Re: [PATCH 4/6] gdb: address table parsing fixes and tests for .gdb_index

[Simon Marchi <simark@simark.ca>]

On 10/18/26 4:50 PM, Andrew Burgess wrote:
> I spotted that when reading a .gdb_index, GDB could read outside the
> address table in the function create_addrmap_from_gdb_index.
> Currently GDB starts with a pointer ITER and checks that this pointer
> is within the address table.  GDB then reads 20 bytes from the address
> table.  There is no check that there are 20 bytes between ITER and
> END, the end of the address table.  This means that a malformed index
> could cause GDB to read outside the address table.
> 
> Fix this by checking at the top of the address table reading loop that
> there are 20 bytes remaining.  Reject any .gdb_index with a malformed
> address table.
> 
> I've then extended the gdb_index proc in dwarf.exp to allow for the
> creation of address tables.  I added a new 'addr' command to add
> properly formed entries to the address table, and 'bad_addr' to add
> malformed entries to the address table.
> 
> I did consider just overloading 'addr' to do both jobs, but I didn't
> like that.  I felt it was less clear if a test intended to create a
> bad address table entry, or just had a mistake in the test.
> 
> While I was in the area I added tests for some of the pre-existing
> error handling within the address table parsing loop.  None of these
> error handling cases were being tested before now.
> ---
>  gdb/dwarf2/read-gdb-index.c                   |  11 ++
>  .../gdb.dwarf2/gdb-index-corrupted.exp        | 114 +++++++++++++++++-
>  gdb/testsuite/lib/dwarf.exp                   |  99 ++++++++++++---
>  3 files changed, 209 insertions(+), 15 deletions(-)
> 
> diff --git a/gdb/dwarf2/read-gdb-index.c b/gdb/dwarf2/read-gdb-index.c
> index 343ad90847f..83e628d3afb 100644
> --- a/gdb/dwarf2/read-gdb-index.c
> +++ b/gdb/dwarf2/read-gdb-index.c
> @@ -733,6 +733,17 @@ create_addrmap_from_gdb_index (dwarf2_per_objfile *per_objfile,
>    const gdb_byte *end = iter + index->address_table.size ();
>    while (iter < end)
>      {
> +      /* Ensure we're not about to read outside the bounds of the address
> +	 table, if we did then we'd interpret the symbol table as address
> +	 map data.  */
> +      if (iter + 20 > end)
> +	{
> +	  warning (_(".gdb_index address table has invalid size (%s bytes),"
> +		     " ignoring .gdb_index"),
> +		   pulongest (index->address_table.size ()));
> +	  return false;
> +	}

We could maybe just check once that the size of the table % 20 == 0.
Claude complained that 'iter + 20 > end' forms a pointer past end, which
I guess might be UB, in theory?  It suggested changing it to
'end - iter < 20', or the modulo approach, I think the latter is nicer.

> @@ -4167,8 +4224,33 @@ namespace eval Dwarf {
>  	# TU list (empty for now).
>  	gdb_index_tu_list:
>  
> -	# Address table (empty for now).
> +	# Address table.
>  	gdb_index_addr_table:
> +	foreach addr_entry $_gdb_index_addrs {
> +	    lassign $addr_entry entry_type low high
> +
> +	    if { $entry_type eq "addr" } {
> +		set cu_ref [lindex $addr_entry 3]
> +
> +		set cu_idx [_gdb_index_resolve_cu_ref $cu_ref]
> +
> +		_op .8byte $low "Low address"
> +		_op .8byte $high "High address"
> +		_op .4byte $cu_idx "CU index"
> +	    } elseif { $entry_type eq "bad_addr" } {
> +		_op_offset 8 "$low" "Low address"

Claude commented:

  Nit: dwarf.exp:4307: addr uses _op .8byte while bad_addr and the CU
  list use _op_offset 8. On 32-bit targets, .8byte <label> needs a
  64-bit relocation that gas may refuse. Use _op_offset 8 for both.

Simon