libctf: fix ref leak of names of newly-inserted non-root-visible types

A bug in ctf_dtd_delete led to refs in the string table to the names of non-root-visible types not being removed when the DTD was. This seems harmless, but actually it would lead to a write down a pointer into freed memory if such a type was ctf_rollback()ed over and then the dict was serialized (updating all the refs as the strtab was serialized in turn). Bug introduced in commit fe4c2d5563 ("libctf: create: non-root-visible types should not appear in name tables") which is included in binutils 2.35. libctf/ * ctf-create.c (ctf_dtd_delete): Remove refs for all types with names, not just root-visible ones.
PR27755, powerpc-ld infinite loop
2026-02-16 22:12:31 +00:00 · 2024-08-02 13:54:40 +01:00 · 2021-05-03 15:46:00 +09:30 · 2021-03-22 10:06:07 -07:00 · 2021-01-30 12:58:34 +00:00
5 changed files with 22 additions and 7 deletions
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,18 @@
+2021-05-03  Alan Modra  <amodra@gmail.com>
+
+	PR 27755
+	* elf32-ppc.c (ppc_elf_inline_plt): Do increment rel in loop.
+
+2021-03-22  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR ld/27587
+	* dwarf2.c (read_attribute_value): Check version >= 3 for
+	DW_FORM_ref_addr.
+
+2021-01-30  Nick Clifton  <nickc@redhat.com>
+
+	* development.sh (development): Set to true.
+
 2021-01-30  Nick Clifton  <nickc@redhat.com>

 	This is the 2.35.2 release.
--- a/bfd/development.sh
+++ b/bfd/development.sh
@@ -16,7 +16,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

 # Controls whether to enable development-mode features by default.
-development=false
+development=true

 # Indicate whether this is a release branch.
 experimental=false
--- a/bfd/dwarf2.c
+++ b/bfd/dwarf2.c
@@ -1182,7 +1182,7 @@ read_attribute_value (struct attribute *  attr,
    case DW_FORM_ref_addr:
      /* DW_FORM_ref_addr is an address in DWARF2, and an offset in
 	 DWARF3.  */
-      if (unit->version == 3 || unit->version == 4)
+      if (unit->version >= 3)
 	{
 	  if (unit->offset_size == 4)
 	    attr->u.val = read_4_bytes (unit->abfd, info_ptr, info_ptr_end);
--- a/bfd/elf32-ppc.c
+++ b/bfd/elf32-ppc.c
@@ -4246,7 +4246,7 @@ ppc_elf_inline_plt (struct bfd_link_info *info)
 	      return FALSE;

 	    relend = relstart + sec->reloc_count;
-	    for (rel = relstart; rel < relend; )
+	    for (rel = relstart; rel < relend; rel++)
 	      {
 		enum elf_ppc_reloc_type r_type;
 		unsigned long r_symndx;
--- a/libctf/ctf-create.c
+++ b/libctf/ctf-create.c
@@ -651,11 +651,11 @@ ctf_dtd_delete (ctf_file_t *fp, ctf_dtdef_t *dtd)
    }

  if (dtd->dtd_data.ctt_name
-      && (name = ctf_strraw (fp, dtd->dtd_data.ctt_name)) != NULL
-      && LCTF_INFO_ISROOT (fp, dtd->dtd_data.ctt_info))
+      && (name = ctf_strraw (fp, dtd->dtd_data.ctt_name)) != NULL)
    {
-      ctf_dynhash_remove (ctf_name_table (fp, name_kind)->ctn_writable,
-			  name);
+      if (LCTF_INFO_ISROOT (fp, dtd->dtd_data.ctt_info))
+	ctf_dynhash_remove (ctf_name_table (fp, name_kind)->ctn_writable,
+			    name);
      ctf_str_remove_ref (fp, name, &dtd->dtd_data.ctt_name);
    }
Author	SHA1	Message	Date
Nick Alcock	acc7a74a2c	libctf: fix ref leak of names of newly-inserted non-root-visible types A bug in ctf_dtd_delete led to refs in the string table to the names of non-root-visible types not being removed when the DTD was. This seems harmless, but actually it would lead to a write down a pointer into freed memory if such a type was ctf_rollback()ed over and then the dict was serialized (updating all the refs as the strtab was serialized in turn). Bug introduced in commit `fe4c2d5563` ("libctf: create: non-root-visible types should not appear in name tables") which is included in binutils 2.35. libctf/ * ctf-create.c (ctf_dtd_delete): Remove refs for all types with names, not just root-visible ones.	2024-08-02 13:54:40 +01:00
Alan Modra	3437a8bad8	PR27755, powerpc-ld infinite loop PR 27755 * elf32-ppc.c (ppc_elf_inline_plt): Do increment rel in loop. (cherry picked from commit `337d0bf887`)	2021-05-03 15:46:00 +09:30
H.J. Lu	d8768ca6a7	DWARF: Check version >= 3 for DW_FORM_ref_addr Check version >= 3, instead of version == 3 \|\| version == 4, for DW_FORM_ref_addr. bfd/ PR ld/27587 * dwarf2.c (read_attribute_value): Check version >= 3 for DW_FORM_ref_addr. (cherry picked from commit `51f6e7a9f4`)	2021-03-22 10:06:07 -07:00
Nick Clifton	959ab8e63a	Reset development to true	2021-01-30 12:58:34 +00:00