[PATCH] libdw: Break long or circular DIE ref chains in dwarf_[has]attr_integrate.

[PATCH] libdw: Break long or circular DIE ref chains in dwarf_[has]attr_integrate.

[Mark Wielaard]

Bad DWARF could create a very long or circular DIE ref chain by linking
DW_AT_abstract_origin or DW_AT_specification to the DIE itself. Break
the chain after seeing a large number (16) of DIEs.

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libdw/ChangeLog                 | 6 ++++++
 libdw/dwarf_attr_integrate.c    | 4 ++--
 libdw/dwarf_hasattr_integrate.c | 4 ++--
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 1195cf6e..07a1346b 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,9 @@
+2018-06-10  Mark Wielaard  <mark@klomp.org>
+
+	* dwarf_attr_integrate.c (dwarf_attr_integrate): Stop after 16 DIE
+	ref chains.
+	* dwarf_hasattr_integrate.c (dwarf_hasattr_integrate): Likewise.
+
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
 	* dwarf_getabbrev.c (dwarf_getabbrev): Check die and offset.
diff --git a/libdw/dwarf_attr_integrate.c b/libdw/dwarf_attr_integrate.c
index 748d988d..fc068638 100644
--- a/libdw/dwarf_attr_integrate.c
+++ b/libdw/dwarf_attr_integrate.c
@@ -38,7 +38,7 @@ dwarf_attr_integrate (Dwarf_Die *die, unsigned int search_name,
 		      Dwarf_Attribute *result)
 {
   Dwarf_Die die_mem;
-
+  int chain = 16; /* Largest DIE ref chain we will follow.  */
   do
     {
       Dwarf_Attribute *attr = INTUSE(dwarf_attr) (die, search_name, result);
@@ -53,7 +53,7 @@ dwarf_attr_integrate (Dwarf_Die *die, unsigned int search_name,
 
       die = INTUSE(dwarf_formref_die) (attr, &die_mem);
     }
-  while (die != NULL);
+  while (die != NULL && chain-- != 0);
 
   /* Not NULL if it didn't have abstract_origin and specification
      attributes.  If it is a split CU then see if the skeleton
diff --git a/libdw/dwarf_hasattr_integrate.c b/libdw/dwarf_hasattr_integrate.c
index 4d4b4c54..1d946280 100644
--- a/libdw/dwarf_hasattr_integrate.c
+++ b/libdw/dwarf_hasattr_integrate.c
@@ -37,7 +37,7 @@ int
 dwarf_hasattr_integrate (Dwarf_Die *die, unsigned int search_name)
 {
   Dwarf_Die die_mem;
-
+  int chain = 16; /* Largest DIE ref chain we will follow.  */
   do
     {
       if (INTUSE(dwarf_hasattr) (die, search_name))
@@ -53,7 +53,7 @@ dwarf_hasattr_integrate (Dwarf_Die *die, unsigned int search_name)
 
       die = INTUSE(dwarf_formref_die) (attr, &die_mem);
     }
-  while (die != NULL);
+  while (die != NULL && chain-- != 0);
 
   /* Not NULL if it didn't have abstract_origin and specification
      attributes.  If it is a split CU then see if the skeleton
-- 
2.17.0

Re: [PATCH] libdw: Break long or circular DIE ref chains in dwarf_[has]attr_integrate.

[Mark Wielaard]

On Sun, 2018-06-10 at 17:01 +0200, Mark Wielaard wrote:
> Bad DWARF could create a very long or circular DIE ref chain by linking
> DW_AT_abstract_origin or DW_AT_specification to the DIE itself. Break
> the chain after seeing a large number (16) of DIEs.

Pushed to master.