From: Mark Wielaard <mark@klomp.org>
To: elfutils-devel@sourceware.org
Cc: Mark Wielaard <mark@klomp.org>
Subject: [PATCH] libdw: Return an error in dwarf_getlocation_attr for missing .debug_addr.
Date: Fri, 08 Jun 2018 09:55:00 -0000 [thread overview]
Message-ID: <1528451701-12732-1-git-send-email-mark@klomp.org> (raw)
When constructing a "fake" Dwarf_Attribute for DW_OP_GNU_const_index,
DW_OP_constx, DW_OP_GNU_addr_index or DW_OP_addrx, we would create a
fake attribute pointing to the actual data in the .debug_addr section.
We would even do that if there was no .debug_addr section assuming
dwarf_formaddr or dwarf_formudata would generate an error. But when
there is no .debug_addr there is also no fake_addr_cu, so the
dwarf_form* functions cannot check the value is correct (and crash).
Fix by returning an error early from dwarf_getlocation_attr indicating
bad DWARF data.
Found by the afl fuzzer running on the varlocs testcase.
Signed-off-by: Mark Wielaard <mark@klomp.org>
---
libdw/ChangeLog | 6 ++++++
libdw/dwarf_getlocation_attr.c | 14 ++++++++++----
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 9d0b484..79fcf1e 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,9 @@
+2018-06-08 Mark Wielaard <mark@klomp.org>
+
+ * dwarf_getlocation_attr.c (addr_valp): Set error and return NULL
+ when there is no .debug_addr section.
+ (dwarf_getlocation_attr): If addr_valp returns NULL, then return -1.
+
2018-06-07 Mark Wielaard <mark@klomp.org>
* libdw_findcu.c (__libdw_intern_next_unit): Report DWARF_E_VERSION,
diff --git a/libdw/dwarf_getlocation_attr.c b/libdw/dwarf_getlocation_attr.c
index 875fc5d..99bcc82 100644
--- a/libdw/dwarf_getlocation_attr.c
+++ b/libdw/dwarf_getlocation_attr.c
@@ -1,5 +1,5 @@
/* Return DWARF attribute associated with a location expression op.
- Copyright (C) 2013, 2014, 2017 Red Hat, Inc.
+ Copyright (C) 2013, 2014, 2017, 2018 Red Hat, Inc.
This file is part of elfutils.
This file is free software; you can redistribute it and/or modify
@@ -58,11 +58,13 @@ static unsigned char *
addr_valp (Dwarf_CU *cu, Dwarf_Word index)
{
Elf_Data *debug_addr = cu->dbg->sectiondata[IDX_debug_addr];
- Dwarf_Word offset = __libdw_cu_addr_base (cu) + (index * cu->address_size);
if (debug_addr == NULL)
- /* This is really an error, will trigger with dwarf_formaddr. */
- return (unsigned char *) (uintptr_t) offset;
+ {
+ __libdw_seterrno (DWARF_E_NO_DEBUG_ADDR);
+ return NULL;
+ }
+ Dwarf_Word offset = __libdw_cu_addr_base (cu) + (index * cu->address_size);
return (unsigned char *) debug_addr->d_buf + offset;
}
@@ -105,6 +107,8 @@ dwarf_getlocation_attr (Dwarf_Attribute *attr, const Dwarf_Op *op, Dwarf_Attribu
else
result->form = DW_FORM_data8;
result->valp = addr_valp (attr->cu, op->number);
+ if (result->valp == NULL)
+ return -1;
result->cu = attr->cu->dbg->fake_addr_cu;
break;
@@ -113,6 +117,8 @@ dwarf_getlocation_attr (Dwarf_Attribute *attr, const Dwarf_Op *op, Dwarf_Attribu
result->code = DW_AT_low_pc;
result->form = DW_FORM_addr;
result->valp = addr_valp (attr->cu, op->number);
+ if (result->valp == NULL)
+ return -1;
result->cu = attr->cu->dbg->fake_addr_cu;
break;
--
1.8.3.1
next reply other threads:[~2018-06-08 9:55 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-08 9:55 Mark Wielaard [this message]
2018-06-10 9:05 ` Mark Wielaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1528451701-12732-1-git-send-email-mark@klomp.org \
--to=mark@klomp.org \
--cc=elfutils-devel@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).