Re: [PATCH 5/6] gdb: handle corrupted .gdb_index header offsets

[Simon Marchi <simark@simark.ca>]

On 10/18/26 4:50 PM, Andrew Burgess wrote:
> The .gdb_index section has a header.  The header is a list of offsets
> into the .gdb_index section.  Currently GDB has basically no error
> checking of these offsets, the offsets can point outside the
> .gdb_index section and GDB will usually try to do something bad as a
> result.
> 
> Most often a bad offset will result in GDB trying to allocate a huge
> amount of memory.  Indeed, I don't recommend running these new tests
> on an unpatched GDB; I managed to bring down my machine due to
> excessive memory allocation.
> 
> I've added a mechanism to the gdb_index proc (in lib/dwarf.exp) to
> allow the various .gdb_index header offsets to be overridden.  Then I
> made use of this in gdb.dwarf2/gdb-index-corrupted.exp to override
> each offset in turn.
> 
> I also added a new test gdb.dwarf2/gdb-index-tiny-header.exp which
> tests with a .gdb_index sized between 0 and 28 bytes (inclusive).
> This covers indexes that are too small to even hold a valid version
> number field, and indexes upto the size of the full header block.  All
> of these indexes are too small to hold useful data so GDB should
> reject them all (without crashing).
> 
> The changes in gdb/dwarf2/read-gdb-index.c are fairly straightforward;
> check the .gdb_index is big enough for the version field, then use the
> version field to check that we have all of the offsets, and that the
> offsets point within the .gdb_index section.
> 
> Also, as the data areas that the .gdb_index header offsets point to
> are arranged in offset order, I also check that offsets are always
> equal or increasing in value.

Claude suggested this as follow-up:

  - Pre-existing, non-blocking (follow-up): the CU list size isn't
    checked to be a multiple of 16, nor the TU list a multiple of 24.
    create_cus_from_gdb_index_list (i += 2 over size/8 elements) and the
    TU loop  (read-gdb-index.c:721, i += 3) then read up to 16 bytes
    past the end of the block. For the dwz index nothing has to follow
    the CU list, so the read can go past the end of the section. This
    patch is the natural place to add that check.

I think that makes sense, it could be a follow-up.  We could decide to
reject the index entirely, or just ignore the incomplete entries at the
end.

> @@ -513,6 +529,49 @@ read_gdb_index_from_buffer (const char *filename,
>  
>    map->version = version;
>  
> +  /* The .gdb_index header is a version number followed by a series of
> +     offsets into the .gdb_index section.  Each header offset points to a
> +     data block, and the offset order, and the data block order are the
> +     same.  This means that each offset must be greater than, or equal to
> +     the previous.  The first offset should point to the first byte after
> +     the .gdb_index header.  None of the header offsets should point outside
> +     of the .gdb_index section.
> +
> +     If any of these requirements are not met then GDB can end either
> +     crashing by accessing invalid memory, or trying to allocate a huge

Missing "up", "can end up either crashing".

Simon