Go to file
Domani Johannes 820ebe46a4 Prevent use-after-free of bfd filename in gdb_bfd_close_or_warn
On Windows gcore is not implemented, and if you try it, you get an
heap-use-after-free error:

(gdb) gcore C:/gdb/build64/gdb-git-python3/gdb/testsuite/outputs/gdb.base/gcore-buffer-overflow/gcore-buffer-overflow.test
warning: cannot close "=================================================================
==10108==ERROR: AddressSanitizer: heap-use-after-free on address 0x1259ea503110 at pc 0x7ff6806e3936 bp 0x0062e01ed990 sp 0x0062e01ed140
READ of size 111 at 0x1259ea503110 thread T0
    #0 0x7ff6806e3935 in strlen C:/gcc/src/gcc-14.2.0/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391
    #1 0x7ff6807169c4 in __pformat_puts C:/gcc/src/mingw-w64-v12.0.0/mingw-w64-crt/stdio/mingw_pformat.c:558
    #2 0x7ff6807186c1 in __mingw_pformat C:/gcc/src/mingw-w64-v12.0.0/mingw-w64-crt/stdio/mingw_pformat.c:2514
    #3 0x7ff680713614 in __mingw_vsnprintf C:/gcc/src/mingw-w64-v12.0.0/mingw-w64-crt/stdio/mingw_vsnprintf.c:41
    #4 0x7ff67f34419f in vsnprintf(char*, unsigned long long, char const*, char*) C:/msys64/mingw64/x86_64-w64-mingw32/include/stdio.h:484
    #5 0x7ff67f34419f in string_vprintf[abi:cxx11](char const*, char*) C:/gdb/src/gdb.git/gdbsupport/common-utils.cc:106
    #6 0x7ff67b37b739 in cli_ui_out::do_message(ui_file_style const&, char const*, char*) C:/gdb/src/gdb.git/gdb/cli-out.c:227
    #7 0x7ff67ce3d030 in ui_out::call_do_message(ui_file_style const&, char const*, ...) C:/gdb/src/gdb.git/gdb/ui-out.c:571
    #8 0x7ff67ce4255a in ui_out::vmessage(ui_file_style const&, char const*, char*) C:/gdb/src/gdb.git/gdb/ui-out.c:740
    #9 0x7ff67ce2c873 in ui_file::vprintf(char const*, char*) C:/gdb/src/gdb.git/gdb/ui-file.c:73
    #10 0x7ff67ce7f83d in gdb_vprintf(ui_file*, char const*, char*) C:/gdb/src/gdb.git/gdb/utils.c:1881
    #11 0x7ff67ce7f83d in vwarning(char const*, char*) C:/gdb/src/gdb.git/gdb/utils.c:181
    #12 0x7ff67f3530eb in warning(char const*, ...) C:/gdb/src/gdb.git/gdbsupport/errors.cc:33
    #13 0x7ff67baed27f in gdb_bfd_close_warning C:/gdb/src/gdb.git/gdb/gdb_bfd.c:437
    #14 0x7ff67baed27f in gdb_bfd_close_or_warn C:/gdb/src/gdb.git/gdb/gdb_bfd.c:646
    #15 0x7ff67baed27f in gdb_bfd_unref(bfd*) C:/gdb/src/gdb.git/gdb/gdb_bfd.c:739
    #16 0x7ff68094b6f2 in gdb_bfd_ref_policy::decref(bfd*) C:/gdb/src/gdb.git/gdb/gdb_bfd.h:82
    #17 0x7ff68094b6f2 in gdb::ref_ptr<bfd, gdb_bfd_ref_policy>::~ref_ptr() C:/gdb/src/gdb.git/gdbsupport/gdb_ref_ptr.h:91
    #18 0x7ff67badf4d2 in gcore_command C:/gdb/src/gdb.git/gdb/gcore.c:176

0x1259ea503110 is located 16 bytes inside of 4064-byte region [0x1259ea503100,0x1259ea5040e0)
freed by thread T0 here:
    #0 0x7ff6806b1687 in free C:/gcc/src/gcc-14.2.0/libsanitizer/asan/asan_malloc_win.cpp:90
    #1 0x7ff67f2ae807 in objalloc_free C:/gdb/src/gdb.git/libiberty/objalloc.c:187
    #2 0x7ff67d7f56e3 in _bfd_free_cached_info C:/gdb/src/gdb.git/bfd/opncls.c:247
    #3 0x7ff67d7f2782 in _bfd_delete_bfd C:/gdb/src/gdb.git/bfd/opncls.c:180
    #4 0x7ff67d7f5df9 in bfd_close_all_done C:/gdb/src/gdb.git/bfd/opncls.c:960
    #5 0x7ff67d7f62ec in bfd_close C:/gdb/src/gdb.git/bfd/opncls.c:925
    #6 0x7ff67baecd27 in gdb_bfd_close_or_warn C:/gdb/src/gdb.git/gdb/gdb_bfd.c:643
    #7 0x7ff67baecd27 in gdb_bfd_unref(bfd*) C:/gdb/src/gdb.git/gdb/gdb_bfd.c:739
    #8 0x7ff68094b6f2 in gdb_bfd_ref_policy::decref(bfd*) C:/gdb/src/gdb.git/gdb/gdb_bfd.h:82
    #9 0x7ff68094b6f2 in gdb::ref_ptr<bfd, gdb_bfd_ref_policy>::~ref_ptr() C:/gdb/src/gdb.git/gdbsupport/gdb_ref_ptr.h:91
    #10 0x7ff67badf4d2 in gcore_command C:/gdb/src/gdb.git/gdb/gcore.c:176

It happens because gdb_bfd_close_or_warn uses a bfd-internal name for
the failing-close warning, after the close is finished, and the name
already freed:

static int
gdb_bfd_close_or_warn (struct bfd *abfd)
{
  int ret;
  const char *name = bfd_get_filename (abfd);

  for (asection *sect : gdb_bfd_sections (abfd))
    free_one_bfd_section (sect);

  ret = bfd_close (abfd);

  if (!ret)
    gdb_bfd_close_warning (name,
			   bfd_errmsg (bfd_get_error ()));

  return ret;
}

Fixed by making a copy of the name for the warning.

Approved-By: Andrew Burgess <aburgess@redhat.com>
2024-10-31 13:40:11 +01:00
bfd Automatic date update in version.in 2024-10-31 00:00:21 +00:00
binutils RISC-V: Dump instruction without checking architecture support as usual. 2024-10-31 11:28:45 +08:00
config Revert "Remove LIBINTL_DEP" 2024-06-20 21:15:27 +09:30
contrib Revert "contrib: Add autoregen.py" 2024-09-04 13:38:57 +00:00
cpu Add markers for 2.43 branch/release 2024-07-20 12:43:19 +01:00
elfcpp Add markers for 2.43 branch/release 2024-07-20 12:43:19 +01:00
etc Update year range in copyright notice of binutils files 2024-01-04 22:58:12 +10:30
gas gas/doc/riscv: Fixed misaligned instruction table 2024-10-31 11:45:57 +08:00
gdb Prevent use-after-free of bfd filename in gdb_bfd_close_or_warn 2024-10-31 13:40:11 +01:00
gdbserver gdbserver: remove unused include in gdbthread.h 2024-10-28 13:58:52 -04:00
gdbsupport Pass current directory to gdb_abspath 2024-10-19 13:18:00 -06:00
gnulib autoupdate: replace obsolete macros AC_CONFIG_HEADER 2024-06-10 08:25:55 +09:30
gold gold: Always resolve non-default weak undefined to 0 2024-08-31 04:28:43 -07:00
gprof Updated Brazilian Portuguese translation for the gprof directory. 2024-09-26 16:11:59 +01:00
gprofng gprofng: fix a memory leak in the mxv-pthreads example 2024-10-17 20:20:23 -07:00
include s390: Add arch15 instructions 2024-10-10 12:09:40 +02:00
ld ld-elf/pr25207.d: Pass --no-rosegment to ld 2024-10-31 05:04:15 +08:00
libbacktrace autoupdate: regen after replacing obsolete macros 2024-06-10 08:25:56 +09:30
libctf binutils testsuite: canonicalize subtest names in libctf 2024-09-24 21:50:41 -04:00
libdecnumber regen config 2023-08-12 10:27:57 +09:30
libiberty libiberty: sync with gcc 2024-09-04 15:35:42 +01:00
libsframe libsframe: remove runstatedir in Makefile.in 2024-07-10 10:24:45 +02:00
opcodes RISC-V: Dump instruction without checking architecture support as usual. 2024-10-31 11:28:45 +08:00
readline autoupdate: add square brackets around arguments of AC_INIT 2024-06-10 08:25:56 +09:30
sim sim: pru: Fix test case assembly with latest GAS 2024-08-12 23:33:59 +03:00
texinfo
zlib autoupdate: regen after replacing obsolete macros 2024-06-10 08:25:56 +09:30
.cvsignore
.editorconfig
.gitattributes
.gitignore .gitignore: ignore .vscode 2024-05-30 12:09:35 +01:00
.pre-commit-config.yaml pre-commit: autoupdate 2024-08-12 13:07:59 -04:00
ar-lib
ChangeLog Add markers for 2.43 branch/release 2024-07-20 12:43:19 +01:00
compile
config-ml.in MSP430: Add -fno-exceptions multilib 2023-08-12 10:24:26 +09:30
config.guess Synchronize config.[sub|guess] with the latest versions from the config project. 2024-07-15 10:22:54 +01:00
config.rpath
config.sub Synchronize config.[sub|guess] with the latest versions from the config project. 2024-07-15 10:22:54 +01:00
configure Disable gprofng build for *musl* 2024-08-26 13:48:29 -07:00
configure.ac Disable gprofng build for *musl* 2024-08-26 13:48:29 -07:00
COPYING
COPYING3
COPYING3.LIB
COPYING.LIB
COPYING.LIBGLOSS
COPYING.NEWLIB
depcomp
djunpack.bat
install-sh
libtool.m4 FDPIC: Handle arm*-*-uclinuxfdpiceabi in configure scripts 2023-08-12 10:25:06 +09:30
lt~obsolete.m4
ltgcc.m4
ltmain.sh ltmain.sh: allow more flags at link-time 2024-09-25 19:06:10 +01:00
ltoptions.m4
ltsugar.m4
ltversion.m4
MAINTAINERS Fix compiling bfd/vms-lib.c for a 32-bit host. 2024-03-18 10:26:16 +00:00
Makefile.def Revert "Pass GUILE down to subdirectories" 2024-03-22 11:07:28 -06:00
Makefile.in Revert "Pass GUILE down to subdirectories" 2024-03-22 11:07:28 -06:00
Makefile.tpl Revert "Pass GUILE down to subdirectories" 2024-03-22 11:07:28 -06:00
makefile.vms
missing
mkdep
mkinstalldirs
move-if-change
multilib.am
README
README-maintainer-mode
SECURITY.txt Add a SECURITY.txt file describing the GNU Binutils' project's stance on security related bugs. 2023-04-20 16:52:11 +01:00
setup.com
src-release.sh Add a target to src-release.sh to crate a binutils release without Gold 2024-10-29 11:50:04 +00:00
symlink-tree
test-driver
ylwrap

		   README for GNU development tools

This directory contains various GNU compilers, assemblers, linkers, 
debuggers, etc., plus their support routines, definitions, and documentation.

If you are receiving this as part of a GDB release, see the file gdb/README.
If with a binutils release, see binutils/README;  if with a libg++ release,
see libg++/README, etc.  That'll give you info about this
package -- supported targets, how to use it, how to report bugs, etc.

It is now possible to automatically configure and build a variety of
tools with one command.  To build all of the tools contained herein,
run the ``configure'' script here, e.g.:

	./configure 
	make

To install them (by default in /usr/local/bin, /usr/local/lib, etc),
then do:
	make install

(If the configure script can't determine your type of computer, give it
the name as an argument, for instance ``./configure sun4''.  You can
use the script ``config.sub'' to test whether a name is recognized; if
it is, config.sub translates it to a triplet specifying CPU, vendor,
and OS.)

If you have more than one compiler on your system, it is often best to
explicitly set CC in the environment before running configure, and to
also set CC when running make.  For example (assuming sh/bash/ksh):

	CC=gcc ./configure
	make

A similar example using csh:

	setenv CC gcc
	./configure
	make

Much of the code and documentation enclosed is copyright by
the Free Software Foundation, Inc.  See the file COPYING or
COPYING.LIB in the various directories, for a description of the
GNU General Public License terms under which you can copy the files.

REPORTING BUGS: Again, see gdb/README, binutils/README, etc., for info
on where and how to report problems.