[Bug gdb/21194] New: ERROR: AddressSanitizer: heap-buffer-overflow on address

[qiyao at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=21194

Bug ID: 21194
Summary: ERROR: AddressSanitizer: heap-buffer-overflow on
address
Product: gdb
Version: HEAD
Status: NEW
Severity: normal
Priority: P2
Component: gdb
Assignee: unassigned at sourceware dot org
Reporter: qiyao at gcc dot gnu.org
Target Milestone: ---

I build GDB with CXXFLAGS='-O0 -g3 -fsanitize=address' and run test
inherit.exp,

$ make check RUNTESTFLAGS='inherit.exp'
^[[1m^[[31m==507==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60600015d438 at pc 0x7f2b4d918935 bp 0x7ffdfbf88ef0 sp 0x7ffdfbf88698^M
^[[1m^[[0m^[[1m^[[34mREAD of size 24 at 0x60600015d438 thread T0^[[1m^[[0m^M
#0 0x7f2b4d918934 in __asan_memcpy
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934)^M
#1 0xba6ebe in value_contents_copy_raw(value*, long, value*, long, long)
../../binutils-gdb/gdb/value.c:1361^M
#2 0xba6fb1 in value_contents_copy(value*, long, value*, long, long)
../../binutils-gdb/gdb/value.c:1390^M
#3 0xbb0abe in value_from_component(value*, type*, long)
../../binutils-gdb/gdb/value.c:3802^M
#4 0x5e7934 in gdbpy_apply_val_pretty_printer(extension_language_defn
const*, type*, long, unsigned long, ui_file*, int, value*, value_print_options
const*, language_defn const*)
../../binutils-gdb/gdb/python/py-prettyprint.c:729^M
#5 0x8e8742 in apply_ext_lang_val_pretty_printer(type*, long, unsigned
long, ui_file*, int, value*, value_print_options const*, language_defn const*)
../../binutils-gdb/gdb/extension.c:518^M
#6 0x7f0c14 in cp_print_value ../../binutils-gdb/gdb/cp-valprint.c:595^M
#7 0x7edb50 in cp_print_value_fields(type*, type*, long, unsigned long,
ui_file*, int, value*, value_print_options const*, type**, int)
../../binutils-gdb/gdb/cp-valprint.c:200^M
#8 0x7ef9a9 in cp_print_value_fields_rtti(type*, unsigned char const*,
long, unsigned long, ui_file*, int, value*, value_print_options const*, type**,
int) ../../binutils-gdb/gdb/cp-valprint.c:456^M
#9 0x7b23e8 in c_val_print_struct ../../binutils-gdb/gdb/c-valprint.c:412^M
#10 0x7b2bee in c_val_print(type*, int, unsigned long, ui_file*, int,
value*, value_print_options const*) ../../binutils-gdb/gdb/c-valprint.c:530^M
#11 0xb98e97 in val_print(type*, long, unsigned long, ui_file*, int,
value*, value_print_options const*, language_defn const*)
../../binutils-gdb/gdb/valprint.c:1120^M
#12 0x7b38a2 in c_value_print(value*, ui_file*, value_print_options const*)
../../binutils-gdb/gdb/c-valprint.c:698^M
#13 0xb99517 in value_print(value*, ui_file*, value_print_options const*)
../../binutils-gdb/gdb/valprint.c:1233^M
#14 0xa42be8 in print_formatted ../../binutils-gdb/gdb/printcmd.c:321^M
#15 0xa46ac9 in print_value(value*, format_data const*)
../../binutils-gdb/gdb/printcmd.c:1233^M
#16 0xa46d82 in print_command_1 ../../binutils-gdb/gdb/printcmd.c:1261
.................
^[[1m^[[32m0x60600015d438 is located 0 bytes to the right of 56-byte region
[0x60600015d400,0x60600015d438)^M
^[[1m^[[0m^[[1m^[[35mallocated by thread T0 here:^[[1m^[[0m^M
#0 0x7f2b4d92479a in __interceptor_calloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)^M
#1 0x7d1672 in xcalloc ../../binutils-gdb/gdb/common/common-utils.c:83^M
#2 0x7d16be in xzalloc(unsigned long)
../../binutils-gdb/gdb/common/common-utils.c:93^M
#3 0xba5b6a in allocate_value_contents
../../binutils-gdb/gdb/value.c:1039^M
#4 0xbb1367 in value_fetch_lazy(value*)
../../binutils-gdb/gdb/value.c:3955^M
#5 0xba951d in record_latest_value(value*)
../../binutils-gdb/gdb/value.c:1904^M
#6 0xa4695c in print_value(value*, format_data const*)
../../binutils-gdb/gdb/printcmd.c:1222^M
#7 0xa46d82 in print_command_1 ../../binutils-gdb/gdb/printcmd.c:1261^M
#8 0xa46e3e in print_command ../../binutils-gdb/gdb/printcmd.c:1267^M

[qiyao at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=21194

--- Comment #1 from Yao Qi <qiyao at gcc dot gnu.org> ---
If I add asserts in value_contents_copy_raw, it is triggered too,

diff --git a/gdb/value.c b/gdb/value.c
index 557c300..ae5ec78 100644
--- a/gdb/value.c
+++ b/gdb/value.c
@@ -1356,6 +1356,10 @@ value_contents_copy_raw (struct value *dst, LONGEST
dst_offset,
TARGET_CHAR_BIT * length));

/* Copy the data. */
+ gdb_assert (length * unit_size + dst_offset * unit_size
+ <= TYPE_LENGTH (dst->enclosing_type));
+ gdb_assert (length * unit_size + src_offset * unit_size
+ <= TYPE_LENGTH (src->enclosing_type));
memcpy (value_contents_all_raw (dst) + dst_offset * unit_size,
value_contents_all_raw (src) + src_offset * unit_size,
length * unit_size);
----------------------------------------------

print g_vD^M
$91 = {<vB> = {<vA> = {va = 19, vx = 20}, _vptr.vB = 0x401300 <vtable for
vD+64>, vb = 21, vx = 22}, <vC> =
/home/yao/SourceCode/gnu/gdb/git/gdb/value.c:1362: internal-error: void
value_contents_copy_raw(value*, LONGEST, value*, LONGEST, LONGEST): Assertion
`length * unit_size + src_offset * unit_size <= TYPE_LENGTH
(src->enclosing_type)' failed.^M
A problem internal to GDB has been detected,^M
further debugging may prove unreliable.^M
Quit this debugging session? (y or n) FAIL: gdb.cp/inherit.exp: print g_vD (GDB
internal error)

[tromey at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=21194

Tom Tromey <tromey at sourceware dot org> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |tromey at sourceware dot org
Resolution|--- |DUPLICATE

--- Comment #2 from Tom Tromey <tromey at sourceware dot org> ---
Marking this one as a dup because the other bug has some analysis.

*** This bug has been marked as a duplicate of bug 22860 ***