Files
binutils-gdb/gdb/common/pathstuff.c
Tom de Vries 310b3441a0 [gdb] Fix heap-buffer-overflow in child_path
When compiling gdb with '-lasan -fsanitizer=address' and running tests with:
- export ASAN_OPTIONS="detect_leaks=0:alloc_dealloc_mismatch=0", and
- a target board using local-board.exp, which sets sysroot to ""
we run into a heap-buffer-overflow in child_path for f.i. gdb.arch/amd64-byte:
...
==3997==ERROR: AddressSanitizer: heap-buffer-overflow on address \
  0x60200002abcf at pc 0x5602acdf6872 bp 0x7ffe5237a090 sp 0x7ffe5237a080
READ of size 1 at 0x60200002abcf thread T0
    #0 0x5602acdf6871 in child_path(char const*, char const*) \
                      gdb/common/pathstuff.c:161
    #1 0x5602adb06587 in find_separate_debug_file gdb/symfile.c:1483
    #2 0x5602adb06f2f in find_separate_debug_file_by_debuglink[abi:cxx11](...) \
                      gdb/symfile.c:1563
    #3 0x5602ad13b743 in elf_symfile_read gdb/elfread.c:1293
    #4 0x5602adb01cfa in read_symbols gdb/symfile.c:798
    #5 0x5602adb03769 in syms_from_objfile_1 gdb/symfile.c:1000
    #6 0x5602adb039d0 in syms_from_objfile gdb/symfile.c:1017
    #7 0x5602adb04551 in symbol_file_add_with_addrs gdb/symfile.c:1124
    #8 0x5602adb04ebf in symbol_file_add_from_bfd(...) gdb/symfile.c:1204
    #9 0x5602ada5a78d in solib_read_symbols(...) gdb/solib.c:695
    #10 0x5602ada5bdae in solib_add(char const*, int, int) gdb/solib.c:1004
    #11 0x5602ada49bcd in enable_break gdb/solib-svr4.c:2394
    #12 0x5602ada4dae9 in svr4_solib_create_inferior_hook gdb/solib-svr4.c:3028
    #13 0x5602ada5d4f1 in solib_create_inferior_hook(int) gdb/solib.c:1215
    #14 0x5602ad347f66 in post_create_inferior(target_ops*, int) \
                          gdb/infcmd.c:467
    #15 0x5602ad348b3c in run_command_1 gdb/infcmd.c:663
    #16 0x5602ad348e55 in run_command gdb/infcmd.c:686
    #17 0x5602acd7d32b in do_const_cfunc gdb/cli/cli-decode.c:106
    #18 0x5602acd84bfe in cmd_func(cmd_list_element*, char const*, int) \
                          gdb/cli/cli-decode.c:1892
    #19 0x5602adc62a90 in execute_command(char const*, int) gdb/top.c:630
    #20 0x5602ad5053e6 in catch_command_errors gdb/main.c:372
    #21 0x5602ad507eb1 in captured_main_1 gdb/main.c:1138
    #22 0x5602ad5081ec in captured_main gdb/main.c:1163
    #23 0x5602ad508281 in gdb_main(captured_main_args*) gdb/main.c:1188
    #24 0x5602ac9ddc3a in main gdb/gdb.c:32
    #25 0x7f582b56eb96 in __libc_start_main \
                       (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #26 0x5602ac9dda09 in _start \
                       (/home/smarchi/build/binutils-gdb/gdb/gdb+0x19a2a09)

0x60200002abcf is located 1 bytes to the left of 1-byte region \
  [0x60200002abd0,0x60200002abd1)
allocated by thread T0 here:
    #0 0x7f582e0e4b50 in __interceptor_malloc \
                      (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
    #1 0x5602acdd3656 in xmalloc gdb/common/common-utils.c:44
    #2 0x5602aefe17d1 in xstrdup libiberty/xstrdup.c:34
    #3 0x5602acdf61f6 in gdb_realpath(char const*) gdb/common/pathstuff.c:80
    #4 0x5602adb06278 in find_separate_debug_file gdb/symfile.c:1444
    #5 0x5602adb06f2f in find_separate_debug_file_by_debuglink[abi:cxx11](...) \
                      gdb/symfile.c:1563
    #6 0x5602ad13b743 in elf_symfile_read gdb/elfread.c:1293
    #7 0x5602adb01cfa in read_symbols gdb/symfile.c:798
    #8 0x5602adb03769 in syms_from_objfile_1 gdb/symfile.c:1000
    #9 0x5602adb039d0 in syms_from_objfile gdb/symfile.c:1017
    #10 0x5602adb04551 in symbol_file_add_with_addrs gdb/symfile.c:1124
    #11 0x5602adb04ebf in symbol_file_add_from_bfd(...) gdb/solib.c:695
    #13 0x5602ada5bdae in solib_add(char const*, int, int) gdb/solib.c:1004
    #14 0x5602ada49bcd in enable_break gdb/solib-svr4.c:2394
    #15 0x5602ada4dae9 in svr4_solib_create_inferior_hook gdb/solib-svr4.c:3028
    #16 0x5602ada5d4f1 in solib_create_inferior_hook(int) gdb/solib.c:1215
    #17 0x5602ad347f66 in post_create_inferior(target_ops*, int) \
                       gdb/infcmd.c:467
    #18 0x5602ad348b3c in run_command_1 gdb/infcmd.c:663
    #19 0x5602ad348e55 in run_command gdb/infcmd.c:686
    #20 0x5602acd7d32b in do_const_cfunc gdb/cli/cli-decode.c:106
    #21 0x5602acd84bfe in cmd_func(cmd_list_element*, char const*, int) \
                       gdb/cli/cli-decode.c:1892
    #22 0x5602adc62a90 in execute_command(char const*, int) gdb/top.c:630
    #23 0x5602ad5053e6 in catch_command_errors gdb/main.c:372
    #24 0x5602ad507eb1 in captured_main_1 gdb/main.c:1138
    #25 0x5602ad5081ec in captured_main gdb/main.c:1163
    #26 0x5602ad508281 in gdb_main(captured_main_args*) gdb/main.c:1188
    #27 0x5602ac9ddc3a in main gdb/gdb.c:32
    #28 0x7f582b56eb96 in __libc_start_main \
                       (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-buffer-overflow gdb/common/pathstuff.c:161 \
  in child_path(char const*, char const*)
Shadow bytes around the buggy address:
  0x0c047fffd520: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fffd530: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fffd540: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fffd550: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fffd560: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00
=>0x0c047fffd570: fa fa 07 fa fa fa 00 fa fa[fa]01 fa fa fa fa fa
  0x0c047fffd580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd5a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd5b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fffd5c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3997==ABORTING
...

The direct cause is that child_path gets called with parent == "", so this
test:
...
  if (IS_DIR_SEPARATOR (parent[parent_len - 1]))
...
accesses parent[-1].

[ There is an open discussion (1) about whether an empty sysroot should indeed
be represented internally as "".  But this patch focuses on fixing the
heap-buffer-overflow without any redesign. ]

Fix this by guarding the test with 'parent_len > 0'.

Note that the fix makes child_path behave the same for:
- parent == "/" && child == "/foo" (returns "foo")
- parent == "" and child == "/foo" (returns "foo").

Build and reg-tested on x86_64-linux.

(1) https://sourceware.org/ml/gdb-patches/2019-05/msg00193.html

gdb/ChangeLog:

2019-06-17  Tom de Vries  <tdevries@suse.de>

	PR gdb/24617
	* common/pathstuff.c (child_path): Make sure parent_len > 0 before
	accessing parent[parent_len - 1].
2019-06-17 22:25:06 +02:00

291 lines
8.3 KiB
C

/* Path manipulation routines for GDB and gdbserver.
Copyright (C) 1986-2019 Free Software Foundation, Inc.
This file is part of GDB.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>. */
#include "common-defs.h"
#include "pathstuff.h"
#include "host-defs.h"
#include "filenames.h"
#include "gdb_tilde_expand.h"
#ifdef USE_WIN32API
#include <windows.h>
#endif
/* See common/pathstuff.h. */
gdb::unique_xmalloc_ptr<char>
gdb_realpath (const char *filename)
{
/* On most hosts, we rely on canonicalize_file_name to compute
the FILENAME's realpath.
But the situation is slightly more complex on Windows, due to some
versions of GCC which were reported to generate paths where
backlashes (the directory separator) were doubled. For instance:
c:\\some\\double\\slashes\\dir
... instead of ...
c:\some\double\slashes\dir
Those double-slashes were getting in the way when comparing paths,
for instance when trying to insert a breakpoint as follow:
(gdb) b c:/some/double/slashes/dir/foo.c:4
No source file named c:/some/double/slashes/dir/foo.c:4.
(gdb) b c:\some\double\slashes\dir\foo.c:4
No source file named c:\some\double\slashes\dir\foo.c:4.
To prevent this from happening, we need this function to always
strip those extra backslashes. While canonicalize_file_name does
perform this simplification, it only works when the path is valid.
Since the simplification would be useful even if the path is not
valid (one can always set a breakpoint on a file, even if the file
does not exist locally), we rely instead on GetFullPathName to
perform the canonicalization. */
#if defined (_WIN32)
{
char buf[MAX_PATH];
DWORD len = GetFullPathName (filename, MAX_PATH, buf, NULL);
/* The file system is case-insensitive but case-preserving.
So it is important we do not lowercase the path. Otherwise,
we might not be able to display the original casing in a given
path. */
if (len > 0 && len < MAX_PATH)
return make_unique_xstrdup (buf);
}
#else
{
char *rp = canonicalize_file_name (filename);
if (rp != NULL)
return gdb::unique_xmalloc_ptr<char> (rp);
}
#endif
/* This system is a lost cause, just dup the buffer. */
return make_unique_xstrdup (filename);
}
/* See common/pathstuff.h. */
gdb::unique_xmalloc_ptr<char>
gdb_realpath_keepfile (const char *filename)
{
const char *base_name = lbasename (filename);
char *dir_name;
char *result;
/* Extract the basename of filename, and return immediately
a copy of filename if it does not contain any directory prefix. */
if (base_name == filename)
return make_unique_xstrdup (filename);
dir_name = (char *) alloca ((size_t) (base_name - filename + 2));
/* Allocate enough space to store the dir_name + plus one extra
character sometimes needed under Windows (see below), and
then the closing \000 character. */
strncpy (dir_name, filename, base_name - filename);
dir_name[base_name - filename] = '\000';
#ifdef HAVE_DOS_BASED_FILE_SYSTEM
/* We need to be careful when filename is of the form 'd:foo', which
is equivalent of d:./foo, which is totally different from d:/foo. */
if (strlen (dir_name) == 2 && isalpha (dir_name[0]) && dir_name[1] == ':')
{
dir_name[2] = '.';
dir_name[3] = '\000';
}
#endif
/* Canonicalize the directory prefix, and build the resulting
filename. If the dirname realpath already contains an ending
directory separator, avoid doubling it. */
gdb::unique_xmalloc_ptr<char> path_storage = gdb_realpath (dir_name);
const char *real_path = path_storage.get ();
if (IS_DIR_SEPARATOR (real_path[strlen (real_path) - 1]))
result = concat (real_path, base_name, (char *) NULL);
else
result = concat (real_path, SLASH_STRING, base_name, (char *) NULL);
return gdb::unique_xmalloc_ptr<char> (result);
}
/* See common/pathstuff.h. */
gdb::unique_xmalloc_ptr<char>
gdb_abspath (const char *path)
{
gdb_assert (path != NULL && path[0] != '\0');
if (path[0] == '~')
return gdb_tilde_expand_up (path);
if (IS_ABSOLUTE_PATH (path))
return make_unique_xstrdup (path);
/* Beware the // my son, the Emacs barfs, the botch that catch... */
return gdb::unique_xmalloc_ptr<char>
(concat (current_directory,
IS_DIR_SEPARATOR (current_directory[strlen (current_directory) - 1])
? "" : SLASH_STRING,
path, (char *) NULL));
}
/* See common/pathstuff.h. */
const char *
child_path (const char *parent, const char *child)
{
/* The child path must start with the parent path. */
size_t parent_len = strlen (parent);
if (filename_ncmp (parent, child, parent_len) != 0)
return NULL;
/* The parent path must be a directory and the child must contain at
least one component underneath the parent. */
const char *child_component;
if (parent_len > 0 && IS_DIR_SEPARATOR (parent[parent_len - 1]))
{
/* The parent path ends in a directory separator, so it is a
directory. The first child component starts after the common
prefix. */
child_component = child + parent_len;
}
else
{
/* The parent path does not end in a directory separator. The
first character in the child after the common prefix must be
a directory separator.
Note that CHILD must hold at least parent_len characters for
filename_ncmp to return zero. If the character at parent_len
is nul due to CHILD containing the same path as PARENT, the
IS_DIR_SEPARATOR check will fail here. */
if (!IS_DIR_SEPARATOR (child[parent_len]))
return NULL;
/* The first child component starts after the separator after the
common prefix. */
child_component = child + parent_len + 1;
}
/* The child must contain at least one non-separator character after
the parent. */
while (*child_component != '\0')
{
if (!IS_DIR_SEPARATOR (*child_component))
return child_component;
child_component++;
}
return NULL;
}
/* See common/pathstuff.h. */
bool
contains_dir_separator (const char *path)
{
for (; *path != '\0'; path++)
{
if (IS_DIR_SEPARATOR (*path))
return true;
}
return false;
}
/* See common/pathstuff.h. */
std::string
get_standard_cache_dir ()
{
#ifdef __APPLE__
#define HOME_CACHE_DIR "Library/Caches"
#else
#define HOME_CACHE_DIR ".cache"
#endif
#ifndef __APPLE__
const char *xdg_cache_home = getenv ("XDG_CACHE_HOME");
if (xdg_cache_home != NULL)
{
/* Make sure the path is absolute and tilde-expanded. */
gdb::unique_xmalloc_ptr<char> abs (gdb_abspath (xdg_cache_home));
return string_printf ("%s/gdb", abs.get ());
}
#endif
const char *home = getenv ("HOME");
if (home != NULL)
{
/* Make sure the path is absolute and tilde-expanded. */
gdb::unique_xmalloc_ptr<char> abs (gdb_abspath (home));
return string_printf ("%s/" HOME_CACHE_DIR "/gdb", abs.get ());
}
return {};
}
/* See common/pathstuff.h. */
std::string
get_standard_temp_dir ()
{
#ifdef WIN32
const char *tmp = getenv ("TMP");
if (tmp != nullptr)
return tmp;
tmp = getenv ("TEMP");
if (tmp != nullptr)
return tmp;
error (_("Couldn't find temp dir path, both TMP and TEMP are unset."));
#else
const char *tmp = getenv ("TMPDIR");
if (tmp != nullptr)
return tmp;
return "/tmp";
#endif
}
/* See common/pathstuff.h. */
const char *
get_shell ()
{
const char *ret = getenv ("SHELL");
if (ret == NULL)
ret = "/bin/sh";
return ret;
}
/* See common/pathstuff.h. */
gdb::char_vector
make_temp_filename (const std::string &f)
{
gdb::char_vector filename_temp (f.length () + 8);
strcpy (filename_temp.data (), f.c_str ());
strcat (filename_temp.data () + f.size (), "-XXXXXX");
return filename_temp;
}