Commit: Fix seg-fault in dwarf.c:process_debug_info

Commit: Fix seg-fault in dwarf.c:process_debug_info

[Nick Clifton]

Hi Guys,

  I recently discovered that I could not examine the debug info in the
  libc shared library without running into a null-pointer dereference:

    $ readelf -wi /lib64/libc.so.6
    [...]
    Segmentation fault (core dumped)

  The issue is code in process_debug_info() which checks for a negative
  rnglists_base without first testing to make sure that a value exists.
  So I am applying the patch below as an obvious fix for the problem.

Cheers
  Nick

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 92a07e00e9b..ce508d0315f 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -4248,14 +4248,17 @@ process_debug_info (struct dwarf_section * section,
 			  compunit.cu_version,
 			  debug_info_p);
 
-	      /* This check was in place before, keep it.  */
-	      stemp = debug_info_p->rnglists_base;
-	      if (stemp < 0)
+	      if (debug_info_p)
 		{
-		  warn (_("CU @ %#" PRIx64 " has has a negative rnglists_base "
-			  "value of %#" PRIx64 " - treating as zero"),
-			debug_info_p->cu_offset, stemp);
-		  debug_info_p->rnglists_base = 0;
+		  /* This check was in place before, keep it.  */
+		  stemp = debug_info_p->rnglists_base;
+		  if (stemp < 0)
+		    {
+		      warn (_("CU @ %#" PRIx64 " has has a negative rnglists_base "
+			      "value of %#" PRIx64 " - treating as zero"),
+			    debug_info_p->cu_offset, stemp);
+		      debug_info_p->rnglists_base = 0;
+		    }
 		}
 	    }
 

Re: Fix null pointer dereference in process_debug_info()

[Alan Modra]

read_bases has a potential null-pointer deref too, and without a
debug_info_p there isn't any point in calling read_bases.

	* dwarf.c (process_debug_info): Don't call read_bases when
	debug_info_p is NULL.

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index ce508d0315f..3ce79f4e5d1 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -4236,7 +4236,7 @@ process_debug_info (struct dwarf_section * section,
 	     Only needed for the top DIE on DWARFv5+.
 	     No simiar treatment for loclists_base because there should
 	     be no loclist attributes in top DIE.  */
-	  if (compunit.cu_version >= 5 && level == 0)
+	  if (debug_info_p && compunit.cu_version >= 5 && level == 0)
 	    {
 	      int64_t stemp;
 
@@ -4248,17 +4248,14 @@ process_debug_info (struct dwarf_section * section,
 			  compunit.cu_version,
 			  debug_info_p);
 
-	      if (debug_info_p)
+	      /* This check was in place before, keep it.  */
+	      stemp = debug_info_p->rnglists_base;
+	      if (stemp < 0)
 		{
-		  /* This check was in place before, keep it.  */
-		  stemp = debug_info_p->rnglists_base;
-		  if (stemp < 0)
-		    {
-		      warn (_("CU @ %#" PRIx64 " has has a negative rnglists_base "
-			      "value of %#" PRIx64 " - treating as zero"),
-			    debug_info_p->cu_offset, stemp);
-		      debug_info_p->rnglists_base = 0;
-		    }
+		  warn (_("CU @ %#" PRIx64 " has has a negative rnglists_base "
+			  "value of %#" PRIx64 " - treating as zero"),
+			debug_info_p->cu_offset, stemp);
+		  debug_info_p->rnglists_base = 0;
 		}
 	    }
 

-- 
Alan Modra
Australia Development Lab, IBM