Go to file
Yao Qi c3c874459b Fix one heap buffer overflow in aarch64_push_dummy_call
Hi,
AddressSanitizer reports an error like this,

(gdb) PASS: gdb.base/call-ar-st.exp: continue to tbreak9
print print_long_arg_list(a, b, c, d, e, f, *struct1, *struct2, *struct3, *struct4, *flags, *flags_combo, *three_char, *five_char, *int_char_combo, *d1, *d2, *d3, *f1, *f2, *f3)
=================================================================
==6236==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200008eb50 at pc 0x89e432 bp 0x7fffa3df9080 sp 0x7fffa3df9078
READ of size 5 at 0x60200008eb50 thread T0
    #0 0x89e431 in memory_xfer_partial gdb/target.c:1264
    #1 0x89e6c7 in target_xfer_partial gdb/target.c:1320
    #2 0x89f267 in target_write_partial gdb/target.c:1595^M
    #3 0x8a014b in target_write_with_progress gdb/target.c:1889^M
    #4 0x8a0262 in target_write gdb/target.c:1914^M
    #5 0x89ee59 in target_write_memory gdb/target.c:1492^M
    #6 0x9a1c74 in write_memory gdb/corefile.c:393^M
    #7 0x467ea5 in aarch64_push_dummy_call gdb/aarch64-tdep.c:1388

The problem is that an instance of stack_item_t is created to adjust
stack for alignment, the item.len is correct, but item.data is buf,
which is wrong, because item.len can be greater than the length of
buf.  This patch sets item.data to NULL, and only update sp (no
inferior memory writes on stack for this item).

gdb:

2015-12-17  Yao Qi  <yao.qi@linaro.org>

	* aarch64-tdep.c (struct stack_item_t): Update comments.
	(pass_on_stack): Set item.data to NULL.
	(aarch64_push_dummy_call): Call write_memory if si->data
	isn't NULL.
2015-12-17 13:07:54 +00:00
bfd Add forgotten ChangeLog updates for 72d98d16ed: 2015-12-17 11:14:37 +01:00
binutils Add support for RX V2 Instruction Set 2015-12-15 09:26:56 +00:00
config libsanitizer merge from upstream r250806, compiler part. 2015-11-28 16:39:32 +00:00
cpu Remove leading/trailing white spaces in ChangeLog 2015-07-24 04:16:47 -07:00
elfcpp [GOLD] R_PPC64_ENTRY support 2015-12-07 13:17:00 +10:30
etc
gas [Patch ARM] Fix build attributes for armv8-a in case of assembler files that contain no directives. 2015-12-17 11:34:39 +00:00
gdb Fix one heap buffer overflow in aarch64_push_dummy_call 2015-12-17 13:07:54 +00:00
gold PR gold/17473: Fix gold build with system C++ headers that use <ctype.h>. 2015-12-16 16:35:27 -08:00
gprof Bump version to 2.26.51 2015-11-14 16:24:39 -08:00
include [Patch ARM] Fix build attributes for armv8-a in case of assembler files that contain no directives. 2015-12-17 11:34:39 +00:00
intl Regen intl/configure 2015-08-31 12:53:36 +09:30
ld Add forgotten ChangeLog updates for 72d98d16ed: 2015-12-17 11:14:37 +01:00
libdecnumber Remove leading/trailing white spaces in ChangeLog 2015-07-24 04:16:47 -07:00
libiberty PR other/61321 - demangler crash on casts in template parameters 2015-11-28 16:39:31 +00:00
opcodes Add support for RX V2 Instruction Set 2015-12-15 09:26:56 +00:00
readline Revert "Sync readline/ to version 7.0 alpha" 2015-07-25 15:57:00 -04:00
sim Fix invalid left shift of negative value 2015-12-15 14:09:14 +01:00
texinfo
zlib Import zlib 1.2.8 with local change merged in. 2015-11-25 15:14:47 -08:00
.cvsignore
.gitattributes
.gitignore
ChangeLog binutils: add support for arm-*-darwin and aarch64-*-darwin. 2015-11-20 14:53:06 +01:00
compile
config-ml.in Sync toplevel files with GCC 2015-07-27 07:49:05 -07:00
config.guess Sync config.sub and config.guess with GCC 2015-08-07 07:51:39 -07:00
config.rpath
config.sub Sync config.sub and config.guess with GCC 2015-08-07 07:51:39 -07:00
configure binutils: add support for arm-*-darwin and aarch64-*-darwin. 2015-11-20 14:53:06 +01:00
configure.ac binutils: add support for arm-*-darwin and aarch64-*-darwin. 2015-11-20 14:53:06 +01:00
COPYING
COPYING3
COPYING3.LIB
COPYING.LIB
COPYING.LIBGLOSS
COPYING.NEWLIB
depcomp
djunpack.bat
install-sh
libtool.m4
lt~obsolete.m4
ltgcc.m4
ltmain.sh
ltoptions.m4
ltsugar.m4
ltversion.m4
MAINTAINERS
Makefile.def Resync files in the binutils repository that are maintained in the gcc repository. 2015-09-30 17:55:16 +01:00
Makefile.in Resync files in the binutils repository that are maintained in the gcc repository. 2015-09-30 17:55:16 +01:00
Makefile.tpl Sync Makefile.tpl with GCC 2015-07-14 09:52:36 -07:00
makefile.vms
missing
mkdep
mkinstalldirs
move-if-change
README
README-maintainer-mode
setup.com
src-release.sh
symlink-tree
ylwrap

		   README for GNU development tools

This directory contains various GNU compilers, assemblers, linkers, 
debuggers, etc., plus their support routines, definitions, and documentation.

If you are receiving this as part of a GDB release, see the file gdb/README.
If with a binutils release, see binutils/README;  if with a libg++ release,
see libg++/README, etc.  That'll give you info about this
package -- supported targets, how to use it, how to report bugs, etc.

It is now possible to automatically configure and build a variety of
tools with one command.  To build all of the tools contained herein,
run the ``configure'' script here, e.g.:

	./configure 
	make

To install them (by default in /usr/local/bin, /usr/local/lib, etc),
then do:
	make install

(If the configure script can't determine your type of computer, give it
the name as an argument, for instance ``./configure sun4''.  You can
use the script ``config.sub'' to test whether a name is recognized; if
it is, config.sub translates it to a triplet specifying CPU, vendor,
and OS.)

If you have more than one compiler on your system, it is often best to
explicitly set CC in the environment before running configure, and to
also set CC when running make.  For example (assuming sh/bash/ksh):

	CC=gcc ./configure
	make

A similar example using csh:

	setenv CC gcc
	./configure
	make

Much of the code and documentation enclosed is copyright by
the Free Software Foundation, Inc.  See the file COPYING or
COPYING.LIB in the various directories, for a description of the
GNU General Public License terms under which you can copy the files.

REPORTING BUGS: Again, see gdb/README, binutils/README, etc., for info
on where and how to report problems.