Mirror of the gdb-patches mailing list
 help / color / mirror / Atom feed
* [patch] Fix crash on reading stabs
@ 2009-11-17 16:31 Jan Kratochvil
  2009-11-17 19:40 ` Joel Brobecker
  0 siblings, 1 reply; 3+ messages in thread
From: Jan Kratochvil @ 2009-11-17 16:31 UTC (permalink / raw)
  To: gdb-patches; +Cc: Joost van der Sluis

Hi,

there is a crash on reading stabs fpc binary:
	https://bugzilla.redhat.com/show_bug.cgi?id=537837

Program received signal SIGSEGV, Segmentation fault.
0x000000000069db3d in read_dbx_symtab (objfile=0x1daf5f0) at dbxread.c:1369
1369              if ((namestring[0] == '-' && namestring[1] == 'l')

(gdb) p/x nlist.n_strx
$7 = 0xfffffff8
(gdb) p sizeof(nlist.n_strx)
$10 = 8

Below the patch context is:
    namestring = (nlist->n_strx + file_string_table_offset
                  + DBX_STRINGTAB (objfile));

so IMO the `(unsigned)' cast is excessive as it does not match the expression
below.  Such cast is there since the GDB "Initial revision" (1999).

`n_strx' type:
struct internal_nlist
{
  unsigned long n_strx;                 /* Index into string table of name.  */
...
};

Regression tested on {x86_64,x86_64-m32,i686}-fedora12-linux-gnu which does not
mean anything with the default DWARF debug info.  It was hanging for stabs so
tried just a large part of gdb.base/*.exp on x86_64-m32 - `unix/-gstabs+/-m32'.

If it isn't obviously approved please feel free to drop it as one should not
use STABS in the first place.


Regards,
Jan


gdb/
2009-11-17  Jan Kratochvil  <jan.kratochvil@redhat.com>

	* dbxread.c (set_namestring): Remove cast to unsigned.  Check N_STRX
	overflow.

--- a/gdb/dbxread.c
+++ b/gdb/dbxread.c
@@ -965,8 +965,9 @@ set_namestring (struct objfile *objfile, const struct internal_nlist *nlist)
 {
   char *namestring;
 
-  if (((unsigned) nlist->n_strx + file_string_table_offset)
-      >= DBX_STRINGTAB_SIZE (objfile))
+  if (nlist->n_strx + file_string_table_offset
+      >= DBX_STRINGTAB_SIZE (objfile)
+      || nlist->n_strx + file_string_table_offset < nlist->n_strx)
     {
       complaint (&symfile_complaints, _("bad string table offset in symbol %d"),
 		 symnum);


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2009-11-17 20:50 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-11-17 16:31 [patch] Fix crash on reading stabs Jan Kratochvil
2009-11-17 19:40 ` Joel Brobecker
2009-11-17 20:50   ` Jan Kratochvil

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox