This patch fixes the worst of the cases where libbfd might terminate
a program due to calling xstrdup or xmalloc. I've also fixed some
error paths that didn't clean up properly.
PR 24955
* libbfd-in.h (bfd_strdup): New inline function.
* archive.c (_bfd_get_elt_at_filepos): Use bfd_strdup. Close
bfd on error.
* elfcode.h (_bfd_elf_bfd_from_remote_memory): Use bfd_strdup.
* opncls.c (bfd_fopen): Use bfd_strdup. Close fd and stream
on error.
(bfd_openstreamr): Use bfd_strdup.
(bfd_openr_iovec, bfd_openw, bfd_create): Likewise.
* plugin.c (try_load_plugin): Use bfd_malloc.
* libbfd.h: Regenerate.
Depending on optimisation level and gcc version, git commit 890f750a3b
introduces a false positive warning that i_shdrp may be used
uninitialized.
PR 24689
* elfcode.h (elf_object_p): Warning fix.
The testcase in the PR had a e_shstrndx section of type SHT_GROUP.
hdr->contents were initialized by setup_group rather than being read
from the file, thus last byte was not zero and string dereference ran
off the end of the buffer.
PR 24689
* elfcode.h (elf_object_p): Check type of e_shstrndx section.
Compressed debug sections can have uncompressed sizes that exceed the
original file size, so we can't use bfd_get_file_size. objdump also
used bfd_get_file_size to limit reloc section size, but I believe the
underlying bug causing the PR22508 out of bounds buffer access was
that we had an integer overflow when calculating the reloc buffer
size. I've fixed that instead in most of the backends, som and
vms-alpha being the exceptions. SOM and vmd-alpha have rather more
serious bugs in their slurp_relocs routines that would need fixing
first if we want to fuss about making them safe against fuzzed object
files.
The patch also fixes a number of other potential overflows by using
the bfd_alloc2/malloc2/zalloc2 memory allocation functions.
bfd/
* coffcode.h (buy_and_read): Delete unnecessary forward decl. Add
nmemb parameter. Use bfd_alloc2.
(coff_slurp_line_table): Use bfd_alloc2. Update buy_and_read calls.
Delete assertion.
(coff_slurp_symbol_table): Use bfd_alloc2 and bfd_zalloc2.
(coff_slurp_reloc_table): Use bfd_alloc2. Update buy_and_read calls.
* coffgen.c (coff_get_reloc_upper_bound): Ensure size calculation
doesn't overflow.
* elf.c (bfd_section_from_shdr): Use bfd_zalloc2. Style fix.
(assign_section_numbers): Style fix.
(swap_out_syms): Use bfd_malloc2.
(_bfd_elf_get_reloc_upper_bound): Ensure size calculation doesn't
overflow.
(_bfd_elf_make_empty_symbol): Style fix.
(elfobj_grok_stapsdt_note_1): Formatting.
* elfcode.h (elf_object_p): Use bfd_alloc2.
(elf_write_relocs, elf_write_shdrs_and_ehdr): Likewise.
(elf_slurp_symbol_table): Use bfd_zalloc2.
(elf_slurp_reloc_table): Use bfd_alloc2.
(_bfd_elf_bfd_from_remote_memory): Use bfd_malloc2.
* elf64-sparc (elf64_sparc_get_reloc_upper_bound): Ensure
size calculation doesn't overflow.
(elf64_sparc_get_dynamic_reloc_upper_bound): Likewise.
* mach-o.c (bfd_mach_o_get_reloc_upper_bound): Likewise.
* pdp11.c (get_reloc_upper_bound): Copy aoutx.h version.
binutils/
* objdump.c (load_specific_debug_section): Don't compare section
size against file size.
(dump_relocs_in_section): Don't compare reloc size against file size.
Print "failed to read relocs" on bfd_get_reloc_upper_bound error.
A recent Fedora bug (1520805) exposed a problem with objcopy's reloc
copying code, when a binary also contains mergeable notes. The note
merging code would delete some relocs, but then the reloc copying code
would try to put them back again, which did not work.
So I am checking in the patch below to fix the problem. The patch
also tweaks one of the binutils note merging tests so that it is
skipped for the Sparc64 target, since this has funky relocs.
binutils * objcopy.c (copy_relocations_in_section): Use the orelocations
field of the input section, if it has been initialised.
* testsuite/binutils-all/note-2-64.d: Skip test on Sparc64.
bfd * elfcode.h (elf_write_relocs): Check for an empty howto field.
One way to print 64-bit bfd_vma or bfd_size_type values on 32-bit
hosts is to cast the value to long long and use the 'll' modifier in
printf format strings. However, that's awkward because we also
support the Microsoft C library printf that uses 'I64' as a modifier
instead, and having variants of translated strings would not endear us
to the translation project. So, rewrite the 'll' modifier in
_doprint for Microsoft. Even with that capability it's not so nice
for 32-bit code to need casts to long long, so this patch makes 'L' a
modifier for bfd_vma rather than an alias for 'll'.
I've then used the new 'L' modifier to fix selected format strings.
* bfd.c (_doprnt): Rewrite "ll" and "L" modifiers to "I64" for
__MSVCRT__. Support "L" modifier for bfd_vma. Formatting.
* elf.c (setup_group): Use "Lx" to print sh_size.
(_bfd_elf_setup_sections): Remove unnecessary cast and print
unknown section type in hex.
(copy_special_section_fields): Style fix.
(bfd_section_from_shdr): Correct format for sh_link. Use a
common error message for all the variants of unrecognized
section types.
(assign_file_positions_for_load_sections): Use "Lx" for lma
adjust error message.
(assign_file_positions_for_non_load_sections): Formatting.
(rewrite_elf_program_header): Formatting. Use "Lx" for
bfd_vma values in error messages.
* elfcode.h (elf_slurp_reloc_table_from_section): Cast
ELF_R_SYM value to type expected by format.
* elflink.c (elf_link_read_relocs_from_section): Use "Lx"
in error messages.
(elf_link_add_object_symbols): Use "Lu" for symbol sizes.
(elf_link_input_bfd): Use "Lx" for r_info.
(bfd_elf_gc_record_vtinherit): Use "Lx" for offset.
PR ld/20815
bfd * elf.c (elf_modify_segment_map): Allow empty LOAD segments if
they contain the program headers.
(_bfd_elf_map_sections_to_segments): If the linker created the
PHDR segment then always attempt to include it in a LOAD segment.
(assign_file_positions_for_non_load_sections): Allow LOAD segments
to overlap PHDR segments.
(phdr_sorter): New function. Sorts program headers.
(assign_file_positions_except_relocs): Sort the program headers
before writing them out. Issue an error if the PHDR segment is
not covered by a LOAD segment, unless the backend allows it.
* elf-bfd.h (struct elf_backend_data): Add
elf_backend_allow_non_load_phdr.
* elfxx-target.h (elf_backend_allow_non_load_phdr): Provide
default definition that returns FALSE.
(elfNN_bed): Initialise the elf_backend_allow_non_load_phdr
field.
* elf64-hppa.c (elf64_hppa_allow_non_load_phdr): New function.
Returns TRUE.
(elf_backend_allow_non_load_phdr): Define.
* elf-m10300.c (_bfd_mn10300_elf_size_dynamic_sections): Do not
place the interpreter string into the .interp section if the
nointerp flag is set in the link info structure.
* elf32-arc.c (elf_arc_size_dynamic_sections): Likewise.
* elf32-score7.c (score_elf_final_link_relocate): Allow for the
_gp symbol not being part of the output.
binutils* readelf.c (process_program_headers): Check PT_LOAD and PT_PHDR
segments for validity.
ld * ld.texinfo: Note that PT_TLS can be used as a segment type.
* testsuite/ld-discard/discard.ld: Add space for program headers.
* testsuite/ld-elf/flags1.ld: Likewise.
* testsuite/ld-elf/maxpage3.t: Likewise.
* testsuite/ld-elf/noload-1.t: Likewise.
* testsuite/ld-elf/orphan.ld: Likewise.
* testsuite/ld-elf/overlay.t: Likewise.
* testsuite/ld-elf/pr14052.t: Likewise.
* testsuite/ld-elf/pr19539.t: Likewise.
* testsuite/ld-elf/provide-hidden-1.ld: Likewise.
* testsuite/ld-elf/provide-hidden-s.ld: Likewise.
* testsuite/ld-elf/weak-dyn-1.ld: Likewise.
* testsuite/ld-i386/pr19539.t: Likewise.
* testsuite/ld-scripts/defined.t: Likewise.
* testsuite/ld-scripts/defined6.t: Likewise.
* testsuite/ld-scripts/dynamic-sections.t: Likewise.
* testsuite/ld-scripts/empty-aligned.t: Likewise.
* testsuite/ld-scripts/provide-2.t: Likewise.
* testsuite/ld-scripts/provide-4.t: Likewise.
* testsuite/ld-vax-elf/plt-local.ld: Likewise.
* testsuite/ld-x86-64/pr19539.t: Likewise.
* testsuite/ld-elf/ehdr_start-missing.d: Do not initialise the
dynamic linker.
* testsuite/ld-elf/ehdr_start-weak.d: Likewise.
* testsuite/ld-elf/elf.exp (pr14170, pr17068): Likewise.
* testsuite/ld-elf/loadaddr1.d: Update expected readelf output.
* testsuite/ld-elf/noload-2.d: Likewise.
* testsuite/ld-powerpc/vxworks2.sd: Likewise.
* testsuite/ld-scripts/phdrs3a.d: Likewise.
* testsuite/ld-scripts/size-2.d: Likewise.
* testsuite/ld-elf/group.ld: Add program headers.
* testsuite/ld-elf/overlay.d: Skip for SPU.
* testsuite/ld-elf/flags1.d: Skip for RX.
* testsuite/ld-elf/pr19162.d: Skip for HPPA64.
* testsuite/ld-elf/pr19539.d: Skip for ALPHA.
* testsuite/ld-scripts/empty-orphan.t: Update program headers.
* testsuite/ld-scripts/size-2.t: Likewise.
On 32-bit targets, memory requested for program/section headers on a
fuzzed binary can wrap to 0. A bfd_alloc of zero bytes actually
returns a one byte allocation rather than a NULL pointer. This then
leads to buffer overflows.
Making this check unconditional triggers an extremely annoying gcc-5
warning.
PR19323
* elfcode.h (elf_object_p): Check for ridiculous e_shnum and
e_phnum values.
PR binutils/17512
* nm.c (print_symbol): Add 'is_synthetic' parameter. Use it to
help initialize the info.elfinfo field.
(print_size_symbols): Add 'synth_count' parameter. Use it to set
the is_synthetic parameter when calling print_symbol.
(print_symbols): Likewise.
(display_rel_file): Pass synth_count to printing function.
(display_archive): Break loop if the last archive displayed
matches the current archive.
* size.c (display_archive): Likewise.
* archive.c (do_slurp_bsd_armap): Make sure that the parsed sized
is at least big enough for the header to be read.
* elf32-i386.c (elf_i386_get_plt_sym_val): Skip unknown relocs.
* mach-o.c (bfd_mach_o_get_synthetic_symtab): Add range checks.
(bfd_mach_o_read_command): Prevetn duplicate error messages about
unrecognized commands.
* syms.c (_bfd_stab_section_find_nearest_line): Add range checks
when indexing into the string table.
PR binutils/17512
* dwarf.h (struct dwarf_section): Add user_data field.
* dwarf.c (frame_need_space): Check for an over large register
number.
(display_debug_frames): Check the return value from
frame_need_space. Check for a CFA expression that is so long the
start address wraps around.
(debug_displays): Initialise the user_data field.
* objdump.c (load_specific_debug_section): Save the BFD section
pointer in the user_data field of the dwarf_section structure.
(free_debug_section): Update BFD section data when freeing section
contents.
* readelf.c (load_specific_debug_section): Initialise the
user_data field.
* archive.c (do_slurp_coff_armap): Add range checks to prevent
running off the end of the string table.
* compress.c (bfd_get_full_section_contents): Return a NULL
pointer for zero sized sections. Do not attempt to copy a buffer
onto itself.
* elf-attrs.c (_bfd_elf_parse_attributes): Check for an empty
header. Add range checks to avoid running off the end of the
section.
* elf.c (bfd_elf_get_str_section): Seek before allocating so that
if the seek fails, no memory is allocated.
(bfd_elf_string_from_elf_section): Do not allocate a string from a
non string section. It only leads to trouble later on.
(_bfd_elf_print_private_bfd_data): Check for there being too
little external dynamic data.
(bfd_section_from_shdr): Replace assertion with a failure mode.
(bfd_section_from_shdr): When walking a loaded group section use
the internal structure size, not the external size. Check for the
group section being empty.
* elf32-i386.c (elf_i386_rtype_to_howto): Replace assertion with a
failure mode.
* elfcode.h (elf_slurp_reloc_table): Likewise.
* reloc.c (bfd_perform_relocation): Avoid seg-fault if the howto
parameter is NULL.
since
5979d6b69bhttps://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=5979d6b69b20a8355ea94b75fad97415fce4788c
vdso handling
https://sourceware.org/ml/binutils/2014-03/msg00082.htmlhttps://sourceware.org/ml/binutils/2014-04/msg00003.html
Message-ID: <A78C989F6D9628469189715575E55B230AA884EB@IRSMSX104.ger.corp.intel.com>
I get on
kernel-3.16.2-200.fc20.x86_64
https://koji.fedoraproject.org/koji/buildinfo?buildID=575860
attaching its vdso.bin.gz
GDB (FSF HEAD 5e43d46791) regression:
reproducer:
./gdb -ex start ./gdb
actual result / FAIL:
Got object file from memory but can't read symbols: File truncated.
expected result / PASS:
<nothing>
or / PASS:
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
That "warning: Could not load shared library..." is mostly harmless (it is
a bug in GDB), in the FAIL case it is not printed just because
bfd_check_format() fails there.
It seems logical to me this way when the 'size' parameter has been already
added.
Alan Modra:
I was wrongly thinking that the section headers were
always last when I wrote that code. (They are now! If you relink
that vdso with current binutils master you won't hit this problem, but
that of course doesn't help existing kernels.)
I do not see a regression for add-symbol-file-from-memory for libncurses.so.5
from the original thread above.
Start of section headers: 1080 (bytes into file)
Size of section headers: 64 (bytes)
Number of section headers: 13
Section header string table index: 8
Section Headers:
[Nr] Name Type Address Off Size ES Flg Lk Inf Al
[ 8] .fake_shstrtab STRTAB 0000000000000780 000780 000076 00 A 0 0 32
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000000 0x0000000000000000 0x0000000000000000 0x0012fe 0x0012fe R E 0x1000
size == 0x2000
shdr_end == 0x778 == 1080 + 13 * 64
high_offset == 0x12fe
else if (size >= shdr_end)
- high_offset = shdr_end;
+ high_offset = size;
But then 0x778 < 0x780 for "Section header string table index" so whole
bfd_check_format() fails because section headers were not cleared here:
/* If the segments visible in memory didn't include the section headers,
then clear them from the file header. */
if (high_offset < shdr_end)
bfd/ChangeLog
2014-09-18 Jan Kratochvil <jan.kratochvil@redhat.com>
PR gdb/17407
* elfcode.h (bfd_from_remote_memory): Use SIZE for HIGH_OFFSET.
When a VDSO gets large enough that it doesn't entirely fit in one page,
but not so large that the part described by the program header exceeds
one page, then gdb/BFD doesn't read the section headers and symbol
table information. This patch cures that by passing the size of the
vdso to BFD, and fixes a number of other issues in the BFD code.
bfd/
* elfcode.h (bfd_from_remote_memory): Add "size" parameter.
Consolidate code handling possible section headers past end of
segment. Don't use p_align for page size guess, instead use
minpagesize. Take note of ld.so clearing section headers when
p_memsz > p_filesz. Handle file header specifying no section
headers. Handle zero p_align throughout. Default loadbase to
zero. Add comments. Rename contents_size to high_offset, and
make it a bfd_vma. Delete unnecessary bfd_set_error calls.
* bfd-in.h (bfd_elf_bfd_from_remote_memory): Update prototpe.
* elf-bfd.h (struct elf_backend_data <elf_backend_from_remote_memory>):
Likewise.
(_bfd_elf32_bfd_from_remote_memory): Likewise.
(_bfd_elf64_bfd_from_remote_memory): Likewise.
* elf.c (bfd_elf_bfd_from_remote_memory): Adjust.
* bfd-in2.h: Regnerate.
gdb/
* symfile-mem.c (symbol_file_add_from_memory): Add size parameter.
Pass to bfd_elf_bfd_from_remote_memory. Adjust all callers.
(struct symbol_file_add_from_memory_args): Add size field.
(find_vdso_size): New function.
(add_vsyscall_page): Attempt to find vdso size.
* bfd-in.h (bfd_elf_bfd_from_remote_memory): Make LEN argument
of target_read_memory as bfd_size_type.
* bfd-in2.h: Regenerate.
* elf-bfd.h (elf_backend_bfd_from_remote_memory): Make LEN
argument of target_read_memory as bfd_size_type.
(_bfd_elf32_bfd_from_remote_memory): Likewise.
(_bfd_elf64_bfd_from_remote_memory): Likewise.
* elf.c (bfd_elf_bfd_from_remote_memory): Likewise.
* elfcode.h (NAME(_bfd_elf,bfd_from_remote_memory)): Likewise.
gdb/
* symfile-mem.c: 3 new gdb_static_assert for target_read_memory_bfd
parameters.
(target_read_memory_bfd): New function.
(symbol_file_add_from_memory): Use it.
* bfd-in.h (bfd_elf_bfd_from_remote_memory): Make LEN argument
of target_read_memory as size_t.
* bfd-in2.h: Regenerate.
* elf-bfd.h (elf_backend_bfd_from_remote_memory): Make LEN
argument of target_read_memory as size_t.
(_bfd_elf32_bfd_from_remote_memory): Likewise.
(_bfd_elf64_bfd_from_remote_memory): Likewise.
* elf.c (bfd_elf_bfd_from_remote_memory): Likewise.
* elfcode.h (NAME(_bfd_elf,bfd_from_remote_memory)): Likewise.
gdb/
* target.c (target_read_memory): Make LEN argument as size_t.
* target.h (target_read_memory): Likewise.
* elfcode.h (elf_checksum_contents): Read in the section's
contents if they are not already available.
* compress.c (bfd_get_full_section_contents): Use zmalloc to
allocate the buffers so that excess bytes are guaranteed to be
zero.
bfd/
* elfcode.h (elf_slurp_symbol_table): Put common plugin IR symbols
in their own common section.
* elflink.c (elf_link_add_object_symbols): Likewise.
* linker.c (generic_link_check_archive_element): Don't lose flags
if common section is pre-existing.
(_bfd_generic_link_add_one_symbol): Likewise.
ld/
* ldfile.c (ldfile_try_open_bfd): Move code creating and switching
to plugin IR BFD..
* ldmain.c (add_archive_element): ..and similar code here..
* plugin.c (plugin_maybe_claim): ..to here. New function.
(plugin_call_claim_file): Make static.
(asymbol_from_plugin_symbol): Set ELF st_shndx for common syms.
(plugin_multiple_common): New function.
(plugin_call_all_symbols_read): Hook in plugin_multiple_common.
* plugin.h (plugin_call_claim_file): Don't declare.
(plugin_maybe_claim): Declare.
* internal.h (elf_internal_sym): Add st_target_internal.
* arm.h (arm_st_branch_type): New enum.
(ARM_SYM_BRANCH_TYPE): New macro.
bfd/
* elf-bfd.h (elf_link_hash_entry): Add target_internal.
* elf.c (swap_out_syms): Set st_target_internal for each
Elf_Internal_Sym.
* elfcode.h (elf_swap_symbol_in): Likewise.
* elf32-i370.c (i370_elf_finish_dynamic_sections): Likewise.
* elf32-sh-symbian.c (sh_symbian_relocate_section): Likewise.
* elf64-sparc.c (elf64_sparc_output_arch_syms): Likewise.
* elfxx-sparc.c (_bfd_sparc_elf_size_dynamic_sections): Likewise.
* elflink.c (elf_link_output_extsym): Likewise.
(bfd_elf_final_link): Likewise.
(elf_link_add_object_symbols): Copy st_target_internal
to the hash table if we see a definition.
(_bfd_elf_copy_link_hash_symbol_type): Copy target_internal.
* elf32-arm.c (elf32_arm_stub_hash_entry): Replace st_type with
a branch_type field.
(a8_erratum_fix, a8_erratum_reloc): Likewise.
(arm_type_of_stub): Replace actual_st_type with an
actual_branch_type parameter.
(arm_build_one_stub): Use branch types rather than st_types to
determine the type of branch.
(cortex_a8_erratum_scan): Likewise.
(elf32_arm_size_stubs): Likewise.
(bfd_elf32_arm_process_before_allocation): Likewise.
(allocate_dynrelocs_for_symbol): Likewise.
(elf32_arm_finish_dynamic_sections): Likewise.
(elf32_arm_final_link_relocate): Replace sym_flags parameter with
a branch_type parameter.
(elf32_arm_relocate_section): Update call accordingly.
(elf32_arm_adjust_dynamic_symbol): Don't check STT_ARM_TFUNC.
(elf32_arm_output_map_sym): Initialize st_target_internal.
(elf32_arm_output_stub_sym): Likewise.
(elf32_arm_symbol_processing): Delete.
(elf32_arm_swap_symbol_in): Convert STT_ARM_TFUNCs into STT_FUNCs.
Use st_target_internal to record the branch type.
(elf32_arm_swap_symbol_out): Use st_target_internal to test for
Thumb functions.
(elf32_arm_is_function_type): Delete.
(elf_backend_symbol_processing): Likewise.
(elf_backend_is_function_type): Likewise.
gas/
* config/tc-arm.c (arm_adjust_symtab): Set the branch type
for Thumb symbols.
ld/
* emultempl/armelf.em (gld${EMULATION_NAME}_finish): Check
eh->target_internal.
opcodes/
* arm-dis.c (get_sym_code_type): Don't check for STT_ARM_TFUNC.
Use branch types instead.
(print_insn): Likewise.
