public inbox for elfutils@sourceware.org
 help / color / mirror / Atom feed
From: Mark Wielaard <mark@klomp.org>
To: elfutils-devel@sourceware.org
Cc: Mark Wielaard <mark@klomp.org>
Subject: [PATCH] libdw: Detect bad DWARF in store_implicit_value.
Date: Fri, 08 Jun 2018 14:19:00 -0000	[thread overview]
Message-ID: <1528467538-8005-1-git-send-email-mark@klomp.org> (raw)

The afl fuzzer running against the varlocs test detected we didn't report
the value block of a DW_OP_implicit_value consistently when the DWARF was
bad. Although this doesn't cause a crash it might result in consumers
using dwarf_getlocation_implicit_value seeing an inconsistent block length
value. To fix this detect and report bad DWARF data earlier.

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libdw/ChangeLog           |  7 +++++++
 libdw/dwarf_getlocation.c | 25 +++++++++++++++++++------
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index ddd8296..23e11b9 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,5 +1,12 @@
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
+	* dwarf_getlocation.c (store_implicit_value): Return error when
+	seeing bad DWARF or when tsearch runs out of memory.
+	(__libdw_intern_expression): Report error when store_implicit_value
+	reported an error.
+
+2018-06-08  Mark Wielaard  <mark@klomp.org>
+
 	* dwarf_getsrclines.c (read_srclines): Sanity check ndirs and nfiles.
 
 2018-06-08  Mark Wielaard  <mark@klomp.org>
diff --git a/libdw/dwarf_getlocation.c b/libdw/dwarf_getlocation.c
index d293e75..7f294fe 100644
--- a/libdw/dwarf_getlocation.c
+++ b/libdw/dwarf_getlocation.c
@@ -120,19 +120,23 @@ loc_compare (const void *p1, const void *p2)
 }
 
 /* For each DW_OP_implicit_value, we store a special entry in the cache.
-   This points us directly to the block data for later fetching.  */
-static void
+   This points us directly to the block data for later fetching.
+   Returns zero on success, -1 on bad DWARF or 1 if tsearch failed.  */
+static int
 store_implicit_value (Dwarf *dbg, void **cache, Dwarf_Op *op)
 {
   struct loc_block_s *block = libdw_alloc (dbg, struct loc_block_s,
 					   sizeof (struct loc_block_s), 1);
   const unsigned char *data = (const unsigned char *) (uintptr_t) op->number2;
-  // Ignored, equal to op->number.  And data length already checked.
-  (void) __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word));
+  uint64_t len = __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word));
+  if (unlikely (len != op->number))
+    return -1;
   block->addr = op;
   block->data = (unsigned char *) data;
   block->length = op->number;
-  (void) tsearch (block, cache, loc_compare);
+  if (unlikely (tsearch (block, cache, loc_compare) == NULL))
+    return 1;
+  return 0;
 }
 
 int
@@ -589,7 +593,16 @@ __libdw_intern_expression (Dwarf *dbg, bool other_byte_order,
       result[n].offset = loclist->offset;
 
       if (result[n].atom == DW_OP_implicit_value)
-	store_implicit_value (dbg, cache, &result[n]);
+	{
+	  int store = store_implicit_value (dbg, cache, &result[n]);
+	  if (unlikely (store != 0))
+	    {
+	      if (store < 0)
+	        goto invalid;
+	      else
+		goto nomem;
+	    }
+	}
 
       struct loclist *loc = loclist;
       loclist = loclist->next;
-- 
1.8.3.1

             reply	other threads:[~2018-06-08 14:19 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-08 14:19 Mark Wielaard [this message]
2018-06-10 15:23 ` Mark Wielaard

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1528467538-8005-1-git-send-email-mark@klomp.org \
    --to=mark@klomp.org \
    --cc=elfutils-devel@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).