[Bug binutils/22210] New: large loop in read_formatted_entries in dwarf2.c in binutils 2.30(HEAD)

[luanjunchao at 163 dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=22210

            Bug ID: 22210
           Summary: large loop in read_formatted_entries in dwarf2.c in
                    binutils 2.30(HEAD)
           Product: binutils
           Version: 2.30 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: luanjunchao at 163 dot com
  Target Milestone: ---

Created attachment 10484
  --> https://sourceware.org/bugzilla/attachment.cgi?id=10484&action=edit
poc of large loop

I wonder if it's normal or not. When I run "nm: -A -a -l -S -s --special-syms
--synthetic --with-symbol-versions hang.elf", it stops for a long time and call
realloc persistently.

I look into the problem and find the point, here is the snippet of function
read_formatted_entries:

  data_count = _bfd_safe_read_leb128 (abfd, buf, &bytes_read, FALSE, buf_end);
  buf += bytes_read;
  for (datai = 0; datai < data_count; datai++)
    {
      bfd_byte *format = format_header_data;
      struct fileinfo fe;

      ......

      if (!callback (table, fe.name, fe.dir, fe.time, fe.size))
        return FALSE;
    }

data_count is unsigned long, and callback is function
line_info_add_include_dir_stub, and then I debug it with gdb:

(gdb)ptype data_count
unsigned long
(gdb)p/x data_count
0xfffbfff
(gdb)p/x datai
0x01

I'm not sure if there is lack of verifcation or not, it seems abnormal.
The poc is attached here.

-- 
You are receiving this mail because:
You are on the CC list for the bug.