diff options
author | Tom de Vries <tdevries@suse.de> | 2022-10-14 21:22:57 +0200 |
---|---|---|
committer | Tom de Vries <tdevries@suse.de> | 2022-10-14 21:22:57 +0200 |
commit | 8e94bb3e3a478544c0d8abfad8404af015f7130b (patch) | |
tree | ff05a8202dbedfba16304050e8fb607446041ad4 /gdb/solib-svr4.c | |
parent | 7c635f3e61e014d713f7fc884215576187fda038 (diff) | |
download | fsf-binutils-gdb-8e94bb3e3a478544c0d8abfad8404af015f7130b.zip fsf-binutils-gdb-8e94bb3e3a478544c0d8abfad8404af015f7130b.tar.gz fsf-binutils-gdb-8e94bb3e3a478544c0d8abfad8404af015f7130b.tar.bz2 |
[gdb] Fix heap-buffer-overflow in find_program_interpreter
With the test-case included in this patch, we run into:
...
(gdb) target remote localhost:2347^M
`target:twice-connect' has disappeared; keeping its symbols.^M
Remote debugging using localhost:2347^M
warning: Unable to find dynamic linker breakpoint function.^M
GDB will be unable to debug shared library initializers^M
and track explicitly loaded dynamic code.^M
Reading /usr/lib/debug/.build-id/$hex/$hex.debug from remote target...^M
0x00007ffff7dd4550 in ?? ()^M
(gdb) PASS: gdb.server/twice-connect.exp: session=second: gdbserver started
FAIL: gdb.server/twice-connect.exp: found interpreter
...
The problem originates in find_program_interpreter, where
bfd_get_section_contents is called to read .interp, but fails. The function
returns false but the result is ignored, so find_program_interpreter returns
some random string.
Fix this by checking the result of the call to bfd_get_section_contents.
Tested on x86_64-linux.
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29652
Diffstat (limited to 'gdb/solib-svr4.c')
-rw-r--r-- | gdb/solib-svr4.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/gdb/solib-svr4.c b/gdb/solib-svr4.c index 27267e0..7e83819 100644 --- a/gdb/solib-svr4.c +++ b/gdb/solib-svr4.c @@ -568,9 +568,11 @@ find_program_interpreter (void) int sect_size = bfd_section_size (interp_sect); gdb::byte_vector buf (sect_size); - bfd_get_section_contents (current_program_space->exec_bfd (), - interp_sect, buf.data (), 0, sect_size); - return buf; + bool res + = bfd_get_section_contents (current_program_space->exec_bfd (), + interp_sect, buf.data (), 0, sect_size); + if (res) + return buf; } } |