbxread.c
@@ -965,8 +965,9 @@ set_namestring (struct objfile *objfile, const struct internal_nlist *nlist)
{
char *namestring;

- if (((unsigned) nlist->n_strx + file_string_table_offset)
- >= DBX_STRINGTAB_SIZE (objfile))
+ if (nlist->n_strx + file_string_table_offset
+ >= DBX_STRINGTAB_SIZE (objfile)
+ || nlist->n_strx + file_string_table_offset < nlist->n_strx)
{
complaint (&symfile_complaints, _("bad string table offset in symbol %d"),
symnum);