dwarf2read.c: Check type of linkage name attribute prior to decoding
Commit Message
This is a fix for PR 16822. Keith Seitz wrote the patch for the fix. I
wrote the test case.
The Texas Instruments compiler uses the encoding for
DW_AT_MIPS_linkage_name for other purposes. TI uses the encoding,
0x2007, for TI_AT_TI_end_line which, unlike DW_AT_MIPS_linkage_name,
does not have a string-typed value. Keith's patch simply makes sure
that linkage_name attributes have a string type prior to attempting to
decode them as such.
My test case causes GDB to segfault in an unpatched GDB. There
will be one PASS in a patched GDB.
Unpatched GDB:
(gdb) file testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name
Reading symbols from testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name...done.
ERROR: Couldn't load testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name into gdb (eof).
ERROR: Couldn't send ptype return_true to GDB.
UNRESOLVED: gdb.dwarf2/dw2-bad-mips-linkage-name.exp: ptype return_true
Patched GDB:
(gdb) file testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name
Reading symbols from /mesquite2/sourceware-git/mesquite-native-5894223/bld/gdb/testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name...done.
(gdb) ptype return_true
type = bool (void)
(gdb) PASS: gdb.dwarf2/dw2-bad-mips-linkage-name.exp: ptype return_true
gdb/ChangeLog:
* dwarf2read.c (dwarf2_physname): Verify that the attribute
is a string prior to decoding it as such.
gdb/testsuite/ChangeLog:
* gdb.dwarf2/dw2-bad-mips-linkage-name.S: New file.
* gdb.dwarf2/dw2-bad-mips-linkage-name.exp: New file.
---
gdb/dwarf2read.c | 5 +-
.../gdb.dwarf2/dw2-bad-mips-linkage-name.S | 207 +++++++++++++++++++++
.../gdb.dwarf2/dw2-bad-mips-linkage-name.exp | 36 ++++
3 files changed, 247 insertions(+), 1 deletion(-)
Comments
On Mon, Aug 3, 2015 at 3:47 PM, Kevin Buettner <kevinb@redhat.com> wrote:
> This is a fix for PR 16822. Keith Seitz wrote the patch for the fix. I
> wrote the test case.
>
> The Texas Instruments compiler uses the encoding for
> DW_AT_MIPS_linkage_name for other purposes. TI uses the encoding,
> 0x2007, for TI_AT_TI_end_line which, unlike DW_AT_MIPS_linkage_name,
> does not have a string-typed value. Keith's patch simply makes sure
> that linkage_name attributes have a string type prior to attempting to
> decode them as such.
>
> My test case causes GDB to segfault in an unpatched GDB. There
> will be one PASS in a patched GDB.
>
> Unpatched GDB:
>
> (gdb) file testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name
> Reading symbols from testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name...done.
> ERROR: Couldn't load testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name into gdb (eof).
> ERROR: Couldn't send ptype return_true to GDB.
> UNRESOLVED: gdb.dwarf2/dw2-bad-mips-linkage-name.exp: ptype return_true
>
> Patched GDB:
>
> (gdb) file testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name
> Reading symbols from /mesquite2/sourceware-git/mesquite-native-5894223/bld/gdb/testsuite/gdb.dwarf2/dw2-bad-mips-linkage-name...done.
> (gdb) ptype return_true
> type = bool (void)
> (gdb) PASS: gdb.dwarf2/dw2-bad-mips-linkage-name.exp: ptype return_true
>
> gdb/ChangeLog:
>
> * dwarf2read.c (dwarf2_physname): Verify that the attribute
> is a string prior to decoding it as such.
>
> gdb/testsuite/ChangeLog:
>
> * gdb.dwarf2/dw2-bad-mips-linkage-name.S: New file.
> * gdb.dwarf2/dw2-bad-mips-linkage-name.exp: New file.
Hi.
If I wanted to regenerate the .S how would I do it?
[generated .S files needs such instructions]
I wonder, though, if this is a good place for using the dwarf assembler.
Seems so. We just need a MIPS_linkage_name attribute
that isn't a string. The dwarf assembler test would be a lot
smaller.
>
> diff --git a/gdb/dwarf2read.c b/gdb/dwarf2read.c
> index 24a4022..9eb7cbc 100644
> --- a/gdb/dwarf2read.c
> +++ b/gdb/dwarf2read.c
> @@ -8722,7 +8722,10 @@ dwarf2_physname (const char *name, struct die_info *die, struct dwarf2_cu *cu)
>
> /* DW_AT_linkage_name is missing in some cases - depend on what GDB
> has computed. */
> - if (attr && DW_STRING (attr))
> + if (attr
> + && (attr->form == DW_FORM_strp || attr->form == DW_FORM_string
> + || attr->form == DW_FORM_GNU_strp_alt)
> + && DW_STRING (attr))
> {
> char *demangled;
One thought that comes to mind is that gdb should protect itself
from all such mistakes.
What if there was a wrapper on dwarf2_attr, dwarf2_string_attr
or some such, and it returned either the attribute (if the attribute
is present *and* is a string) or NULL.
And if the attribute is present but not a string it logs a
complaint (standard bad debug info complaint) and returns NULL.
On Mon, 3 Aug 2015 16:31:08 -0700
Doug Evans <dje@google.com> wrote:
> On Mon, Aug 3, 2015 at 3:47 PM, Kevin Buettner <kevinb@redhat.com> wrote:
>
> >
> > * gdb.dwarf2/dw2-bad-mips-linkage-name.S: New file.
> > * gdb.dwarf2/dw2-bad-mips-linkage-name.exp: New file.
>
> If I wanted to regenerate the .S how would I do it?
> [generated .S files needs such instructions]
You wouldn't, at least not easily.
I used a circa 2010 mips-elf toolchain to create a .S file which I
then modified by hand, both removing sections not relevant to the test
as well as adding in a reference to the DW_AT_MIPS_linkage_name
attribute that's not a string.
> I wonder, though, if this is a good place for using the dwarf assembler.
> Seems so. We just need a MIPS_linkage_name attribute
> that isn't a string. The dwarf assembler test would be a lot
> smaller.
Thanks for the suggestion. I'll look into this.
> > diff --git a/gdb/dwarf2read.c b/gdb/dwarf2read.c
> > index 24a4022..9eb7cbc 100644
> > --- a/gdb/dwarf2read.c
> > +++ b/gdb/dwarf2read.c
> > @@ -8722,7 +8722,10 @@ dwarf2_physname (const char *name, struct die_info *die, struct dwarf2_cu *cu)
> >
> > /* DW_AT_linkage_name is missing in some cases - depend on what GDB
> > has computed. */
> > - if (attr && DW_STRING (attr))
> > + if (attr
> > + && (attr->form == DW_FORM_strp || attr->form == DW_FORM_string
> > + || attr->form == DW_FORM_GNU_strp_alt)
> > + && DW_STRING (attr))
> > {
> > char *demangled;
>
> One thought that comes to mind is that gdb should protect itself
> from all such mistakes.
>
> What if there was a wrapper on dwarf2_attr, dwarf2_string_attr
> or some such, and it returned either the attribute (if the attribute
> is present *and* is a string) or NULL.
> And if the attribute is present but not a string it logs a
> complaint (standard bad debug info complaint) and returns NULL.
Sounds reasonable. I'll take a look at this too.
Kevin
@@ -8722,7 +8722,10 @@ dwarf2_physname (const char *name, struct die_info *die, struct dwarf2_cu *cu)
/* DW_AT_linkage_name is missing in some cases - depend on what GDB
has computed. */
- if (attr && DW_STRING (attr))
+ if (attr
+ && (attr->form == DW_FORM_strp || attr->form == DW_FORM_string
+ || attr->form == DW_FORM_GNU_strp_alt)
+ && DW_STRING (attr))
{
char *demangled;
new file mode 100644
@@ -0,0 +1,207 @@
+/* This testcase is part of GDB, the GNU debugger.
+
+ Copyright 2015 Free Software Foundation, Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>. */
+
+/* This test includes both DW_AT_MIPS_linkage_name and DW_AT_TI_end_line,
+ both of which use the same encoding. It doesn't matter to us whether
+ GDB do anything useful with DW_AT_TI_end_line; we just don't want it
+ to crash. */
+
+ .section .debug_abbrev,"",@progbits
+$Ldebug_abbrev0:
+ .section .debug_info,"",@progbits
+$Ldebug_info0:
+ .section .debug_line,"",@progbits
+$Ldebug_line0:
+ .text
+$Ltext0:
+ .globl _Z11return_truev
+$LFB0 = .
+ .file 1 "dw2-bad-mips-linkage-name.cc"
+_Z11return_truev:
+ .4byte 0xabcdef
+$LFE0:
+ .globl main
+$LFB1 = .
+main:
+ .4byte 0xfedbca
+$LFE1:
+ .size main, .-main
+$Letext0:
+ .section .debug_info
+ .4byte 0x5d # Length of Compilation Unit Info
+ .2byte 0x2 # DWARF version number
+ .4byte $Ldebug_abbrev0 # Offset Into Abbrev. Section
+ .byte 0x4 # Pointer Size (in bytes)
+ .uleb128 0x1 # (DIE (0xb) DW_TAG_compile_unit)
+ .4byte $LASF1 # DW_AT_producer: "GNU C++"
+ .byte 0x4 # DW_AT_language
+ .4byte $LASF2 # DW_AT_name: "dw2-bad-mips-linkage-name.cc"
+ .4byte $LASF3 # DW_AT_comp_dir: "/"
+ .4byte $Ltext0 # DW_AT_low_pc
+ .4byte $Letext0 # DW_AT_high_pc
+ .4byte $Ldebug_line0 # DW_AT_stmt_list
+ .uleb128 0x2 # (DIE (0x25) DW_TAG_subprogram)
+ .byte 0x1 # DW_AT_external
+ .4byte $LASF4 # DW_AT_name: "return_true"
+ .byte 0x1 # DW_AT_decl_file (dw2-bad-mips-linkage-name.cc)
+ .byte 0x2 # DW_AT_decl_line
+ .4byte $LASF5 # DW_AT_MIPS_linkage_name: "_Z11return_truev"
+ .4byte 0x3d # DW_AT_type
+ .4byte $LFB0 # DW_AT_low_pc
+ .4byte $LFE0 # DW_AT_high_pc
+ .uleb128 0x3 # (DIE (0x41) DW_TAG_base_type)
+ .byte 0x1 # DW_AT_byte_size
+ .byte 0x2 # DW_AT_encoding
+ .4byte $LASF0 # DW_AT_name: "bool"
+ .uleb128 0x4 # (DIE (0x48) DW_TAG_subprogram)
+ .byte 0x1 # DW_AT_external
+ .4byte $LASF6 # DW_AT_name: "main"
+ .byte 0x1 # DW_AT_decl_file (dw2-bad-mips-linkage-name.cc)
+ .byte 0x8 # DW_AT_decl_line
+ .byte 0x6 # DW_AT_TI_end_line (which shares same encoding
+ # with DW_AT_MIPS_linkage_name)
+ .4byte 0x59 # DW_AT_type
+ .4byte $LFB1 # DW_AT_low_pc
+ .4byte $LFE1 # DW_AT_high_pc
+ .uleb128 0x5 # (DIE (0x60) DW_TAG_base_type)
+ .byte 0x4 # DW_AT_byte_size
+ .byte 0x5 # DW_AT_encoding
+ .ascii "int\0" # DW_AT_name
+ .byte 0x0 # end of children of DIE 0xb
+ .section .debug_abbrev
+ .uleb128 0x1 # (abbrev code)
+ .uleb128 0x11 # (TAG: DW_TAG_compile_unit)
+ .byte 0x1 # DW_children_yes
+ .uleb128 0x25 # (DW_AT_producer)
+ .uleb128 0xe # (DW_FORM_strp)
+ .uleb128 0x13 # (DW_AT_language)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3 # (DW_AT_name)
+ .uleb128 0xe # (DW_FORM_strp)
+ .uleb128 0x1b # (DW_AT_comp_dir)
+ .uleb128 0xe # (DW_FORM_strp)
+ .uleb128 0x11 # (DW_AT_low_pc)
+ .uleb128 0x1 # (DW_FORM_addr)
+ .uleb128 0x12 # (DW_AT_high_pc)
+ .uleb128 0x1 # (DW_FORM_addr)
+ .uleb128 0x10 # (DW_AT_stmt_list)
+ .uleb128 0x6 # (DW_FORM_data4)
+ .byte 0x0
+ .byte 0x0
+ .uleb128 0x2 # (abbrev code)
+ .uleb128 0x2e # (TAG: DW_TAG_subprogram)
+ .byte 0x0 # DW_children_no
+ .uleb128 0x3f # (DW_AT_external)
+ .uleb128 0xc # (DW_FORM_flag)
+ .uleb128 0x3 # (DW_AT_name)
+ .uleb128 0xe # (DW_FORM_strp)
+ .uleb128 0x3a # (DW_AT_decl_file)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3b # (DW_AT_decl_line)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x2007 # (DW_AT_MIPS_linkage_name)
+ .uleb128 0xe # (DW_FORM_strp)
+ .uleb128 0x49 # (DW_AT_type)
+ .uleb128 0x13 # (DW_FORM_ref4)
+ .uleb128 0x11 # (DW_AT_low_pc)
+ .uleb128 0x1 # (DW_FORM_addr)
+ .uleb128 0x12 # (DW_AT_high_pc)
+ .uleb128 0x1 # (DW_FORM_addr)
+ .byte 0x0
+ .byte 0x0
+ .uleb128 0x3 # (abbrev code)
+ .uleb128 0x24 # (TAG: DW_TAG_base_type)
+ .byte 0x0 # DW_children_no
+ .uleb128 0xb # (DW_AT_byte_size)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3e # (DW_AT_encoding)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3 # (DW_AT_name)
+ .uleb128 0xe # (DW_FORM_strp)
+ .byte 0x0
+ .byte 0x0
+ .uleb128 0x4 # (abbrev code)
+ .uleb128 0x2e # (TAG: DW_TAG_subprogram)
+ .byte 0x0 # DW_children_no
+ .uleb128 0x3f # (DW_AT_external)
+ .uleb128 0xc # (DW_FORM_flag)
+ .uleb128 0x3 # (DW_AT_name)
+ .uleb128 0xe # (DW_FORM_strp)
+ .uleb128 0x3a # (DW_AT_decl_file)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3b # (DW_AT_decl_line)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x2007 # (DW_AT_TI_end_line / DW_AT_MIPS_linkage_name)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x49 # (DW_AT_type)
+ .uleb128 0x13 # (DW_FORM_ref4)
+ .uleb128 0x11 # (DW_AT_low_pc)
+ .uleb128 0x1 # (DW_FORM_addr)
+ .uleb128 0x12 # (DW_AT_high_pc)
+ .uleb128 0x1 # (DW_FORM_addr)
+ .byte 0x0
+ .byte 0x0
+ .uleb128 0x5 # (abbrev code)
+ .uleb128 0x24 # (TAG: DW_TAG_base_type)
+ .byte 0x0 # DW_children_no
+ .uleb128 0xb # (DW_AT_byte_size)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3e # (DW_AT_encoding)
+ .uleb128 0xb # (DW_FORM_data1)
+ .uleb128 0x3 # (DW_AT_name)
+ .uleb128 0x8 # (DW_FORM_string)
+ .byte 0x0
+ .byte 0x0
+ .byte 0x0
+ .section .debug_pubnames,"",@progbits
+ .4byte 0x27 # Length of Public Names Info
+ .2byte 0x2 # DWARF Version
+ .4byte $Ldebug_info0 # Offset of Compilation Unit Info
+ .4byte 0x68 # Compilation Unit Length
+ .4byte 0x25 # DIE offset
+ .ascii "return_true\0" # external name
+ .4byte 0x40 # DIE offset
+ .ascii "main\0" # external name
+ .4byte 0x0
+ .section .debug_aranges,"",@progbits
+ .4byte 0x1c # Length of Address Ranges Info
+ .2byte 0x2 # DWARF Version
+ .4byte $Ldebug_info0 # Offset of Compilation Unit Info
+ .byte 0x4 # Size of Address
+ .byte 0x0 # Size of Segment Descriptor
+ .2byte 0x0 # Pad to 8 byte boundary
+ .2byte 0x0
+ .4byte $Ltext0 # Address
+ .4byte $Letext0-$Ltext0 # Length
+ .4byte 0x0
+ .4byte 0x0
+ .section .debug_str,"MS",@progbits,1
+$LASF2:
+ .ascii "dw2-bad-mips-linkage-name.cc\000"
+$LASF0:
+ .ascii "bool\000"
+$LASF5:
+ .ascii "_Z11return_truev\000"
+$LASF1:
+ .ascii "GNU C++"
+$LASF4:
+ .ascii "return_true\000"
+$LASF3:
+ .ascii "/\000"
+$LASF6:
+ .ascii "main\000"
+
new file mode 100644
@@ -0,0 +1,36 @@
+# Copyright 2015 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+load_lib dwarf.exp
+
+# This test can only be run on targets which support DWARF-2 and use gas.
+if {![dwarf2_support]} {
+ return 0
+}
+
+# This testfile has reproducibility only with cc-with-index.sh.
+
+standard_testfile .S
+
+if [prepare_for_testing ${testfile}.exp ${testfile} ${srcfile}] {
+ return -1
+}
+
+# A successful run will have just one PASS. An unsuccessful run will
+# likely show errors out before getting to this point due to a
+# segfault in GDB.
+
+gdb_test "ptype return_true" " = bool \\(void\\)"
+