[Bug ld/30905] New: ld: Test case pr28158 fails on x86_64-linux-musl when index is > 19

2023-09-25 Thread awilfox at adelielinux dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=30905

Bug ID: 30905
   Summary: ld: Test case pr28158 fails on x86_64-linux-musl when
index is > 19
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: ld
  Assignee: unassigned at sourceware dot org
  Reporter: awilfox at adelielinux dot org
  Target Milestone: ---

Created attachment 15138
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15138&action=edit
elf: Adjust PR ld/28158 tests

awilcox on lab-x86_64-lin-1
~/Code/binutils-next/system/binutils/src/binutils-2.41/ld % ../binutils/readelf
--dyn-syms -W tmpdir/pr28158

Symbol table '.dynsym' contains 5 entries:
   Num:Value  Size TypeBind   Vis  Ndx Name
 0:  0 NOTYPE  LOCAL  DEFAULT  UND 
 1:  0 FUNCGLOBAL DEFAULT  UND __libc_start_main
 2: 00402020 4 OBJECT  GLOBAL DEFAULT   20 foo@VERS_2.0 (2)
 3: 00400378 1 FUNCGLOBAL DEFAULT9 _init
 4: 00400571 1 FUNCGLOBAL DEFAULT   12 _fini


The regex in pr28158.rd is:

 +[0-9]+: +[0-9a-f]+ +[0-9]+ +OBJECT +GLOBAL +DEFAULT +[1-9]+ foo@VERS_2.0
\([0-9]+\)

This doesn't match because the index column has value '20', while the regex
only matches numbers 1-9 (not 0-9).  The test passes if the regex is changed to
0-9.  Attached patch does that.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30904] New: nm: SEGV at bfd/elf.c:2267 in _bfd_elf_get_dynamic_symbols

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30904

Bug ID: 30904
   Summary: nm: SEGV at bfd/elf.c:2267 in
_bfd_elf_get_dynamic_symbols
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15137
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15137&action=edit
this poc can crash nm-new in the latest version without arguments

Summary:

A crash caused when using nm
AddressSanitizer reported it as SEGV

git commit, OS, Compiler and processor:

git commit be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.6 LTS
Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new ./poc_0

AddressSanitizer report:

$ /home/royyao/sytseng/binutils-gdb-asan/binutils/nm-new ./poc_0

AddressSanitizer:DEADLYSIGNAL
=
==3624246==ERROR: AddressSanitizer: SEGV on unknown address 0x00d0 (pc
0x559ec0952ce0 bp 0x7fffd5967ea0 sp 0x7fffd5967bf0 T0)
==3624246==The signal is caused by a READ memory access.
==3624246==Hint: address points to the zero page.
#0 0x559ec0952cdf in _bfd_elf_get_dynamic_symbols
/home/royyao/sytseng/binutils-gdb-asan/bfd/elf.c:2267
#1 0x559ec0938c7d in bfd_elf64_object_p
/home/royyao/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
#2 0x559ec08c59a8 in bfd_check_format_matches
/home/royyao/sytseng/binutils-gdb-asan/bfd/format.c:431
#3 0x559ec08a77da in display_file
/home/royyao/sytseng/binutils-gdb-asan/binutils/nm.c:1645
#4 0x559ec08a9827 in main
/home/royyao/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#5 0x7f4e61e94082 in __libc_start_main ../csu/libc-start.c:308
#6 0x559ec08a015d in _start
(/home/royyao/sytseng/binutils-gdb-asan/binutils/nm-new+0xa315d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/royyao/sytseng/binutils-gdb-asan/bfd/elf.c:2267 in
_bfd_elf_get_dynamic_symbols
==3624246==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30898] consider multi-threading for gprofng display text

2023-09-25 Thread vladimir.mezentsev at oracle dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30898

Vladimir Mezentsev  changed:

   What|Removed |Added

 Ever confirmed|0   |1
   Last reconfirmed||2023-09-26
 Status|UNCONFIRMED |NEW

--- Comment #1 from Vladimir Mezentsev  
---
Did you try
gprofng display text -func /tmp/binutils-2.41/build/test.2.er

Is this also slow?
May we get your sample program to recreate the experiment on our machines ?


> Also running 
> "gprofng display text -metrics name:soname:e.%totalcpu -disasm func1"
>  (this function showed 5% usage in the "-functions" flavor) took 6 minutes 
> (that's a huge, generated function).

The command is incorrect. It should be:
gprofng display text -name short:soname -metrics e.%totalcpu:name -disasm func1

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30897] Support source view for "referenced" source (e.g. bison)

2023-09-25 Thread vladimir.mezentsev at oracle dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30897

Vladimir Mezentsev  changed:

   What|Removed |Added

 Status|UNCONFIRMED |ASSIGNED
   Last reconfirmed||2023-09-26
 Ever confirmed|0   |1

--- Comment #1 from Vladimir Mezentsev  
---
It is a bug.
A workaround could be to look at the functions from QLParser.yy.
For example:

gprofng display text -dis QL::yylex
gprofng display text -source QL::yylex

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30903] New: nm: heap-buffer-overflow at bfd/bfd.c:2677 in bfd_demangle

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30903

Bug ID: 30903
   Summary: nm: heap-buffer-overflow at bfd/bfd.c:2677 in
bfd_demangle
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15136
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15136&action=edit
this poc with -D argument can crash nm-new in the latest version

Summary:

A crash caused when using nm
AddressSanitizer reported it as heap-buffer-overflow

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_83

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/nm-new -D ./poc_83

BFD: warning: ./pocs/poc_83 has a program header with invalid alignment
=
==4058725==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x621010e0 at pc 0x7fb331b9fccd bp 0x7ffc82fbe790 sp 0x7ffc82fbdf38
READ of size 354 at 0x621010e0 thread T0
#0 0x7fb331b9fccc in __interceptor_strchr
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:671
#1 0x559a49bea133 in bfd_demangle
/home/pt/sytseng/binutils-gdb-asan/bfd/bfd.c:2677
#2 0x559a49bcb3fe in print_symname
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:700
#3 0x559a49bd1a11 in print_symbol_info_posix
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1934
#4 0x559a49bce2c1 in print_symbol
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1228
#5 0x559a49bcf4e7 in print_symbols
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1388
#6 0x559a49bd002e in display_rel_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1503
#7 0x559a49bd0838 in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1649
#8 0x559a49bd2827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#9 0x7fb331957082 in __libc_start_main ../csu/libc-start.c:308
#10 0x559a49bc915d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/nm-new+0xa315d)

0x621010e0 is located 0 bytes to the right of 4064-byte region
[0x62100100,0x621010e0)
allocated by thread T0 here:
#0 0x7fb331c38808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x559a49ed0ffa in objalloc_create objalloc.c:95
#2 0x559a49bf5b3a in _bfd_new_bfd
/home/pt/sytseng/binutils-gdb-asan/bfd/opncls.c:92
#3 0x559a49bf63a2 in bfd_fopen
/home/pt/sytseng/binutils-gdb-asan/bfd/opncls.c:265
#4 0x559a49bf67f4 in bfd_openr
/home/pt/sytseng/binutils-gdb-asan/bfd/opncls.c:361
#5 0x559a49bd070b in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1630
#6 0x559a49bd2827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#7 0x7fb331957082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:671
in __interceptor_strchr
Shadow bytes around the buggy address:
  0x0c427fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff81d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff81e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff81f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fff8210: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa
  0x0c427fff8220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:   00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:   fa
  Freed heap region:   fd
  Stack left redzone:  f1
  Stack mid redzone:   f2
  Stack right redzone: f3
  Stack after return:  f5
  Stack use after scope:   f8
  Global redzone:  f9
  Global init order:   f6
  Poisoned by user:f7
  Container overflow:  fc
  Array cookie:ac
  Intra object redzone:bb
  ASan internal:   fe
  Left alloca redzone: ca
  Right alloca redzone:cb
  Shadow gap:  cc
==4058725==ABORTING

-- 
You a

[Bug binutils/30888] nm: SEGV on unknow address at bfd/elf.c:9543 in _bfd_elf_slurp_version_tables

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30888

曾信彥  changed:

   What|Removed |Added

Summary|nm: SEGV on unknow address  |nm: SEGV on unknow address
   |at bfd/elf.c:9453 in|at bfd/elf.c:9543 in
   |_bfd_elf_slurp_version_tabl |_bfd_elf_slurp_version_tabl
   |es  |es

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30902] New: nm: stack-overflow at rust-demangle.c:1572 in str_buf_append

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30902

Bug ID: 30902
   Summary: nm: stack-overflow at rust-demangle.c:1572 in
str_buf_append
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15135
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15135&action=edit
this poc with -C --no-recurse-limit arguments can crash nm-new in the latest
version

Summary:

A crash caused when using nm
AddressSanitizer reported it as stack-overflow

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -C --no-recurse-limit ./poc_0

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/nm-new -C --no-recurse-limit
./poc_0

BFD: warning: ./pocs/poc_0 has a section extending past end of file
./pocs/poc_0: no group info for section '.note.gnu.build-id'
BFD: ./pocs/poc_0: invalid string offset 3724541951 >= 601 for section
`.strtab'
BFD: ./pocs/poc_0: invalid string offset 15793920 >= 601 for section `.strtab'
BFD: ./pocs/poc_0: invalid string offset 4294967274 >= 601 for section
`.strtab'
BFD: ./pocs/poc_0: invalid string offset 4227858432 >= 601 for section
`.strtab'
BFD: ./pocs/poc_0: invalid string offset 8388608 >= 601 for section `.strtab'
BFD: ./pocs/poc_0: invalid string offset 6912 >= 601 for section `.strtab'
BFD: ./pocs/poc_0: invalid string offset 57089 >= 601 for section `.strtab'
BFD: ./pocs/poc_0: invalid string offset 32801 >= 601 for section `.strtab'
BFD: ./pocs/poc_0: invalid string offset 4294246637 >= 601 for section
`.strtab'
BFD: ./pocs/poc_0: invalid string offset 268435814 >= 601 for section `.strtab'
BFD: ./pocs/poc_0: invalid string offset 4294902315 >= 601 for section
`.strtab'
BFD: ./pocs/poc_0: .gnu.version_r invalid entry
AddressSanitizer:DEADLYSIGNAL
=
==1238816==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcde5b0fa8
(pc 0x7f2360ffd379 bp 0x7ffcde5b1840 sp 0x7ffcde5b0fb0 T0)
#0 0x7f2360ffd378 in __interceptor_memcpy
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790
#1 0x55976bbcd71c in str_buf_append rust-demangle.c:1572
#2 0x55976bbcd76c in str_buf_demangle_callback rust-demangle.c:1579
#3 0x55976bbc6914 in print_str rust-demangle.c:279
#4 0x55976bbc9e4f in demangle_type rust-demangle.c:924
#5 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#6 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#7 0x55976bbca85c in demangle_type rust-demangle.c:1055
#8 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#9 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#10 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#11 0x55976bbca85c in demangle_type rust-demangle.c:1055
#12 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#13 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#14 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#15 0x55976bbca85c in demangle_type rust-demangle.c:1055
#16 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#17 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#18 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#19 0x55976bbca85c in demangle_type rust-demangle.c:1055
#20 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#21 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#22 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#23 0x55976bbca85c in demangle_type rust-demangle.c:1055
#24 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#25 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#26 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#27 0x55976bbca85c in demangle_type rust-demangle.c:1055
#28 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#29 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#30 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#31 0x55976bbca85c in demangle_type rust-demangle.c:1055
#32 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#33 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#34 0x55976bbca8ee in demangle_type rust-demangle.c:1062
#35 0x55976bbca85c in demangle_type rust-demangle.c:1055
#36 0x55976bbc9e9f in demangle_type rust-demangle.c:929
#37 0x55976bbc95f1 in demangle_path rust-demangle.c:759
#38 0x55976bbca8ee in demangle_type rust-demangle.c:1

[Bug binutils/30901] New: objdump: SEGV at bfd/elf.c:2267 in _bfd_elf_get_dynamic_symbols

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30901

Bug ID: 30901
   Summary: objdump: SEGV at bfd/elf.c:2267 in
_bfd_elf_get_dynamic_symbols
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15134
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15134&action=edit
this poc with -T argument can crash objdump in the latest version

Summary:

A crash caused when using objdump
AddressSanitizer reported it as SEGV

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/objdump -T ./poc_55_hav

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./pocs/poc_55_hav

id:50,sig:11,seed:00,src:012011,op:havoc,rep:32
AddressSanitizer:DEADLYSIGNAL
=
==1073912==ERROR: AddressSanitizer: SEGV on unknown address 0x (pc
0x55b97a4b0808 bp 0x7ffdb7ac8bb0 sp 0x7ffdb7ac8900 T0)
==1073912==The signal is caused by a READ memory access.
==1073912==Hint: address points to the zero page.
#0 0x55b97a4b0807 in _bfd_elf_get_dynamic_symbols
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2267
#1 0x55b97a4967a5 in bfd_elf64_object_p
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
#2 0x55b97a4221fe in bfd_check_format_matches
/home/pt/sytseng/binutils-gdb-asan/bfd/format.c:431
#3 0x55b97a2e38b5 in display_object_bfd objdump.c:5748
#4 0x55b97a2e3c05 in display_any_bfd objdump.c:5837
#5 0x55b97a2e3c7f in display_file objdump.c:5858
#6 0x55b97a2e5633 in main objdump.c:6269
#7 0x7f39b2247082 in __libc_start_main ../csu/libc-start.c:308
#8 0x55b97a2c937d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2267 in
_bfd_elf_get_dynamic_symbols
==1073912==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30900] New: objdump: heap-buffer-overflow at bfd/elf.c:2562 in bfd_elf_print_symbol

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30900

Bug ID: 30900
   Summary: objdump: heap-buffer-overflow at bfd/elf.c:2562 in
bfd_elf_print_symbol
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15133
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15133&action=edit
this poc with -T argument can crash objdump in the latest version

Summary:

A crash caused when using nm
AddressSanitizer reported it as heap-buffer-overflow

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/objdump -T ./poc_55

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./poc_55

/home/pt/sytseng/binutils-gdb-asan/binutils/objdump: option -P/--private not
supported by this file
=
==2509832==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x62107866 at pc 0x7ff945486dcb bp 0x7ffe2a9f1ac0 sp 0x7ffe2a9f1238
READ of size 1 at 0x62107866 thread T0
#0 0x7ff945486dca in printf_common
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_format.inc:546
#1 0x7ff945487fb6 in __interceptor_vfprintf
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1604
#2 0x7ff9454880be in __interceptor_fprintf
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1661
#3 0x55f25b2ba18e in bfd_elf_print_symbol
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2562
#4 0x55f25b0e8e01 in dump_symbols objdump.c:5162
#5 0x55f25b0eb4e1 in dump_bfd objdump.c:5670
#6 0x55f25b0eb8cd in display_object_bfd objdump.c:5750
#7 0x55f25b0ebc05 in display_any_bfd objdump.c:5837
#8 0x55f25b0ebc7f in display_file objdump.c:5858
#9 0x55f25b0ed633 in main objdump.c:6269
#10 0x7ff945216082 in __libc_start_main ../csu/libc-start.c:308
#11 0x55f25b0d137d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)

0x62107866 is located 902 bytes to the right of 4064-byte region
[0x62106500,0x621074e0)
allocated by thread T0 here:
#0 0x7ff9454f7808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x55f25b4d2bf2 in _objalloc_alloc objalloc.c:159
#2 0x55f25b22e60c in bfd_alloc
/home/pt/sytseng/binutils-gdb-asan/bfd/libbfd.c:452
#3 0x55f25b2a81f9 in _bfd_alloc_and_read
/home/pt/sytseng/binutils-gdb-asan/bfd/libbfd.h:886
#4 0x55f25b2b7bfe in _bfd_elf_get_dynamic_symbols
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2105
#5 0x55f25b29e7a5 in bfd_elf64_object_p
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
#6 0x55f25b229e02 in bfd_check_format_matches
/home/pt/sytseng/binutils-gdb-asan/bfd/format.c:365
#7 0x55f25b0eb8b5 in display_object_bfd objdump.c:5748
#8 0x55f25b0ebc05 in display_any_bfd objdump.c:5837
#9 0x55f25b0ebc7f in display_file objdump.c:5858
#10 0x55f25b0ed633 in main objdump.c:6269
#11 0x7ff945216082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_format.inc:546
in printf_common
Shadow bytes around the buggy address:
  0x0c427fff8eb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8ed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8ef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c427fff8f00: fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa
  0x0c427fff8f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8f20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff8f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff8f40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff8f50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:   00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:   fa
  Freed heap region:   fd
  Stack left redzone:  f1
  Stack mid redzone:   f2
  Stack right redzone: f3
  Stack after return:  f5
  Stack use after scope:   f8
  Global redzone:  f9
  Global init order:   f6
  Poisoned by user:

[Bug gprofng/30893] gprofng uses syscall + perf_event (hwcdrv) and ptrace (gpcollect) without any check and doc

2023-09-25 Thread sam at gentoo dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=30893

Sam James  changed:

   What|Removed |Added

 CC||sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30897] Support source view for "referenced" source (e.g. bison)

2023-09-25 Thread sam at gentoo dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=30897

Sam James  changed:

   What|Removed |Added

 CC||sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.


Running strip on libpython3.so twice creates statically linked files

2023-09-25 Thread Junsong Li
Hello, I find out strip (version 2.7 and up to the latest git commit) produces 
incorrect elf for a shared library called libpython3.so​ in this python build 
standalone project (one example is 
https://github.com/indygreg/python-build-standalone/releases/tag/20210506).

I tested the python3.8.10 and python3.9.5 from the prebuilt assets:

(make sure you have zstd installed)
$ wget 
https://github.com/indygreg/python-build-standalone/releases/download/20210506/cpython-3.8.10-x86_64-unknown-linux-gnu-pgo-20210506T0943.tar.zst
 && tar xf cpython-3.8.10-x86_64-unknown-linux-gnu-pgo-20210506T0943.tar.zs

$ strip --verbose python/install/lib/libpython3.so
copy from `python/install/lib/libpython3.so' [elf64-x86-64] to 
`python/install/lib/stdefEcz' [elf64-x86-64]
strip: python/install/lib/stdefEcz: section .dynamic lma 0x51c0 adjusted to 
0x61a0
strip: python/install/lib/stdefEcz: section .dynstr lma 0x53a0 adjusted to 
0x6380

$ ldd python/install/lib/libpython3.so
        linux-vdso.so.1 (0x7fffa5118000)
        libpython3.8.so.1.0 => 
/home/junsong-li/playground/download/python/install/lib/../lib/libpython3.8.so.1.0
 (0x7ff8825c4000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 
(0x7ff882598000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x7ff8823a6000)
        libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 
(0x7ff88236b000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x7ff882365000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x7ff882359000)
        libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x7ff882354000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x7ff882205000)
        /lib64/ld-linux-x86-64.so.2 (0x7ff883993000)

$ strip --verbose python/install/lib/libpython3.so
copy from `python/install/lib/libpython3.so' [elf64-x86-64] to 
`python/install/lib/st51yoNs' [elf64-x86-64]

$ ldd python/install/lib/libpython3.so
        statically linked

I took a quick investigation on the produced elf: the .dynamic section is moved 
to 0x61a0 only when I run the second strip but the adjustment is reported 
during the first run. Here is the readelf output diff of the first strip result 
and the second strip result

$ diff /tmp/v2.txt /tmp/v3.txt
13c13
<   Start of section headers:          17688 (bytes into file)
---
>   Start of section headers:          25848 (bytes into file)
61c61
<   [18] .bss              NOBITS           4020  3020
---
>   [18] .bss              NOBITS           4020  4020
63c63
<   [19] .comment          PROGBITS           4458
---
>   [19] .comment          PROGBITS           6438
65c65
<   [20] .dynamic          DYNAMIC          51c0  41c0
---
>   [20] .dynamic          DYNAMIC          51c0  61a0
67c67
<   [21] .dynstr           STRTAB           53a0  43a0
---
>   [21] .dynstr           STRTAB           53a0  6380
69c69
<   [22] .shstrtab         STRTAB             446a
---
>   [22] .shstrtab         STRTAB             644a
94,96c94,96
<   LOAD           0x3020 0x4020 0x5000
<                  0x1438 0x1438  RW     0x1000
<   DYNAMIC        0x41c0 0x51c0 0x51c0
---
>   LOAD           0x3020 0x3020 0x3020
>                  0x3418 0x3418  RW     0x1000
>   DYNAMIC        0x61a0 0x51c0 0x61a0
110c110
< Dynamic section at offset 0x41c0 contains 26 entries:
---
> Dynamic section at offset 0x61a0 contains 26 entries:


Note after the first strip, the dynamic section is still at 0x41c0 even if 
strip reported it has adjusted this section to 0x61a0.

In older versions (I happen to have a strip 2.26.1), strip reports errors, 
which prevents the binary corruption:

$ strip --verbose libpython3.so
copy from `libpython3.so' [elf64-x86-64] to `stT8vsRX' [elf64-x86-64]
strip: stT8vsRX: Not enough room for program headers, try linking with -N
strip:stT8vsRX[.hash]: Bad value

[Bug gprofng/30896] gprofng display text: please provide a way (or document how) to include the object name next to the called functions

2023-09-25 Thread vladimir.mezentsev at oracle dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30896

--- Comment #1 from Vladimir Mezentsev  
---
% gprofng display text -name short:soname -func test.1.er/
Functions sorted by metric: Exclusive Total CPU Time

Excl. Total   Incl. TotalName
CPU   CPU
 sec.  %   sec.  %
0.060 100.00  0.060 100.00[]
0.  0.0.060 100.00   __libc_start_main []
0.  0.0.060 100.00   main []


If you want to change the metric list:
% gprofng display text -name short:soname -metrics i.%totalcpu:name -func
test.1.er/
Current metrics: i.%totalcpu:name
Current Sort Metric: Inclusive Total CPU Time ( i.%totalcpu )
Functions sorted by metric: Inclusive Total CPU Time

Incl. TotalName
CPU
 sec.  %
0.060 100.00[]
0.060 100.00   __libc_start_main []
0.060 100.00   main []


More details in
% man gp-display-text
...
   "name {short | long | mangled}[:{soname | nosoname}]"
   Specify whether to use the short, long, or mangled form of function
names.  Optionally, the load object that the
   function is part of can be included in the output by adding the
soname keyword.  It can also be ommitted (nosoname),
   which is the default.

   Whether there is an actual difference between these types of names
depends on the language.

   Note that there should be no (white)space to the left and right of
the colon (:).
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30792] Rnglists section dump in readelf outputs one rangelist per CU

2023-09-25 Thread sevaa at sprynet dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30792

--- Comment #10 from Vsevolod Alekseyev  ---
Thanks. Now that I feel reasonably comfortable around dwarf.c, I think I could
tackle 29267 and 29267, and who knows what else will come up on the corpus
testing.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30792] Rnglists section dump in readelf outputs one rangelist per CU

2023-09-25 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30792

Nick Clifton  changed:

   What|Removed |Added

   Assignee|unassigned at sourceware dot org   |nickc at redhat dot com
   Last reconfirmed||2023-09-25
 Ever confirmed|0   |1
 Status|UNCONFIRMED |ASSIGNED

--- Comment #9 from Nick Clifton  ---
(In reply to Vsevolod Alekseyev from comment #7)
> Anyway, here is the patch with the current state of affairs. Feel free to
> ditch the patch and let me know if you'd rather wait until I address the
> rest of 29267.

No I liked it, so I have gone ahead and checked it in.  There were a few
minor formatting issues, but I cleaned those up.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30792] Rnglists section dump in readelf outputs one rangelist per CU

2023-09-25 Thread cvs-commit at gcc dot gnu.org
https://sourceware.org/bugzilla/show_bug.cgi?id=30792

--- Comment #8 from cvs-commit at gcc dot gnu.org  ---
The master branch has been updated by Nick Clifton :

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=84102ebc29a1ea531e7fe78bd841bfb2fe501dc2

commit 84102ebc29a1ea531e7fe78bd841bfb2fe501dc2
Author: Vsevolod Alekseyev 
Date:   Mon Sep 25 18:01:31 2023 +0100

Fix readelf's display of dwarf v5 range lists

  PR 30792
  * dwarf.h (struct debug_info): Remove range_versions field.
  * dwarf.c (fetch_indexed_offset): New function.
(read_and_display_attr_value): Use it for DW_FORM_rnglistx. Remove code to
initialise range_versions. (skip_attribute): New function. (read_bases): Read
and reccord all range and address bases in a CU. (process_debug_info): Call
read_bases. (display_debug_rnglists): Rename to
display_debug_rnglists_unit_header and only display the range list header
information. (display_debug_ranges): Adjust.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30898] New: consider multi-threading for gprofng display text

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30898

Bug ID: 30898
   Summary: consider multi-threading for gprofng display text
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: enhancement
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

recording a sample program that uses lots of shared object files (most loaded
with dlopen) using "gprofng collect app" is quite fast; doing the "gprofng
display html" afterwards was... unexpected.


The first process took several minutes and wrote hundreds of MBs (mostly
disassembly) to disk
/tmp/install/bin/gp-display-text -limit 100 -viewmode machine -compare off
-script display.2.html/gp-script /tmp/binutils-2.41/build/test.2.er

The second process ran even much longer (actually I've killt it after taking a
single complete core for over 2 hours)

perl /tmp/install/bin/gp-display-html --whoami=gprofng display html test.2.er


Both processes ran on a single core, so the main question here is: is it
possible to use multiple cores for those tasks?


Also running 
"gprofng display text -metrics name:soname:e.%totalcpu -disasm func1" (this
function showed 5% usage in the "-functions" flavor) took 6 minutes (that's a
huge, generated function).



Can anything be done about the run time for the "gprofng display" command?


Maybe the default for "gprofng display html" should be to NOT include
disassembly (this may be a separate issue though)?

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30897] New: Support source view for "referenced" source (e.g. bison)

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30897

Bug ID: 30897
   Summary: Support source view for "referenced" source (e.g.
bison)
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: enhancement
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

There is an example within gprofng for that.
When looking at QLParser we only can show the source file QLParser.tab.cc, but
the really interesting file is QLParser.yy.

Using "gprof display text -source QLParser.yy" shows
Error: No function or file with given name ` QLParser.yy' found


Please provide a way to annotate also those sources.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug ld/30877] [BUG][RISCV]relro protection not working in riscv

2023-09-25 Thread akhilesh.k at samsung dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30877

Akhilesh Kumar  changed:

   What|Removed |Added

 CC||akhilesh.k at samsung dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30896] New: gprofng display text: please provide a way (or document how) to include the object name next to the called functions

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30896

Bug ID: 30896
   Summary: gprofng display text: please provide a way (or
document how) to include the object name next to the
called functions
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: enhancement
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

"gprofng display text -metrics name:e.%totalcpu -functions"

shows the metrics for the function names; given the docs I've tried

"gprofng display text -metrics name:soname:e.%totalcpu -functions"

results in

Error: No data recorded to support metric specification: soname

the goal was that instead of

0.230 100.00  0.230 100.00   
0.120  52.17  0.120  52.17   func1

the output would be

0.230 100.00  0.230 100.00   
0.120  52.17  0.120  52.17   func1 (name.so)

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30895] New: gprofng is not relocatable

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30895

Bug ID: 30895
   Summary: gprofng is not relocatable
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: minor
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

To reproduce on a clean system:

./configure
make
make install DESTDIR=/tmp
cd /tmp/usr/local/bin
./gprofng collect app ls
Creating experiment directory test.1.er (Process ID: 4132928) ...
configuration error: can not find libgp-collector.so. run aborted
LD_LIBRARY_PATH=../lib ./gprofng collect app ls
Creating experiment directory test.1.er (Process ID: 4136138) ...
configuration error: can not find libgp-collector.so. run aborted

Ideally (one or all):
* there is an environment variable to override the search path
* the shared library is found via the link loader path
* the shared library is searched not fixed on compile-time constant LIBDIR but
relative to the installed binary (which would make gprofng relocatable)

I didn't found an option to run that outside of the configure-time installation
path - is there one?

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30894] New: bison should be no hard dependency

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30894

Bug ID: 30894
   Summary: bison should be no hard dependency
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

Created attachment 15132
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15132&action=edit
ditribute bison generated files

When running from a distribution tarball, bison should not be necessary. The
attachement adjust the distribution, so that the generated files will be
distributed in exactly the version they were tested with, but configure.ac
still needs an adjustment to not abort if bison isn't there.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30893] New: gprofng uses syscall + perf_event (hwcdrv) and ptrace (gpcollect) without any check and doc

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30893

Bug ID: 30893
   Summary: gprofng uses syscall + perf_event (hwcdrv) and ptrace
(gpcollect) without any check and doc
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

gprofng should either have an option to build without syscall + perf_event or
an explicit check in configure for the necessary headers.

Similar ptrace should also be tested.

Note: both are also not mentioned in the dependencies in the README either

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30892] New: objdump: SEGV at bfd/elf.c:2562 in bfd_elf_print_symbol

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30892

Bug ID: 30892
   Summary: objdump: SEGV at bfd/elf.c:2562 in
bfd_elf_print_symbol
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15131
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15131&action=edit
this poc with -T argument can crash objdump in the latest version

Summary:

A crash caused when using objdump
AddressSanitizer reported it as SEGV

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/objdump -T ./poc_36

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./poc_36

/home/pt/sytseng/binutils-gdb-asan/binutils/objdump: option -P/--private not
supported by this file
AddressSanitizer:DEADLYSIGNAL
=
==2557302==ERROR: AddressSanitizer: SEGV on unknown address 0x62100a006570 (pc
0x7fbf1d067616 bp 0x7ffe2bd496d0 sp 0x7ffe2bd48df8 T0)
==2557302==The signal is caused by a READ memory access.
#0 0x7fbf1d067615 in __sanitizer::internal_strlen(char const*)
../../../../src/libsanitizer/sanitizer_common/sanitizer_libc.cc:164
#1 0x7fbf1cfde174 in printf_common
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_format.inc:544
#2 0x7fbf1cfdefb6 in __interceptor_vfprintf
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1604
#3 0x7fbf1cfdf0be in __interceptor_fprintf
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1661
#4 0x55daa305218e in bfd_elf_print_symbol
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2562
#5 0x55daa2e80e01 in dump_symbols objdump.c:5162
#6 0x55daa2e834e1 in dump_bfd objdump.c:5670
#7 0x55daa2e838cd in display_object_bfd objdump.c:5750
#8 0x55daa2e83c05 in display_any_bfd objdump.c:5837
#9 0x55daa2e83c7f in display_file objdump.c:5858
#10 0x55daa2e85633 in main objdump.c:6269
#11 0x7fbf1cd6d082 in __libc_start_main ../csu/libc-start.c:308
#12 0x55daa2e6937d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
../../../../src/libsanitizer/sanitizer_common/sanitizer_libc.cc:164 in
__sanitizer::internal_strlen(char const*)
==2557302==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30891] New: objdump: SEGV /home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9543 in _bfd_elf_slurp_version_tables

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30891

Bug ID: 30891
   Summary: objdump: SEGV
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9543 in
_bfd_elf_slurp_version_tables
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15130
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15130&action=edit
this poc with -T argument can crash objdump in the latest version

Summary:

A crash caused when using objdump
AddressSanitizer reported it as SEGV

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/objdump -T ./poc_25

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./poc_25

BFD: warning: ./pocs/poc_25 has a program header with invalid alignment
/home/pt/sytseng/binutils-gdb-asan/binutils/objdump: option -P/--private not
supported by this file
AddressSanitizer:DEADLYSIGNAL
=
==2535506==ERROR: AddressSanitizer: SEGV on unknown address 0x002c (pc
0x55dca2fc8ff3 bp 0x7ffcc79f0d30 sp 0x7ffcc79f0b40 T0)
==2535506==The signal is caused by a READ memory access.
==2535506==Hint: address points to the zero page.
#0 0x55dca2fc8ff2 in _bfd_elf_slurp_version_tables
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9543
#1 0x55dca2f7f805 in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1278
#2 0x55dca2fc722d in _bfd_elf_canonicalize_dynamic_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9285
#3 0x55dca2db2e96 in slurp_dynamic_symtab objdump.c:1051
#4 0x55dca2dc93e0 in dump_bfd objdump.c:5656
#5 0x55dca2dc98cd in display_object_bfd objdump.c:5750
#6 0x55dca2dc9c05 in display_any_bfd objdump.c:5837
#7 0x55dca2dc9c7f in display_file objdump.c:5858
#8 0x55dca2dcb633 in main objdump.c:6269
#9 0x7fb063965082 in __libc_start_main ../csu/libc-start.c:308
#10 0x55dca2daf37d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9543 in
_bfd_elf_slurp_version_tables
==2535506==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30890] objdump: attempting free on address which was not malloc()-ed at bfd/elf.c:9802 in _bfd_elf_slurp_version_tables

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30890

--- Comment #1 from 曾信彥  ---
$ binutils/nm-new -D ./poc_0

needs to modify to

$ binutils/objdump -T ./poc_0

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30890] New: objdump: attempting free on address which was not malloc()-ed at bfd/elf.c:9802 in _bfd_elf_slurp_version_tables

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30890

Bug ID: 30890
   Summary: objdump: attempting free on address which was not
malloc()-ed at bfd/elf.c:9802 in
_bfd_elf_slurp_version_tables
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15129
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15129&action=edit
this poc with -T argument can crash objdump in the latest version

Summary:

A crash caused when using objdump
AddressSanitizer reported it as attempting free on address which was not
malloc()-ed

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_0

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./poc_0

/home/pt/sytseng/binutils-gdb-asan/binutils/objdump: option -P/--private not
supported by this file
BFD: ./pocs/poc_0: .gnu.version_r invalid entry
=
==2486577==ERROR: AddressSanitizer: attempting free on address which was not
malloc()-ed: 0x62106688 in thread T0
#0 0x7f62bd29140f in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x55892d993c66 in _bfd_elf_slurp_version_tables
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9802
#2 0x55892d948805 in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1278
#3 0x55892d99022d in _bfd_elf_canonicalize_dynamic_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9285
#4 0x55892d77be96 in slurp_dynamic_symtab objdump.c:1051
#5 0x55892d7923e0 in dump_bfd objdump.c:5656
#6 0x55892d7928cd in display_object_bfd objdump.c:5750
#7 0x55892d792c05 in display_any_bfd objdump.c:5837
#8 0x55892d792c7f in display_file objdump.c:5858
#9 0x55892d794633 in main objdump.c:6269
#10 0x7f62bcfb0082 in __libc_start_main ../csu/libc-start.c:308
#11 0x55892d77837d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)

0x62106688 is located 392 bytes inside of 4064-byte region
[0x62106500,0x621074e0)
allocated by thread T0 here:
#0 0x7f62bd291808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x55892db79bf2 in _objalloc_alloc objalloc.c:159
#2 0x55892d8d560c in bfd_alloc
/home/pt/sytseng/binutils-gdb-asan/bfd/libbfd.c:452
#3 0x55892d95fa52 in _bfd_elf_get_dynamic_symbols
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2293
#4 0x55892d9457a5 in bfd_elf64_object_p
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
#5 0x55892d8d11fe in bfd_check_format_matches
/home/pt/sytseng/binutils-gdb-asan/bfd/format.c:431
#6 0x55892d7928b5 in display_object_bfd objdump.c:5748
#7 0x55892d792c05 in display_any_bfd objdump.c:5837
#8 0x55892d792c7f in display_file objdump.c:5858
#9 0x55892d794633 in main objdump.c:6269
#10 0x7f62bcfb0082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: bad-free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 in
__interceptor_free
==2486577==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30889] New: can't compile without large file support

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30889

Bug ID: 30889
   Summary: can't compile without large file support
   Product: binutils
   Version: 2.41
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: gprofng
  Assignee: vladimir.mezentsev at oracle dot com
  Reporter: bugmenot at mailinator dot com
  Target Milestone: ---

Created attachment 15128
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15128&action=edit
only use O_LARGEFILE if defined

here's a partial patch similar to what zlib uses; of course for a full support
some largefile types like ino64_t should not be used directly (but still I'd
suggest to include this minor patch to have at least the open option similar to
zlib)

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug gprofng/30779] gprofng: fails to build with musl-1.2.4 (gprofng/src/Data_window.h:56:3: error: 'off64_t' does not name a type; did you mean 'off_t'?)

2023-09-25 Thread bugmenot at mailinator dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=30779

John Doe  changed:

   What|Removed |Added

 CC||bugmenot at mailinator dot com

--- Comment #4 from John Doe  ---
> I fixed the compiler errors (open64, fgetpo64 and fsetpos64 are redefined) in 
> gprofng.

This seems to be missing in git upstream.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30888] New: nm: SEGV on unknow address at bfd/elf.c:9453 in _bfd_elf_slurp_version_tables

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30888

Bug ID: 30888
   Summary: nm: SEGV on unknow address at bfd/elf.c:9453 in
_bfd_elf_slurp_version_tables
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15127
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15127&action=edit
this poc with -D argument can crash nm-new in the latest version

Summary:

A crash caused when using nm
AddressSanitizer reported it as alloc-dealloc-mismatch (INVALID vs free)

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_26

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/nm-new -D ./poc_26

BFD: warning: ./pocs/poc_26 has a program header with invalid alignment
AddressSanitizer:DEADLYSIGNAL
=
==702781==ERROR: AddressSanitizer: SEGV on unknown address 0x002c (pc
0x564014e614cb bp 0x7ffe62815d40 sp 0x7ffe62815b50 T0)
==702781==The signal is caused by a READ memory access.
==702781==Hint: address points to the zero page.
#0 0x564014e614ca in _bfd_elf_slurp_version_tables
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9543
#1 0x564014e17cdd in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1278
#2 0x564014e5f705 in _bfd_elf_canonicalize_dynamic_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9285
#3 0x564014db0fcf in _bfd_generic_read_minisymbols
/home/pt/sytseng/binutils-gdb-asan/bfd/syms.c:834
#4 0x564014d826da in display_rel_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1413
#5 0x564014d83838 in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1649
#6 0x564014d85827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#7 0x7f5a56d20082 in __libc_start_main ../csu/libc-start.c:308
#8 0x564014d7c15d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/nm-new+0xa315d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9543 in
_bfd_elf_slurp_version_tables
==702781==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30887] New: nm: alloc-dealloc-mismatch (INVALID vs free) at bfd/elf.c:9802 in _bfd_elf_slurp_version_tables

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30887

Bug ID: 30887
   Summary: nm: alloc-dealloc-mismatch (INVALID vs free) at
bfd/elf.c:9802 in _bfd_elf_slurp_version_tables
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15126
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15126&action=edit
this poc with -D argument can crash nm-new in the latest version

Summary:

A crash caused when using nm
AddressSanitizer reported it as alloc-dealloc-mismatch (INVALID vs free)

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_16

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/nm-new -D ./poc_16

BFD: warning: ./pocs/poc_16 has a program header with invalid alignment
BFD: ./pocs/poc_16: .gnu.version_r invalid entry
=
==689764==ERROR: AddressSanitizer: alloc-dealloc-mismatch (INVALID vs free) on
0x62107a88
#0 0x7f518765940f in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x557116e5113e in _bfd_elf_slurp_version_tables
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9802
#2 0x557116e05cdd in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1278
#3 0x557116e4d705 in _bfd_elf_canonicalize_dynamic_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9285
#4 0x557116d9efcf in _bfd_generic_read_minisymbols
/home/pt/sytseng/binutils-gdb-asan/bfd/syms.c:834
#5 0x557116d706da in display_rel_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1413
#6 0x557116d71838 in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1649
#7 0x557116d73827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#8 0x7f5187378082 in __libc_start_main ../csu/libc-start.c:308
#9 0x557116d6a15d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/nm-new+0xa315d)

0x62107a88 is located 392 bytes inside of 4064-byte region
[0x62107900,0x621088e0)
allocated by thread T0 here:
#0 0x7f5187659808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x557117072354 in _objalloc_alloc objalloc.c:159
#2 0x557116d93db6 in bfd_alloc
/home/pt/sytseng/binutils-gdb-asan/bfd/libbfd.c:452
#3 0x557116e1cf2a in _bfd_elf_get_dynamic_symbols
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2293
#4 0x557116e02c7d in bfd_elf64_object_p
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
#5 0x557116d8f5ac in bfd_check_format_matches
/home/pt/sytseng/binutils-gdb-asan/bfd/format.c:365
#6 0x557116d717da in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1645
#7 0x557116d73827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#8 0x7f5187378082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: alloc-dealloc-mismatch
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 in
__interceptor_free
==689764==HINT: if you don't care about these errors you may set
ASAN_OPTIONS=alloc_dealloc_mismatch=0
==689764==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30886] New: nm: SEGV on unknow address at nm.c:718 in print_symname

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30886

Bug ID: 30886
   Summary: nm: SEGV on unknow address at nm.c:718 in
print_symname
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15125
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15125&action=edit
this poc with -D argument can crash nm-new in the latest version

Summary:

A crash caused when using nm
AddressSanitizer reported it as DEADLYSIGNAL

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_14

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/nm-new -D ./poc_14

BFD: warning: ./pocs/poc_14 has a program header with invalid alignment
AddressSanitizer:DEADLYSIGNAL
=
==686862==ERROR: AddressSanitizer: SEGV on unknown address 0x621004000f30 (pc
0x55a5e809f56e bp 0x712488b0 sp 0x712487e0 T0)
==686862==The signal is caused by a READ memory access.
#0 0x55a5e809f56d in print_symname
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:718
#1 0x55a5e80a532b in print_symbol_info_bsd
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1873
#2 0x55a5e80a22c1 in print_symbol
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1228
#3 0x55a5e80a34e7 in print_symbols
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1388
#4 0x55a5e80a402e in display_rel_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1503
#5 0x55a5e80a4838 in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1649
#6 0x55a5e80a6827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#7 0x7f4230f78082 in __libc_start_main ../csu/libc-start.c:308
#8 0x55a5e809d15d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/nm-new+0xa315d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:718 in print_symname
==686862==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug binutils/30885] New: nm: heap-buffer-overflow at elfcode.h:1507 in bfd_elf64_slurp_symbol_table

2023-09-25 Thread yan.cs10 at nycu dot edu.tw
https://sourceware.org/bugzilla/show_bug.cgi?id=30885

Bug ID: 30885
   Summary: nm: heap-buffer-overflow at elfcode.h:1507 in
bfd_elf64_slurp_symbol_table
   Product: binutils
   Version: 2.42 (HEAD)
Status: UNCONFIRMED
  Severity: normal
  Priority: P2
 Component: binutils
  Assignee: unassigned at sourceware dot org
  Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15124
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15124&action=edit
this poc with -D -l argument can crash nm-new in the latest version

Summary:

A crash caused when using nm
AddressSanitizer reported it as heap-buffer-overflow

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D -l ./poc_0

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/nm-new -D -l ./poc_0

BFD: warning: ./pocs/poc_0 has a program header with invalid alignment
=
==666905==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60200598 at pc 0x564fd90fc26d bp 0x7ffd7c1e0ad0 sp 0x7ffd7c1e0ac0
WRITE of size 8 at 0x60200598 thread T0
#0 0x564fd90fc26c in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1507
#1 0x564fd91425cc in _bfd_elf_canonicalize_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9273
#2 0x564fd906450a in print_symbol
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1252
#3 0x564fd90654e7 in print_symbols
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1388
#4 0x564fd906602e in display_rel_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1503
#5 0x564fd9066838 in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1649
#6 0x564fd9068827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#7 0x7f51463e5082 in __libc_start_main ../csu/libc-start.c:308
#8 0x564fd905f15d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/nm-new+0xa315d)

0x60200598 is located 0 bytes to the right of 8-byte region
[0x60200590,0x60200598)
allocated by thread T0 here:
#0 0x7f51466c6808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x564fd9371f63 in xmalloc xmalloc.c:149
#2 0x564fd906445c in print_symbol
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1251
#3 0x564fd90654e7 in print_symbols
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1388
#4 0x564fd906602e in display_rel_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1503
#5 0x564fd9066838 in display_file
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:1649
#6 0x564fd9068827 in main
/home/pt/sytseng/binutils-gdb-asan/binutils/nm.c:2161
#7 0x7f51463e5082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1507 in
bfd_elf64_slurp_symbol_table
Shadow bytes around the buggy address:
  0x0c047fff8060: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff8070: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8090: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff80a0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa 04 fa
=>0x0c047fff80b0: fa fa 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:   00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:   fa
  Freed heap region:   fd
  Stack left redzone:  f1
  Stack mid redzone:   f2
  Stack right redzone: f3
  Stack after return:  f5
  Stack use after scope:   f8
  Global redzone:  f9
  Global init order:   f6
  Poisoned by user:f7
  Container overflow:  fc
  Array cookie:ac
  Intra object redzone:bb
  ASan internal:   fe
  Left alloca redzone: ca
  Right alloca redzone:cb
  Shadow gap:  cc
==666905==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.


[Bug ld/30877] [BUG][RISCV]relro protection not working in riscv

2023-09-25 Thread cvs-commit at gcc dot gnu.org
https://sourceware.org/bugzilla/show_bug.cgi?id=30877

--- Comment #3 from cvs-commit at gcc dot gnu.org  ---
The master branch has been updated by Andreas Schwab :

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7345d05aafde53a48d5a587a6d9c1778db78e0f3

commit 7345d05aafde53a48d5a587a6d9c1778db78e0f3
Author: Andreas Schwab 
Date:   Thu Sep 21 16:49:41 2023 +0200

RISC-V: Protect .got with relro

Move .got before .data so that it can be protected with -zrelro.  Also
separate .got.plt from .got if -znow is not in effect; the first two words
of .got.plt are placed within the relro region.

ld:
PR ld/30877
* emulparams/elf32lriscv-defs.sh (DATA_GOT, SEPARATE_GOTPLT):
Define.
* emulparams/elf64lriscv-defs.sh (SEPARATE_GOTPLT): Define.
* testsuite/ld-elf/binutils.exp (binutils_test): Remove riscv*-*-*
from relro_got expression.

-- 
You are receiving this mail because:
You are on the CC list for the bug.