From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 101935 invoked by alias); 8 Jun 2018 14:19:05 -0000 Mailing-List: contact elfutils-devel-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Post: List-Help: List-Subscribe: Sender: elfutils-devel-owner@sourceware.org Received: (qmail 101918 invoked by uid 89); 8 Jun 2018 14:19:04 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99.4 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.9 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy= X-Spam-Status: No, score=-26.9 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: gnu.wildebeest.org Received: from wildebeest.demon.nl (HELO gnu.wildebeest.org) (212.238.236.112) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 08 Jun 2018 14:19:03 +0000 Received: from tarox.wildebeest.org (tarox.wildebeest.org [172.31.17.39]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by gnu.wildebeest.org (Postfix) with ESMTPSA id 077E7301470D; Fri, 8 Jun 2018 16:19:01 +0200 (CEST) Received: by tarox.wildebeest.org (Postfix, from userid 1000) id E2504413CB92; Fri, 8 Jun 2018 16:19:00 +0200 (CEST) From: Mark Wielaard To: elfutils-devel@sourceware.org Cc: Mark Wielaard Subject: [PATCH] libdw: Detect bad DWARF in store_implicit_value. Date: Fri, 08 Jun 2018 14:19:00 -0000 Message-Id: <1528467538-8005-1-git-send-email-mark@klomp.org> X-Mailer: git-send-email 1.8.3.1 X-Spam-Flag: NO X-IsSubscribed: yes X-SW-Source: 2018-q2/txt/msg00184.txt.bz2 The afl fuzzer running against the varlocs test detected we didn't report the value block of a DW_OP_implicit_value consistently when the DWARF was bad. Although this doesn't cause a crash it might result in consumers using dwarf_getlocation_implicit_value seeing an inconsistent block length value. To fix this detect and report bad DWARF data earlier. Signed-off-by: Mark Wielaard --- libdw/ChangeLog | 7 +++++++ libdw/dwarf_getlocation.c | 25 +++++++++++++++++++------ 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/libdw/ChangeLog b/libdw/ChangeLog index ddd8296..23e11b9 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,5 +1,12 @@ 2018-06-08 Mark Wielaard + * dwarf_getlocation.c (store_implicit_value): Return error when + seeing bad DWARF or when tsearch runs out of memory. + (__libdw_intern_expression): Report error when store_implicit_value + reported an error. + +2018-06-08 Mark Wielaard + * dwarf_getsrclines.c (read_srclines): Sanity check ndirs and nfiles. 2018-06-08 Mark Wielaard diff --git a/libdw/dwarf_getlocation.c b/libdw/dwarf_getlocation.c index d293e75..7f294fe 100644 --- a/libdw/dwarf_getlocation.c +++ b/libdw/dwarf_getlocation.c @@ -120,19 +120,23 @@ loc_compare (const void *p1, const void *p2) } /* For each DW_OP_implicit_value, we store a special entry in the cache. - This points us directly to the block data for later fetching. */ -static void + This points us directly to the block data for later fetching. + Returns zero on success, -1 on bad DWARF or 1 if tsearch failed. */ +static int store_implicit_value (Dwarf *dbg, void **cache, Dwarf_Op *op) { struct loc_block_s *block = libdw_alloc (dbg, struct loc_block_s, sizeof (struct loc_block_s), 1); const unsigned char *data = (const unsigned char *) (uintptr_t) op->number2; - // Ignored, equal to op->number. And data length already checked. - (void) __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word)); + uint64_t len = __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word)); + if (unlikely (len != op->number)) + return -1; block->addr = op; block->data = (unsigned char *) data; block->length = op->number; - (void) tsearch (block, cache, loc_compare); + if (unlikely (tsearch (block, cache, loc_compare) == NULL)) + return 1; + return 0; } int @@ -589,7 +593,16 @@ __libdw_intern_expression (Dwarf *dbg, bool other_byte_order, result[n].offset = loclist->offset; if (result[n].atom == DW_OP_implicit_value) - store_implicit_value (dbg, cache, &result[n]); + { + int store = store_implicit_value (dbg, cache, &result[n]); + if (unlikely (store != 0)) + { + if (store < 0) + goto invalid; + else + goto nomem; + } + } struct loclist *loc = loclist; loclist = loclist->next; -- 1.8.3.1