https://sourceware.org/bugzilla/show_bug.cgi?id=22210
Bug ID: 22210
Summary: large loop in read_formatted_entries in dwarf2.c in
binutils 2.30(HEAD)
Product: binutils
Version: 2.30 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: luanjunchao at 163 dot com
Target Milestone: ---
Created attachment 10484
--> https://sourceware.org/bugzilla/attachment.cgi?id=10484&action=edit
poc of large loop
I wonder if it's normal or not. When I run "nm: -A -a -l -S -s --special-syms
--synthetic --with-symbol-versions hang.elf", it stops for a long time and call
realloc persistently.
I look into the problem and find the point, here is the snippet of function
read_formatted_entries:
data_count = _bfd_safe_read_leb128 (abfd, buf, &bytes_read, FALSE, buf_end);
buf += bytes_read;
for (datai = 0; datai < data_count; datai++)
{
bfd_byte *format = format_header_data;
struct fileinfo fe;
......
if (!callback (table, fe.name, fe.dir, fe.time, fe.size))
return FALSE;
}
data_count is unsigned long, and callback is function
line_info_add_include_dir_stub, and then I debug it with gdb:
(gdb)ptype data_count
unsigned long
(gdb)p/x data_count
0xfffbfff
(gdb)p/x datai
0x01
I'm not sure if there is lack of verifcation or not, it seems abnormal.
The poc is attached here.
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
bug-binutils mailing list
bug-binutils@gnu.org
https://lists.gnu.org/mailman/listinfo/bug-binutils
