From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id WuhDJXW812pSuDsAWB0awg (envelope-from ) for ; Tue, 20 Oct 2026 15:09:41 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=simark.ca; s=mail; t=1792523381; bh=cfW82WraSAH1j7Vejm/P7Vv1DSTjsotHMUjJK6tZRig=; h=Date:Subject:To:References:From:In-Reply-To:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=McMow6aVumtnxn/pTS7k4FufeBv1yvLxrKlyjgpcXDj5ifdaxoebPjM393V6+LDLE fNIpa0rbrvLDYiDySEJQ+diGD83fX6LJupBUxECoHOxWZ55F1rbBhLEh76wW0ytYjq save3wnZ8BAsSQzLuTdgHH9078xaGf+5n5sP0Q68= Received: by simark.ca (Postfix, from userid 112) id 8210A1E04D; Tue, 20 Oct 2026 15:09:41 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-5.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=simark.ca header.i=@simark.ca header.a=rsa-sha256 header.s=mail header.b=HVDuXFDR; dkim-atps=neutral Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id DD3C51E04D for ; Tue, 20 Oct 2026 15:09:40 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id A1A3F4B920DA for ; Tue, 20 Oct 2026 19:09:33 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A1A3F4B920DA Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=simark.ca header.i=@simark.ca header.a=rsa-sha256 header.s=mail header.b=HVDuXFDR Received: from simark.ca (simark.ca [158.69.221.121]) by sourceware.org (Postfix) with ESMTPS id 2EB244B99F55 for ; Tue, 20 Oct 2026 19:09:10 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 2EB244B99F55 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=simark.ca Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=simark.ca ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 2EB244B99F55 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=158.69.221.121 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792523350; cv=none; b=UutagjTMRZM733OhLhtCAIoJA+2/RFLD8OuOXIa7x+5O/Hop+6trYobzAEBTpKbZpls3kxO7W6+Bz7Y1BH3BZbmBiPxC53DgC5dqXyhU8w2NHa3r0BPbXGFGllWICM4w8i+7eG1KYXX9p5QAnppIIilVVoDZNTJK5B3a3923BRg= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792523350; c=relaxed/simple; bh=cfW82WraSAH1j7Vejm/P7Vv1DSTjsotHMUjJK6tZRig=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=RRvTrBbYz5gcD/OXYSD+4VTVE9yiwUI2ucQ9PsM9kLKrhkikKFMqA6pPEqUWF5j3BexYwmbW4ii1o20TMWc0l+XyDZjjBTnxsM+mTo6zqG/Vo1DrGrQKYu5ghIWFqFMtbAASx+lq99dAx62xzmAilQCypxQfBfSeyHlJAOm/wK8= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=simark.ca header.i=@simark.ca header.a=rsa-sha256 header.s=mail header.b=HVDuXFDR DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 2EB244B99F55 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=simark.ca; s=mail; t=1792523348; bh=cfW82WraSAH1j7Vejm/P7Vv1DSTjsotHMUjJK6tZRig=; h=Date:Subject:To:References:From:In-Reply-To:From; b=HVDuXFDR6imVXC4Scdcp44UWSb2rxa19NuFa2RwPZY+p0hcmDsum/vmvka9FAyQ8N lBcx3jDiTDM6Fo1APl3Vj5Ie6YnVgQ1qxC1ATsZpKBQDWfT1XToucEjEhJoEMNo1JA oOwPtwEZHj7dJqVTi0lPwaU/s3IH/troeUyyurR0= Received: by simark.ca (Postfix) id 82AF61E04D; Tue, 20 Oct 2026 15:09:08 -0400 (EDT) Message-ID: <9804bdaa-ffb4-4edf-ad24-cc2371834d63@simark.ca> Date: Tue, 20 Oct 2026 15:09:07 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 4/6] gdb: address table parsing fixes and tests for .gdb_index To: Andrew Burgess , gdb-patches@sourceware.org References: <841d48e1c379fd92d46de92998c42ac39e3cfdb4.1792356284.git.aburgess@redhat.com> Content-Language: fr From: Simon Marchi In-Reply-To: <841d48e1c379fd92d46de92998c42ac39e3cfdb4.1792356284.git.aburgess@redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org On 10/18/26 4:50 PM, Andrew Burgess wrote: > I spotted that when reading a .gdb_index, GDB could read outside the > address table in the function create_addrmap_from_gdb_index. > Currently GDB starts with a pointer ITER and checks that this pointer > is within the address table. GDB then reads 20 bytes from the address > table. There is no check that there are 20 bytes between ITER and > END, the end of the address table. This means that a malformed index > could cause GDB to read outside the address table. > > Fix this by checking at the top of the address table reading loop that > there are 20 bytes remaining. Reject any .gdb_index with a malformed > address table. > > I've then extended the gdb_index proc in dwarf.exp to allow for the > creation of address tables. I added a new 'addr' command to add > properly formed entries to the address table, and 'bad_addr' to add > malformed entries to the address table. > > I did consider just overloading 'addr' to do both jobs, but I didn't > like that. I felt it was less clear if a test intended to create a > bad address table entry, or just had a mistake in the test. > > While I was in the area I added tests for some of the pre-existing > error handling within the address table parsing loop. None of these > error handling cases were being tested before now. > --- > gdb/dwarf2/read-gdb-index.c | 11 ++ > .../gdb.dwarf2/gdb-index-corrupted.exp | 114 +++++++++++++++++- > gdb/testsuite/lib/dwarf.exp | 99 ++++++++++++--- > 3 files changed, 209 insertions(+), 15 deletions(-) > > diff --git a/gdb/dwarf2/read-gdb-index.c b/gdb/dwarf2/read-gdb-index.c > index 343ad90847f..83e628d3afb 100644 > --- a/gdb/dwarf2/read-gdb-index.c > +++ b/gdb/dwarf2/read-gdb-index.c > @@ -733,6 +733,17 @@ create_addrmap_from_gdb_index (dwarf2_per_objfile *per_objfile, > const gdb_byte *end = iter + index->address_table.size (); > while (iter < end) > { > + /* Ensure we're not about to read outside the bounds of the address > + table, if we did then we'd interpret the symbol table as address > + map data. */ > + if (iter + 20 > end) > + { > + warning (_(".gdb_index address table has invalid size (%s bytes)," > + " ignoring .gdb_index"), > + pulongest (index->address_table.size ())); > + return false; > + } We could maybe just check once that the size of the table % 20 == 0. Claude complained that 'iter + 20 > end' forms a pointer past end, which I guess might be UB, in theory? It suggested changing it to 'end - iter < 20', or the modulo approach, I think the latter is nicer. > @@ -4167,8 +4224,33 @@ namespace eval Dwarf { > # TU list (empty for now). > gdb_index_tu_list: > > - # Address table (empty for now). > + # Address table. > gdb_index_addr_table: > + foreach addr_entry $_gdb_index_addrs { > + lassign $addr_entry entry_type low high > + > + if { $entry_type eq "addr" } { > + set cu_ref [lindex $addr_entry 3] > + > + set cu_idx [_gdb_index_resolve_cu_ref $cu_ref] > + > + _op .8byte $low "Low address" > + _op .8byte $high "High address" > + _op .4byte $cu_idx "CU index" > + } elseif { $entry_type eq "bad_addr" } { > + _op_offset 8 "$low" "Low address" Claude commented: Nit: dwarf.exp:4307: addr uses _op .8byte while bad_addr and the CU list use _op_offset 8. On 32-bit targets, .8byte