[Bug binutils/4110] Broken object file crashes nm

[sliedes at cc dot hut dot fi]

------- Additional Comments From sliedes at cc dot hut dot fi  2007-03-17 13:48 
-------
Created an attachment (id=1626)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=1626&action=view)
One more test case

With patch.3 it's starting to look quite robust, I had to try a lot of things
to break it :) Here's one that breaks it only in some very obscure cases, so
I'll attach Valgrind output from a case where it does not crash and a backtrace
from a crash in case you are unable to reproduce. (It just happens that the
uninitialized idx->shr is usually NULL, and under some obscure conditions I got
it to be 0x100 in the backtrace).

---------- Valgrind output ----------
$ valgrind ~/rec/binutils/binutils/nm-new broken.o
==9440== Memcheck, a memory error detector.
==9440== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==9440== Using LibVEX rev 1732, a library for dynamic binary translation.
==9440== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==9440== Using valgrind-3.2.3-Debian, a dynamic binary instrumentation
framework.
==9440== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==9440== For more details, rerun with: -v
==9440==
BFD: broken.o: invalid string offset 798 >= 8 for section `.group'
==9440== Conditional jump or move depends on uninitialised value(s)
==9440==    at 0x42BC4A: bfd_section_from_shdr (elf.c:2171)
==9440==    by 0x41EE4B: bfd_elf64_object_p (elfcode.h:850)
==9440==    by 0x40CAEC: bfd_check_format_matches (format.c:240)
==9440==    by 0x4039F4: display_file (nm.c:1179)
==9440==    by 0x403F3A: main (nm.c:1622)
BFD: broken.o: invalid string offset 814 >= 8 for section `.group'
BFD: broken.o: invalid string offset 836 >= 8 for section `.group'
BFD: broken.o: invalid string offset 1068 >= 8 for section `.group'
BFD: broken.o: invalid string offset 2524 >= 8 for section `.group'
BFD: broken.o: invalid string offset 65838 >= 309 for section `.shstrtab'
BFD: broken.o: invalid string offset 2511 >= 8 for section `.group'
/home/sliedes/rec/binutils/binutils/nm-new: broken.o: File truncated
==9440==
==9440== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 8 from 1)
==9440== malloc/free: in use at exit: 0 bytes in 0 blocks.
==9440== malloc/free: 15 allocs, 15 frees, 52,954 bytes allocated.
==9440== For counts of detected errors, rerun with: -v
==9440== All heap blocks were freed -- no leaks are possible.
----------

---------- Backtrace ----------
(gdb) r
Starting program: /home/sliedes/rec/binutils/binutils/nm-new smodels.o
BFD: smodels.o: invalid string offset 798 >= 520 for section `*group'

Program received signal SIGSEGV, Segmentation fault.
0x000000000042bc4c in bfd_section_from_shdr (abfd=0x5ac400, shindex=1) at
elf.c:2171
2171                  if (idx->shdr != NULL
(gdb) l
2166              idx += n_elt;
2167              while (--n_elt != 0)
2168                {
2169                  --idx;
2170
2171                  if (idx->shdr != NULL
2172                      && (s = idx->shdr->bfd_section) != NULL
2173                      && elf_next_in_group (s) != NULL)
2174                    {
2175                      elf_next_in_group (hdr->bfd_section) = s;
(gdb) print *idx
$2 = {shdr = 0x100, flags = 256}
(gdb) bt
#0  0x000000000042bc4c in bfd_section_from_shdr (abfd=0x5ac400, shindex=1) at
elf.c:2171
#1  0x000000000041ee4c in bfd_elf64_object_p (abfd=0x5ac400) at elfcode.h:850
#2  0x000000000040caed in bfd_check_format_matches (abfd=0x5ac400,
format=<value optimized out>, matching=0x7fff07a2cac8) at format.c:240
#3  0x00000000004039f5 in display_file (filename=0x7fff07a2d4bc "smodels.o") at
nm.c:1179
#4  0x0000000000403f3b in main (argc=2, argv=0x7fff07a2cc08) at nm.c:1622
(gdb) bt full
#0  0x000000000042bc4c in bfd_section_from_shdr (abfd=0x5ac400, shindex=1) at
elf.c:2171
        idx = (Elf_Internal_Group *) 0x5add50
        n_elt = 104
        s = (asection *) 0x0
        hdr = (Elf_Internal_Shdr *) 0x5bce18
        name = <value optimized out>
#1  0x000000000041ee4c in bfd_elf64_object_p (abfd=0x5ac400) at elfcode.h:850
        num_sec = 34
        x_ehdr = {e_ident =
"\177ELF\002\001\001\000\000\000\000\000\000\000\000", e_type = "\001",
e_machine = ">", e_version = "\001\000\000",
  e_entry = "\000\000\000\000\000\000\000", e_phoff =
"\000\000\000\000\000\000\000", e_shoff = "\220K\000\000\000\000\000", e_flags
= "\000\000\000",
  e_ehsize = "@", e_phentsize = "\000", e_phnum = "\000", e_shentsize = "@",
e_shnum = "\"", e_shstrndx = "\037"}
        i_ehdrp = <value optimized out>
        x_shdr = {sh_name = "\t\000\000", sh_type = "\003\000\000", sh_flags =
"\000\000\000\000\000\000\000", sh_addr = "\000\000\000\000\000\000\000",
  sh_offset = " `\000\000\000\000\000", sh_size = "\017\n\000\000\000\000\000",
sh_link = "\000\000\000", sh_info = "\000\000\000",
  sh_addralign = "\001\000\000\000\000\000\000", sh_entsize =
"\000\000\000\000\000\000\000"}
        i_shdr = {sh_name = 0, sh_type = 0, sh_flags = 0, sh_addr = 0, sh_size
= 0, sh_entsize = 0, sh_link = 0, sh_info = 0, sh_offset = 0,
  sh_addralign = 0, bfd_section = 0x0, contents = 0x0}
        i_shdrp = <value optimized out>
        shindex = 1
        ebd = (const struct elf_backend_data *) 0x5a6220
        preserve = {marker = 0x5ad300, tdata = 0x0, flags = 0, arch_info =
0x47acc0, sections = 0x0, section_last = 0x0, section_count = 0, section_htab =
{
    table = 0x5ae2f0, newfunc = 0x40f490 <bfd_section_hash_newfunc>, memory =
0x5ac560, size = 251, count = 0, entsize = 280, frozen = 0}}
        s = <value optimized out>
        target = (const bfd_target *) 0x47eb40
        target_ptr = <value optimized out>
#2  0x000000000040caed in bfd_check_format_matches (abfd=0x5ac400,
format=<value optimized out>, matching=0x7fff07a2cac8) at format.c:240
        temp = <value optimized out>
        err = <value optimized out>
        target = <value optimized out>
        matching_vector = (const bfd_target **) 0x5b3e10
        save_targ = (const bfd_target *) 0x47eb40
        right_targ = (const bfd_target *) 0x0
        ar_right_targ = <value optimized out>
        match_count = 0
        ar_match_index = 15
#3  0x00000000004039f5 in display_file (filename=0x7fff07a2d4bc "smodels.o") at
nm.c:1179
        retval = 0
        file = (bfd *) 0x5ac400
        matching = <value optimized out>
#4  0x0000000000403f3b in main (argc=2, argv=0x7fff07a2cc08) at nm.c:1622
        style = <value optimized out>
        c = <value optimized out>
        retval = 0
----------


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=4110

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.