public inbox for elfutils@sourceware.org
 help / color / mirror / Atom feed
* [PATCH] libdw: Check validity of dwarf_getabbrev arguments.
@ 2018-06-08 18:48 Mark Wielaard
  2018-06-11  6:38 ` Mark Wielaard
  0 siblings, 1 reply; 2+ messages in thread
From: Mark Wielaard @ 2018-06-08 18:48 UTC (permalink / raw)
  To: elfutils-devel; +Cc: Mark Wielaard

When the given Dwarf_Die was invalid we might crash and when the offset
was totally bogus we might succeed with a random abbrev.

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libdw/ChangeLog           |  4 ++++
 libdw/dwarf_getabbrev.c   | 20 +++++++++++++++++---
 tests/ChangeLog           |  5 +++++
 tests/get-units-invalid.c |  6 ++++++
 tests/show-abbrev.c       |  8 ++++++++
 5 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 21cb03c..1195cf6 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,5 +1,9 @@
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
+	* dwarf_getabbrev.c (dwarf_getabbrev): Check die and offset.
+
+2018-06-08  Mark Wielaard  <mark@klomp.org>
+
 	* dwarf_get_units.c (dwarf_get_units): Handle existing error, no
 	dwarf.
 
diff --git a/libdw/dwarf_getabbrev.c b/libdw/dwarf_getabbrev.c
index 1e113db..988d12c 100644
--- a/libdw/dwarf_getabbrev.c
+++ b/libdw/dwarf_getabbrev.c
@@ -158,7 +158,21 @@ __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, Dwarf_Off offset,
 Dwarf_Abbrev *
 dwarf_getabbrev (Dwarf_Die *die, Dwarf_Off offset, size_t *lengthp)
 {
-  return __libdw_getabbrev (die->cu->dbg, die->cu,
-			    die->cu->orig_abbrev_offset + offset, lengthp,
-			    NULL);
+  if (die == NULL || die->cu == NULL)
+    return NULL;
+
+  Dwarf_CU *cu = die->cu;
+  Dwarf *dbg = cu->dbg;
+  Dwarf_Off abbrev_offset = cu->orig_abbrev_offset;
+  Elf_Data *data = dbg->sectiondata[IDX_debug_abbrev];
+  if (data == NULL)
+    return NULL;
+
+  if (offset >= data->d_size - abbrev_offset)
+    {
+      __libdw_seterrno (DWARF_E_INVALID_OFFSET);
+      return NULL;
+    }
+
+  return __libdw_getabbrev (dbg, cu, abbrev_offset + offset, lengthp, NULL);
 }
diff --git a/tests/ChangeLog b/tests/ChangeLog
index 25ed41e..3b69a87 100644
--- a/tests/ChangeLog
+++ b/tests/ChangeLog
@@ -1,5 +1,10 @@
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
+	* get-units-invalid.c (main): Check invalid dwarf_getabbrev call.
+	* show-abbrev.c (main): Check illegal dwarf_getabbrev offset call.
+
+2018-06-08  Mark Wielaard  <mark@klomp.org>
+
 	* varlocs.c (main): Only assert when cfi_debug_bias != 0 if there
 	actually is a cfi_debug.
 
diff --git a/tests/get-units-invalid.c b/tests/get-units-invalid.c
index ba0f818..155e12d 100644
--- a/tests/get-units-invalid.c
+++ b/tests/get-units-invalid.c
@@ -98,6 +98,12 @@ main (int argc, char *argv[])
 			  dwarf_diename (&subdie));
 		  return -1;
 		}
+	      if (dwarf_getabbrev (&subdie, 0, NULL) != NULL)
+		{
+		  printf ("Should NOT have an abbrev: %s\n",
+			  dwarf_diename (&subdie));
+		  return -1;
+		}
 	    }
 	  else if (unit_type == DW_UT_type)
 	    printf ("subdie: %s\n", dwarf_diename (&subdie));
diff --git a/tests/show-abbrev.c b/tests/show-abbrev.c
index b0af029..002ae25 100644
--- a/tests/show-abbrev.c
+++ b/tests/show-abbrev.c
@@ -51,6 +51,14 @@ main (int argc, char *argv[])
 	    /* Something went wrong.  */
 	    break;
 
+	  /* Test something obviously wrong.  */
+	  Dwarf_Abbrev *a = dwarf_getabbrev (&die, (Dwarf_Off) -1, NULL);
+	  if (a != NULL)
+	    {
+	      printf ("dwarf_getabbrev -1 succeeded?\n");
+	      break;
+	    }
+
 	  Dwarf_Off offset = 0;
 
 	  while (1)
-- 
1.8.3.1

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] libdw: Check validity of dwarf_getabbrev arguments.
  2018-06-08 18:48 [PATCH] libdw: Check validity of dwarf_getabbrev arguments Mark Wielaard
@ 2018-06-11  6:38 ` Mark Wielaard
  0 siblings, 0 replies; 2+ messages in thread
From: Mark Wielaard @ 2018-06-11  6:38 UTC (permalink / raw)
  To: elfutils-devel

On Fri, 2018-06-08 at 20:47 +0200, Mark Wielaard wrote:
> When the given Dwarf_Die was invalid we might crash and when the offset
> was totally bogus we might succeed with a random abbrev.

Pushed to master.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2018-06-11  6:38 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-08 18:48 [PATCH] libdw: Check validity of dwarf_getabbrev arguments Mark Wielaard
2018-06-11  6:38 ` Mark Wielaard

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).