Re: [PATCH 3/6] gdb: validate the CU vector offset when loading the .gdb_index

[Simon Marchi <simark@simark.ca>]

On 10/18/26 4:50 PM, Andrew Burgess wrote:
> Within the .gdb_index, the symbol table contains indexes that point to
> CU vectors within the constant pool.  Unfortunately, these indexes are
> not validated against the size of the constant pool, so a malformed
> .gdb_index can cause GDB to read outside the bounds of the .gdb_index.
> 
> This commit extends the dwarf.exp gdb_index proc to allow for the CU
> offset to be overridden, this is then used to add tests that expose
> this bug.
> 
> Finally, mapped_gdb_index::build_name_components is updated to sanity
> check the CU offset before it is used.  If we find an invalid offset
> then that symbol will be ignored.
> 
> To improve GDB's ability to catch errors I also added an assert to
> offset_view::operator[] that the whole offset_type is within the view.
> Without the build_name_components fix this assert will be triggered by
> one of the new tests.

Again, I skipped the test part for now.

> diff --git a/gdb/dwarf2/read-gdb-index.c b/gdb/dwarf2/read-gdb-index.c
> index e0895fb6aa8..343ad90847f 100644
> --- a/gdb/dwarf2/read-gdb-index.c
> +++ b/gdb/dwarf2/read-gdb-index.c
> @@ -102,6 +102,11 @@ class offset_view
>    /* Extract the INDEXth offset_type from the array.  */
>    offset_type operator[] (size_t index) const
>    {
> +    /* Ensure the whole offset_type is within the underlying bytes.  If GDB
> +       is compiled with libc++ assert then the access of M_BYTES will be

Not sure if you meant to say libstdc++ here (maybe clang's libc++ has
the same asserts, I don't know).

> +       checked, but this only guarantees that the first byte is within the
> +       array_view as it's a gdb_byte view.  */
> +    gdb_assert (index < size ());
>      const gdb_byte *bytes = &m_bytes[index * sizeof (offset_type)];
>      return (offset_type) extract_unsigned_integer (bytes,
>  						   sizeof (offset_type),
> @@ -273,7 +278,22 @@ mapped_gdb_index::build_name_components (dwarf2_per_objfile *per_objfile)
>        gdb_assert (components.size () > 0);
>  
>        std::vector<cooked_index_entry *> these_entries;
> -      offset_view vec (constant_pool.slice (symbol_vec_index (idx)));
> +
> +      offset_type vec_index = symbol_vec_index (idx);
> +      /* The CU vector starts with an offset_type length word.  Check that
> +	 VEC_INDEX lands inside CONSTANT_POOL, and that there is at least an
> +	 offset_type worth of bytes beyond this in CONSTANT_POOL to be
> +	 read.  */
> +      if (vec_index >= constant_pool.size ()
> +	  || constant_pool.size () - vec_index < sizeof (offset_type))

Can this be simplified to just:

  if (vec_index + sizeof (offset_type) > constant_pool.size ())
    {
      // bad
    }

Simon