From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 93183 invoked by alias); 8 Jun 2018 18:48:06 -0000 Mailing-List: contact elfutils-devel-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Post: List-Help: List-Subscribe: Sender: elfutils-devel-owner@sourceware.org Received: (qmail 93143 invoked by uid 89); 8 Jun 2018 18:48:04 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99.4 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.9 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy= X-Spam-Status: No, score=-26.9 required=5.0 tests=BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: gnu.wildebeest.org Received: from wildebeest.demon.nl (HELO gnu.wildebeest.org) (212.238.236.112) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 08 Jun 2018 18:48:02 +0000 Received: from tarox.wildebeest.org (tarox.wildebeest.org [172.31.17.39]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by gnu.wildebeest.org (Postfix) with ESMTPSA id 3EC17300092E; Fri, 8 Jun 2018 20:48:00 +0200 (CEST) Received: by tarox.wildebeest.org (Postfix, from userid 1000) id 2E656413CB92; Fri, 8 Jun 2018 20:48:00 +0200 (CEST) From: Mark Wielaard To: elfutils-devel@sourceware.org Cc: Mark Wielaard Subject: [PATCH] libdw: Check validity of dwarf_getabbrev arguments. Date: Fri, 08 Jun 2018 18:48:00 -0000 Message-Id: <1528483678-24193-1-git-send-email-mark@klomp.org> X-Mailer: git-send-email 1.8.3.1 X-Spam-Flag: NO X-IsSubscribed: yes X-SW-Source: 2018-q2/txt/msg00188.txt.bz2 When the given Dwarf_Die was invalid we might crash and when the offset was totally bogus we might succeed with a random abbrev. Signed-off-by: Mark Wielaard --- libdw/ChangeLog | 4 ++++ libdw/dwarf_getabbrev.c | 20 +++++++++++++++++--- tests/ChangeLog | 5 +++++ tests/get-units-invalid.c | 6 ++++++ tests/show-abbrev.c | 8 ++++++++ 5 files changed, 40 insertions(+), 3 deletions(-) diff --git a/libdw/ChangeLog b/libdw/ChangeLog index 21cb03c..1195cf6 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,5 +1,9 @@ 2018-06-08 Mark Wielaard + * dwarf_getabbrev.c (dwarf_getabbrev): Check die and offset. + +2018-06-08 Mark Wielaard + * dwarf_get_units.c (dwarf_get_units): Handle existing error, no dwarf. diff --git a/libdw/dwarf_getabbrev.c b/libdw/dwarf_getabbrev.c index 1e113db..988d12c 100644 --- a/libdw/dwarf_getabbrev.c +++ b/libdw/dwarf_getabbrev.c @@ -158,7 +158,21 @@ __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, Dwarf_Off offset, Dwarf_Abbrev * dwarf_getabbrev (Dwarf_Die *die, Dwarf_Off offset, size_t *lengthp) { - return __libdw_getabbrev (die->cu->dbg, die->cu, - die->cu->orig_abbrev_offset + offset, lengthp, - NULL); + if (die == NULL || die->cu == NULL) + return NULL; + + Dwarf_CU *cu = die->cu; + Dwarf *dbg = cu->dbg; + Dwarf_Off abbrev_offset = cu->orig_abbrev_offset; + Elf_Data *data = dbg->sectiondata[IDX_debug_abbrev]; + if (data == NULL) + return NULL; + + if (offset >= data->d_size - abbrev_offset) + { + __libdw_seterrno (DWARF_E_INVALID_OFFSET); + return NULL; + } + + return __libdw_getabbrev (dbg, cu, abbrev_offset + offset, lengthp, NULL); } diff --git a/tests/ChangeLog b/tests/ChangeLog index 25ed41e..3b69a87 100644 --- a/tests/ChangeLog +++ b/tests/ChangeLog @@ -1,5 +1,10 @@ 2018-06-08 Mark Wielaard + * get-units-invalid.c (main): Check invalid dwarf_getabbrev call. + * show-abbrev.c (main): Check illegal dwarf_getabbrev offset call. + +2018-06-08 Mark Wielaard + * varlocs.c (main): Only assert when cfi_debug_bias != 0 if there actually is a cfi_debug. diff --git a/tests/get-units-invalid.c b/tests/get-units-invalid.c index ba0f818..155e12d 100644 --- a/tests/get-units-invalid.c +++ b/tests/get-units-invalid.c @@ -98,6 +98,12 @@ main (int argc, char *argv[]) dwarf_diename (&subdie)); return -1; } + if (dwarf_getabbrev (&subdie, 0, NULL) != NULL) + { + printf ("Should NOT have an abbrev: %s\n", + dwarf_diename (&subdie)); + return -1; + } } else if (unit_type == DW_UT_type) printf ("subdie: %s\n", dwarf_diename (&subdie)); diff --git a/tests/show-abbrev.c b/tests/show-abbrev.c index b0af029..002ae25 100644 --- a/tests/show-abbrev.c +++ b/tests/show-abbrev.c @@ -51,6 +51,14 @@ main (int argc, char *argv[]) /* Something went wrong. */ break; + /* Test something obviously wrong. */ + Dwarf_Abbrev *a = dwarf_getabbrev (&die, (Dwarf_Off) -1, NULL); + if (a != NULL) + { + printf ("dwarf_getabbrev -1 succeeded?\n"); + break; + } + Dwarf_Off offset = 0; while (1) -- 1.8.3.1