[Bug corefiles/23118] New: gdb terminate with SIGABRT when loading binary with core dump

[donald.zgd at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23118

Bug ID: 23118
Summary: gdb terminate with SIGABRT when loading binary with
core dump
Product: gdb
Version: HEAD
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: corefiles
Assignee: unassigned at sourceware dot org
Reporter: donald.zgd at gmail dot com
Target Milestone: ---

# ------------
# Cmdline:
$ gdb /tmp/cb /tmp/core

# ------------
# gdb output
Program received signal SIGABRT, Aborted.
0x00007ffff6716428 in __GI_raise (sig=***@entry=6) at
../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff6716428 in __GI_raise (sig=***@entry=6) at
../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007ffff671802a in __GI_abort () at abort.c:89
#2 0x00007ffff67587ea in __libc_message (do_abort=***@entry=2,
fmt=***@entry=0x7ffff6871ed8 "*** Error in `%s': %s: 0x%s ***\n") at
../sysdeps/posix/libc_fatal.c:175
#3 0x00007ffff676137a in malloc_printerr (ar_ptr=<optimized out>,
ptr=<optimized out>,
str=0x7ffff6871f50 "free(): invalid next size (fast)", action=3) at
malloc.c:5006
#4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at
malloc.c:3867
#5 0x00007ffff676553c in __GI___libc_free (mem=<optimized out>) at
malloc.c:2968
#6 0x000000000095dd61 in memory_bclose (abfd=0x138c680) at
../../bfd/bfdio.c:608
#7 0x000000000096383e in bfd_close_all_done (abfd=0x138c680) at
../../bfd/opncls.c:768
#8 0x00000000009637f8 in bfd_close (abfd=0x138c680) at ../../bfd/opncls.c:735
#9 0x000000000071a3ae in gdb_bfd_close_or_warn (abfd=0x138c680) at
../../gdb/gdb_bfd.c:511
#10 0x000000000071a783 in gdb_bfd_unref (abfd=0x138c680) at
../../gdb/gdb_bfd.c:615
#11 0x000000000043c853 in gdb_bfd_ref_policy::decref (abfd=0x138c680) at
../../gdb/gdb_bfd.h:64
#12 0x000000000043c987 in gdb::ref_ptr<bfd, gdb_bfd_ref_policy>::~ref_ptr
(this=0x7fffffffdc10, __in_chrg=<optimized out>)
at ../../gdb/common/gdb_ref_ptr.h:91
#13 0x000000000043e15a in symbol_file_add_from_memory (templ=0x137d490,
addr=4151988224, size=8192,
name=0x138c5a0 "system-supplied DSO at 0xf77a5000", from_tty=0) at
../../gdb/symfile-mem.c:102
#14 0x000000000043e328 in add_vsyscall_page (target=0x1134b60 <core_ops>,
from_tty=1) at ../../gdb/symfile-mem.c:199
#15 0x000000000043ee39 in std::_Function_handler<void (target_ops*, int), void
(*)(target_ops*, int)>::_M_invoke(std::_Any_data const&, target_ops*&&, int&&)
(__functor=..., __args#0=<unknown type in /tmp/gdb_fuzz/gdb, CU 0x11bf62, DIE
0x13f758>,
__args#1=<unknown type in /tmp/gdb_fuzz/gdb, CU 0x11bf62, DIE 0x13f75d>) at
/usr/include/c++/5/functional:1871
#16 0x000000000074fda2 in std::function<void (target_ops*,
int)>::operator()(target_ops*, int) const (this=0x12eeb38,
__args#0=0x1134b60 <core_ops>, __args#1=1) at
/usr/include/c++/5/functional:2267
#17 0x000000000074fb6e in gdb::observers::observable<target_ops*, int>::notify
(this=0x11423c0 <gdb::observers::inferior_created>,
args#0=0x1134b60 <core_ops>, args#1=1) at ../../gdb/common/observable.h:106
#18 0x0000000000749d06 in post_create_inferior (target=0x1134b60 <core_ops>,
from_tty=1) at ../../gdb/infcmd.c:502
#19 0x000000000064347d in core_open (arg=0x7fffffffe58f "/tmp/core",
from_tty=1) at ../../gdb/corelow.c:394
#20 0x0000000000641709 in core_file_command (filename=0x7fffffffe58f
"/tmp/core", from_tty=1) at ../../gdb/corefile.c:73
#21 0x000000000079291a in catch_command_errors (command=0x64166a
<core_file_command(char const*, int)>,
arg=0x7fffffffe58f "/tmp/core", from_tty=1) at ../../gdb/main.c:379
#22 0x0000000000793b99 in captured_main_1 (context=0x7fffffffe1b0) at
../../gdb/main.c:1077
#23 0x0000000000793ecd in captured_main (data=0x7fffffffe1b0) at
../../gdb/main.c:1147
#24 0x0000000000793fb3 in gdb_main (args=0x7fffffffe1b0) at
../../gdb/main.c:1173
#25 0x000000000040bd2f in main (argc=3, argv=0x7fffffffe2b8) at
../../gdb/gdb.c:32
(gdb) info proc mappings
process 19155
Mapped address spaces:

Start Addr End Addr Size Offset objfile
0x400000 0xe2a000 0xa2a000 0x0 /tmp/gdb
0x1029000 0x110b000 0xe2000 0xa29000 /tmp/gdb
0x110b000 0x1128000 0x1d000 0xb0b000 /tmp/gdb
0x1128000 0x13a1000 0x279000 0x0 [heap]
0x7ffff0000000 0x7ffff0021000 0x21000 0x0
0x7ffff0021000 0x7ffff4000000 0x3fdf000 0x0
0x7ffff5f2b000 0x7ffff5f41000 0x16000 0x0
/lib/x86_64-linux-gnu/libgcc_s.so.1
0x7ffff5f41000 0x7ffff6140000 0x1ff000 0x16000
/lib/x86_64-linux-gnu/libgcc_s.so.1
0x7ffff6140000 0x7ffff6141000 0x1000 0x15000
/lib/x86_64-linux-gnu/libgcc_s.so.1
0x7ffff6153000 0x7ffff62c4000 0x171000 0x0
0x7ffff62c4000 0x7ffff62c6000 0x2000 0x0
/lib/x86_64-linux-gnu/libutil-2.23.so
0x7ffff62c6000 0x7ffff64c5000 0x1ff000 0x2000
/lib/x86_64-linux-gnu/libutil-2.23.so
0x7ffff64c5000 0x7ffff64c6000 0x1000 0x1000
/lib/x86_64-linux-gnu/libutil-2.23.so
0x7ffff64c6000 0x7ffff64c7000 0x1000 0x2000
/lib/x86_64-linux-gnu/libutil-2.23.so
0x7ffff64c7000 0x7ffff64e0000 0x19000 0x0
/lib/x86_64-linux-gnu/libz.so.1.2.8
0x7ffff64e0000 0x7ffff66df000 0x1ff000 0x19000
/lib/x86_64-linux-gnu/libz.so.1.2.8
0x7ffff66df000 0x7ffff66e0000 0x1000 0x18000
/lib/x86_64-linux-gnu/libz.so.1.2.8
0x7ffff66e0000 0x7ffff66e1000 0x1000 0x19000
/lib/x86_64-linux-gnu/libz.so.1.2.8
0x7ffff66e1000 0x7ffff68a1000 0x1c0000 0x0
/lib/x86_64-linux-gnu/libc-2.23.so
0x7ffff68a1000 0x7ffff6aa1000 0x200000 0x1c0000
/lib/x86_64-linux-gnu/libc-2.23.so
0x7ffff6aa1000 0x7ffff6aa5000 0x4000 0x1c0000
/lib/x86_64-linux-gnu/libc-2.23.so
0x7ffff6aa5000 0x7ffff6aa7000 0x2000 0x1c4000
/lib/x86_64-linux-gnu/libc-2.23.so
0x7ffff6aa7000 0x7ffff6aab000 0x4000 0x0
0x7ffff6aab000 0x7ffff6ad1000 0x26000 0x0
/lib/x86_64-linux-gnu/libexpat.so.1.6.0
0x7ffff6ad1000 0x7ffff6cd1000 0x200000 0x26000
/lib/x86_64-linux-gnu/libexpat.so.1.6.0
0x7ffff6cd1000 0x7ffff6cd3000 0x2000 0x26000
/lib/x86_64-linux-gnu/libexpat.so.1.6.0
0x7ffff6cd3000 0x7ffff6cd4000 0x1000 0x28000
/lib/x86_64-linux-gnu/libexpat.so.1.6.0
0x7ffff6cd4000 0x7ffff6fc6000 0x2f2000 0x0
/usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0
0x7ffff6fc6000 0x7ffff71c6000 0x200000 0x2f2000
/usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0
0x7ffff71c6000 0x7ffff71c8000 0x2000 0x2f2000
/usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0
0x7ffff71c8000 0x7ffff723f000 0x77000 0x2f4000
/usr/lib/x86_64-linux-gnu/libpython2.7.so.1.0
0x7ffff723f000 0x7ffff7262000 0x23000 0x0
0x7ffff7262000 0x7ffff736a000 0x108000 0x0
/lib/x86_64-linux-gnu/libm-2.23.so
0x7ffff736a000 0x7ffff7569000 0x1ff000 0x108000
/lib/x86_64-linux-gnu/libm-2.23.so
0x7ffff7569000 0x7ffff756a000 0x1000 0x107000
/lib/x86_64-linux-gnu/libm-2.23.so
0x7ffff756a000 0x7ffff756b000 0x1000 0x108000
/lib/x86_64-linux-gnu/libm-2.23.so
0x7ffff756b000 0x7ffff7583000 0x18000 0x0
/lib/x86_64-linux-gnu/libpthread-2.23.so
0x7ffff7583000 0x7ffff7782000 0x1ff000 0x18000
/lib/x86_64-linux-gnu/libpthread-2.23.so
0x7ffff7782000 0x7ffff7783000 0x1000 0x17000
/lib/x86_64-linux-gnu/libpthread-2.23.so
0x7ffff7783000 0x7ffff7784000 0x1000 0x18000
/lib/x86_64-linux-gnu/libpthread-2.23.so
0x7ffff7784000 0x7ffff7788000 0x4000 0x0
0x7ffff7788000 0x7ffff77ad000 0x25000 0x0
/lib/x86_64-linux-gnu/libtinfo.so.5.9
0x7ffff77ad000 0x7ffff79ac000 0x1ff000 0x25000
/lib/x86_64-linux-gnu/libtinfo.so.5.9
0x7ffff79ac000 0x7ffff79b0000 0x4000 0x24000
/lib/x86_64-linux-gnu/libtinfo.so.5.9
0x7ffff79b0000 0x7ffff79b1000 0x1000 0x28000
/lib/x86_64-linux-gnu/libtinfo.so.5.9
0x7ffff79b1000 0x7ffff79d2000 0x21000 0x0
/lib/x86_64-linux-gnu/libncurses.so.5.9
0x7ffff79d2000 0x7ffff7bd1000 0x1ff000 0x21000
/lib/x86_64-linux-gnu/libncurses.so.5.9
0x7ffff7bd1000 0x7ffff7bd2000 0x1000 0x20000
/lib/x86_64-linux-gnu/libncurses.so.5.9
0x7ffff7bd2000 0x7ffff7bd3000 0x1000 0x21000
/lib/x86_64-linux-gnu/libncurses.so.5.9
0x7ffff7bd3000 0x7ffff7bd6000 0x3000 0x0
/lib/x86_64-linux-gnu/libdl-2.23.so
0x7ffff7bd6000 0x7ffff7dd5000 0x1ff000 0x3000
/lib/x86_64-linux-gnu/libdl-2.23.so
0x7ffff7dd5000 0x7ffff7dd6000 0x1000 0x2000
/lib/x86_64-linux-gnu/libdl-2.23.so
0x7ffff7dd6000 0x7ffff7dd7000 0x1000 0x3000
/lib/x86_64-linux-gnu/libdl-2.23.so
0x7ffff7dd7000 0x7ffff7dfd000 0x26000 0x0
/lib/x86_64-linux-gnu/ld-2.23.so
0x7ffff7e05000 0x7ffff7e45000 0x40000 0x0
0x7ffff7e45000 0x7ffff7fdd000 0x198000 0x0
/usr/lib/locale/locale-archive
0x7ffff7fdd000 0x7ffff7fe5000 0x8000 0x0
0x7ffff7fef000 0x7ffff7ff0000 0x1000 0x0
0x7ffff7ff0000 0x7ffff7ff7000 0x7000 0x0
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
0x7ffff7ff7000 0x7ffff7ffa000 0x3000 0x0 [vvar]
0x7ffff7ffa000 0x7ffff7ffc000 0x2000 0x0 [vdso]
0x7ffff7ffc000 0x7ffff7ffd000 0x1000 0x25000
/lib/x86_64-linux-gnu/ld-2.23.so
0x7ffff7ffd000 0x7ffff7ffe000 0x1000 0x26000
/lib/x86_64-linux-gnu/ld-2.23.so
0x7ffff7ffe000 0x7ffff7fff000 0x1000 0x0
0x7ffffffde000 0x7ffffffff000 0x21000 0x0 [stack]
0xffffffffff600000 0xffffffffff601000 0x1000 0x0 [vsyscall]


# ------------
# Environment
$ uname -a
Linux 4.4.0-112-generic #135-Ubuntu SMP Fri Jan 19 11:48:36 UTC 2018 x86_64
x86_64 x86_64 GNU/Linux

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.3 LTS
Release: 16.04
Codename: xenial

$ ulimit -s
8192


# ------------------------------
# Tested on the following gdb version
# 1.
$ git rev-parse HEAD
5373441d20b652d5b0332b6cada74524af3ae707


# ------------------------------
This bug was found by Guodong Zhu and Kang Li with Team Seri0us at 360.

[donald.zgd at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23118

--- Comment #1 from Guodong Zhu <donald.zgd at gmail dot com> ---
Created attachment 10982
--> https://sourceware.org/bugzilla/attachment.cgi?id=10982&action=edit
a regular ELF file (cb), used to load with the core file

[donald.zgd at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23118

--- Comment #2 from Guodong Zhu <donald.zgd at gmail dot com> ---
Created attachment 10984
--> https://sourceware.org/bugzilla/attachment.cgi?id=10984&action=edit
malformed core file

[donald.zgd at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23118

--- Comment #3 from Guodong Zhu <donald.zgd at gmail dot com> ---
*** Bug 23117 has been marked as a duplicate of this bug. ***