* asan: null dereference in read_and_display_attr_value
@ 2023-10-10 11:46 Alan Modra
0 siblings, 0 replies; only message in thread
From: Alan Modra @ 2023-10-10 11:46 UTC (permalink / raw)
To: binutils
This fixes multiple places in read_and_display_attr_value dealing with
range and location lists that can segfault when debug_info_p is NULL.
Fuzzed object files can contain arbitrary DW_FORMs.
* dwarf.c (read_and_display_attr_value): Don't dereference NULL
debug_info_p.
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 7a350cae50b..646f280bdeb 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -2704,7 +2704,9 @@ read_and_display_attr_value (unsigned long attribute,
if (form == DW_FORM_loclistx)
{
- if (dwo)
+ if (debug_info_p == NULL )
+ idx = (uint64_t) -1;
+ else if (dwo)
{
idx = fetch_indexed_offset (uvalue, loclists_dwo,
debug_info_p->loclists_base,
@@ -2712,7 +2714,7 @@ read_and_display_attr_value (unsigned long attribute,
if (idx != (uint64_t) -1)
idx += (offset_size == 8) ? 20 : 12;
}
- else if (debug_info_p == NULL || dwarf_version > 4)
+ else if (dwarf_version > 4)
{
idx = fetch_indexed_offset (uvalue, loclists,
debug_info_p->loclists_base,
@@ -2737,21 +2739,12 @@ read_and_display_attr_value (unsigned long attribute,
}
else if (form == DW_FORM_rnglistx)
{
- if (dwo)
- {
- idx = fetch_indexed_offset (uvalue, rnglists,
- debug_info_p->rnglists_base,
- debug_info_p->offset_size);
- }
+ if (debug_info_p == NULL)
+ idx = (uint64_t) -1;
else
- {
- if (debug_info_p == NULL)
- base = 0;
- else
- base = debug_info_p->rnglists_base;
- idx = fetch_indexed_offset (uvalue, rnglists, base,
- debug_info_p->offset_size);
- }
+ idx = fetch_indexed_offset (uvalue, rnglists,
+ debug_info_p->rnglists_base,
+ debug_info_p->offset_size);
}
else
{
--
Alan Modra
Australia Development Lab, IBM
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2023-10-10 11:46 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-10-10 11:46 asan: null dereference in read_and_display_attr_value Alan Modra
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).