From patchwork Mon Apr 24 11:32:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 87000 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp2673222vqo; Mon, 24 Apr 2023 04:33:07 -0700 (PDT) X-Google-Smtp-Source: AKy350bFcSYo4/64kdTTmNa3/nxIg14vZJvbalD/ECAcBj3qVoDoDlWq/hKsGgAfjyeKP5QKceq0 X-Received: by 2002:aa7:c9c7:0:b0:506:be55:d84c with SMTP id i7-20020aa7c9c7000000b00506be55d84cmr11390342edt.11.1682335987489; Mon, 24 Apr 2023 04:33:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1682335987; cv=none; d=google.com; s=arc-20160816; b=EdiJ7Cpv52+bpWmfG98+sbrxkt+nK0op7Gx4PjRxVoIudeD4q0TAIdGy6WU2s659ao 37LXGxBP3RxBZoHJbLv9vUDWWHFKb5hKgVOzfRVJgD8VKmSR6a1uaQ4qfFCukukYwxnH NqIexQiff5d7NevmDSMn4pQ+DiDHyI8vBZT1aAIllMhChjBaweydiAXcbbqVLI7DYweT W74klBtXgWfcqrWXKgmFUwZBFRTacQMAIpbcySlidNoOGvvKfJx+fMJFd00nUVyAYVyJ aNzC6bKNHD1Uz2cjjt1zi4OaauPwnPjoVpQbZAmSiPdUNMNP/mJN8tdR7LrwMXf4pFgu rWFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-disposition:mime-version:message-id:subject:to:date :dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=v83lvNbKK2BpDI38haTrumeZWaDTI0qWmdBLvpdhjKM=; b=d4Ecs1N3N+jH+jrFg/cGRRGMetk5Vru4flIjazxSq70icYG8PSreQ0RV8ilwpoHYmo d2uJnim1vFqgby5HqMg4QO9P/0GOBeoLSg8ig7FGwCeidrSu+QNjLCzg2yvEt5ufSRuu Lr5tYZw8Hu/2N28+6Qu5Sc0MAcA7QkrRg9TblfGLcQpdJqQGGXMy+a5of87dMkkYNPeR C6PIOzIcZTGanWEPhm4OTnTx44ky6WpcyunOVz7rRyIg8QDrf9AaSNAwf/K6SIQjMYhX ZfjRsDtGMKqekFD7vmV7pAjJ61SfKeo/seabCoO9RSrTySVD2ZZ3JsKX47ZeWJaZCNp/ nV6Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=Q80VLIF+; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from sourceware.org (server2.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id y24-20020aa7d518000000b00506b14f86a8si8362827edq.354.2023.04.24.04.33.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Apr 2023 04:33:07 -0700 (PDT) Received-SPF: pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=Q80VLIF+; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 6C4A23858D32 for ; Mon, 24 Apr 2023 11:33:06 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 6C4A23858D32 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1682335986; bh=v83lvNbKK2BpDI38haTrumeZWaDTI0qWmdBLvpdhjKM=; h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=Q80VLIF+yGFEOx/I05e3KNM6/EehNjFTltSX9uFgVNtPQ9RJRgOIHN20YG+gWM6UH 3616ZaN/DqNMpsUpb+DgwZ9HRc7tzSkYZJvBvd1U+KfNEtR97bbFfHDuMecCqxGeLO yscFn5ATSBhlcBtxrP2dUDuHhCixwVA45wY9/o5I= X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) by sourceware.org (Postfix) with ESMTPS id 04CA33858D3C for ; Mon, 24 Apr 2023 11:32:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 04CA33858D3C Received: by mail-pg1-x531.google.com with SMTP id 41be03b00d2f7-517bb01bac9so3135821a12.0 for ; Mon, 24 Apr 2023 04:32:54 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682335973; x=1684927973; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=v83lvNbKK2BpDI38haTrumeZWaDTI0qWmdBLvpdhjKM=; b=lu+m5oKETiGlIHw4T4QaUaAOF4+7/yLIEbNMJI6Eajs1cWHVBc+4auE6pcz3ZEotfs +Fq3GOl4wMLxlDN8r+77NdvObqIDoRxNQTo7nS8KnHZlWV7nNrklK1z3kkDfO4q1040r 9Yb2tIbRSqHHO/dNaopulyrdkuoeGhZaXfIsKe3z5GdjH4K0aXUe4IikG29xOPh/8p0Z 8KTDHG3uD/weWLnsz4+UAeHjenN5sxccJqtJeJDBX3BguU9jrGd+u0feFJbkk7MjnNnH 1wweHjLTBnC0p4jZOkWQ8l240LH1Cq2QYi3zawNG/5f5BLq0gMePX+SIHb9GIl7NJ/DW yHBA== X-Gm-Message-State: AAQBX9cKfivFSl58gtOi+KOS2a8zrodiClSzA3apAqcE7JgfD8cv76M9 AiyX085/vw+hdwVG5adIQoG/Y28ofy4= X-Received: by 2002:a17:90a:cc04:b0:246:b898:5f54 with SMTP id b4-20020a17090acc0400b00246b8985f54mr13510074pju.16.1682335973460; Mon, 24 Apr 2023 04:32:53 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id o3-20020a17090a9f8300b0024b39ddfbdbsm6196583pjp.37.2023.04.24.04.32.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Apr 2023 04:32:52 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id C607A1142DD8; Mon, 24 Apr 2023 21:02:50 +0930 (ACST) Date: Mon, 24 Apr 2023 21:02:50 +0930 To: binutils@sourceware.org Subject: asan: segfault in coff_mangle_symbols Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-3035.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Alan Modra via Binutils From: Alan Modra Reply-To: Alan Modra Errors-To: binutils-bounces+ouuuleilei=gmail.com@sourceware.org Sender: "Binutils" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1764057140228879110?= X-GMAIL-MSGID: =?utf-8?q?1764057140228879110?= The testcase managed to trigger creation of a wild pointer in coff_slurp_symbol_table. Stop that happening, and fix an unrelated problem I happened to see in bfd_coff_get_syment. * coff-bfd.c (bfd_coff_get_syment): Clear fix_value after converting n_value from a pointer to an index. * coffcode.h (coff_slurp_symbol_table ): Sanity check symbol value before converting to a pointer. diff --git a/bfd/coff-bfd.c b/bfd/coff-bfd.c index 292778ecb56..9aceeb080a7 100644 --- a/bfd/coff-bfd.c +++ b/bfd/coff-bfd.c @@ -45,9 +45,12 @@ bfd_coff_get_syment (bfd *abfd, *psyment = csym->native->u.syment; if (csym->native->fix_value) - psyment->n_value = - ((psyment->n_value - (uintptr_t) obj_raw_syments (abfd)) - / sizeof (combined_entry_type)); + { + psyment->n_value = + ((psyment->n_value - (uintptr_t) obj_raw_syments (abfd)) + / sizeof (combined_entry_type)); + csym->native->fix_value = 0; + } /* FIXME: We should handle fix_line here. */ diff --git a/bfd/coffcode.h b/bfd/coffcode.h index 423f6c070ef..594f3e0457b 100644 --- a/bfd/coffcode.h +++ b/bfd/coffcode.h @@ -4852,13 +4852,18 @@ coff_slurp_symbol_table (bfd * abfd) case C_BSTAT: dst->symbol.flags = BSF_DEBUGGING; - /* The value is actually a symbol index. Save a pointer - to the symbol instead of the index. FIXME: This - should use a union. */ - src->u.syment.n_value - = (uintptr_t) (native_symbols + src->u.syment.n_value); - dst->symbol.value = src->u.syment.n_value; - src->fix_value = 1; + if (src->u.syment.n_value >= obj_raw_syment_count (abfd)) + dst->symbol.value = 0; + else + { + /* The value is actually a symbol index. Save a pointer + to the symbol instead of the index. FIXME: This + should use a union. */ + src->u.syment.n_value + = (uintptr_t) (native_symbols + src->u.syment.n_value); + dst->symbol.value = src->u.syment.n_value; + src->fix_value = 1; + } break; #endif