[rpms/gdb] rawhide: fix rhbz2498034 - fix use-after-free in gdb_read_core_file_mappings

[rpms/gdb] rawhide: fix rhbz2498034 - fix use-after-free in gdb_read_core_file_mappings

[Andrew Burgess]

            A new commit has been pushed.

            Repo   : rpms/gdb
            Branch : rawhide
            Commit : 2e5ce167bca2bb0c2d37b98d6e6885dc66b2801d
            Author : Andrew Burgess <aburgess@redhat.com>
            Date   : 2026-07-09T10:05:30+01:00
            Stats  : +87/-1 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/gdb/c/2e5ce167bca2bb0c2d37b98d6e6885dc66b2801d?branch=rawhide

            Log:
            fix rhbz2498034 - fix use-after-free in gdb_read_core_file_mappings

Backport the following upstream commit in order to address RHBZ
2498034: 93f536d813c41527e8c939a5f8a90a4b37a5abab.  This commit will
drop out when we rebase to GDB 18.

---
diff --git a/_gdb.spec.Patch.include b/_gdb.spec.Patch.include
index f3ee607..5b5ff62 100644
--- a/_gdb.spec.Patch.include
+++ b/_gdb.spec.Patch.include
@@ -98,3 +98,7 @@ Patch016: gdb-backport-dap-core-file-support.patch
 # This commit will not be needed once we rebase to GDB 18.
 Patch017: gdb-backport-libiberty-sync.patch
 
+# Backport of upstream commit 93f536d813c41527e8c939a5f8a90a4 to fix
+# RHBZ2498034.
+Patch018: gdb-backport-corefile-use-after-free-fix.patch
+

diff --git a/_patch_order b/_patch_order
index 5b73423..caf767c 100644
--- a/_patch_order
+++ b/_patch_order
@@ -15,3 +15,4 @@ gdb-rhbz2467251-computed-location-synthetic-pointers.patch
 gdb-tcl9-utf8-encoding-fix.patch
 gdb-backport-dap-core-file-support.patch
 gdb-backport-libiberty-sync.patch
+gdb-backport-corefile-use-after-free-fix.patch

diff --git a/gdb-backport-corefile-use-after-free-fix.patch b/gdb-backport-corefile-use-after-free-fix.patch
new file mode 100644
index 0000000..64aa23e
--- /dev/null
+++ b/gdb-backport-corefile-use-after-free-fix.patch
@@ -0,0 +1,77 @@
+From FEDORA_PATCHES Mon Sep 17 00:00:00 2001
+From: Lancelot SIX <lancelot.six@amd.com>
+Date: Mon, 13 Oct 2025 15:11:09 +0100
+Subject: gdb-backport-corefile-use-after-free-fix.patch
+
+;; Backport of upstream commit 93f536d813c41527e8c939a5f8a90a4 to fix
+;; RHBZ2498034.
+
+gdb/corelow: Fix use-after-free in gdb_read_core_file_mappings
+
+A recent refactor (fc8e5a565b3 -- gdb: make structured core file
+mappings processing global) in gdb/corelow.c:gdb_read_core_file_mappings
+introduced a use-after-free bug detected by address sanitizer.
+
+In this change, a cache is built which holds addresses to elements of a
+std::vector.  However, as elements as inserted in the vector, the
+addresses in the cache should be invalidated, but are not, leading to
+the use-after-free issue.
+
+This patch proposes to store the index in the vector in the cache
+instead of the address of the element, solving the invalidation issue.
+An alternative approach could be to use a std::list which does not need
+invalidation of addresses/references/iterators as the container is
+grown.
+
+Change-Id: Ib57d87c5d0405ffa3b7d38557fb33f7283c5d063
+Approved-By: Andrew Burgess <aburgess@redhat.com>
+
+diff --git a/gdb/corelow.c b/gdb/corelow.c
+--- a/gdb/corelow.c
++++ b/gdb/corelow.c
+@@ -2090,19 +2090,20 @@ gdb_read_core_file_mappings (struct gdbarch *gdbarch, struct bfd *cbfd)
+   /* A map entry used while building RESULTS.  */
+   struct map_entry
+   {
+-    explicit map_entry (core_mapped_file *ptr)
+-      : file_data (ptr)
++    explicit map_entry (size_t idx)
++      : file_data_index (idx),
++	ignore_build_id_p (false)
+     { /* Nothing.  */ }
+ 
+     /* Points to an entry in RESULTS, this allows entries to be quickly
+        looked up and updated as new mappings are read.  */
+-    core_mapped_file *file_data = nullptr;
++    size_t file_data_index;
+ 
+     /* If true then we have seen multiple different build-ids associated
+        with the filename of FILE_DATA.  The FILE_DATA->build_id field will
+        have been set to nullptr, and we should not set FILE_DATA->build_id
+        in future.  */
+-    bool ignore_build_id_p = false;
++    bool ignore_build_id_p;
+   };
+ 
+   /* All files mapped into the core file.  The key is the filename.  */
+@@ -2141,8 +2142,9 @@ gdb_read_core_file_mappings (struct gdbarch *gdbarch, struct bfd *cbfd)
+ 	    results.emplace_back ();
+ 
+ 	    /* The entry to be added to the lookup map.  */
+-	    map_entry entry (&results.back ());
+-	    entry.file_data->filename = filename;
++	    map_entry entry (std::distance (&results.front (),
++					    &results.back ()));
++	    results[entry.file_data_index].filename = filename;
+ 
+ 	    /* Add entry to the quick lookup map and update ITER.  */
+ 	    auto inserted_result
+@@ -2151,7 +2153,7 @@ gdb_read_core_file_mappings (struct gdbarch *gdbarch, struct bfd *cbfd)
+ 	    iter = inserted_result.first;
+ 	  }
+ 
+-	core_mapped_file &file_data = *iter->second.file_data;
++	core_mapped_file &file_data = results[iter->second.file_data_index];
+ 	bool &ignore_build_id_p = iter->second.ignore_build_id_p;
+ 
+ 	file_data.regions.emplace_back (start, end, file_ofs);

diff --git a/gdb.spec b/gdb.spec
index d57d631..e166765 100644
--- a/gdb.spec
+++ b/gdb.spec
@@ -45,7 +45,7 @@ Version: 17.2
 
 # The release always contains a leading reserved number, start it at 1.
 # `upstream' is not a part of `name' to stay fully rpm dependencies compatible for the testing.
-Release: 1%{?dist}
+Release: 2%{?dist}
 
 License: GPL-3.0-or-later AND BSD-3-Clause AND FSFAP AND LGPL-2.1-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later AND LicenseRef-Fedora-Public-Domain AND GFDL-1.3-or-later AND LGPL-2.0-or-later WITH GCC-exception-2.0 AND GPL-3.0-or-later WITH GCC-exception-3.1 AND GPL-2.0-or-later WITH GNU-compiler-exception AND MIT
 # Do not provide URL for snapshots as the file lasts there only for 2 days.
@@ -929,6 +929,10 @@ fi
 
 %changelog
 * Wed Jul 8 2026 Andrew Burgess <aburgess@redhat.com>
+- Backport upstream commit 93f536d813c41527 to fix RHBZ 2498034.  This
+  commit will drop out when we rebase to GDB 18.
+
+* Wed Jul 8 2026 Andrew Burgess <aburgess@redhat.com>
 - Backport upstream commit be3a9405ceb4d6d6 to fix and issue with the
   D demangler (RHBZ 2368350).  This commit will drop out when we
   rebase to GDB 18.