[PATCH] libdw: Handle bogus CU length in dwarf_nextcu.

[PATCH] libdw: Handle bogus CU length in dwarf_nextcu.

[Mark Wielaard]

The length field could be so big that it would wrap around the next_offset.
We don't really care that length is bogus, but we don't want to use it to
calculate the next offset if it is.

Found by afl-fuzz.

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libdw/ChangeLog      | 5 +++++
 libdw/dwarf_nextcu.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 4280c55..11de763 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,8 @@
+2018-06-22  Mark Wielaard  <mark@klomp.org>
+
+	* dwarf_nextcu.c (__libdw_next_unit): Set next_off to -1 when it would
+	wrap around.
+
 2018-06-18  Mark Wielaard  <mark@klomp.org>
 
 	* dwarf_aggregate_size.c (array_size): New depth argument. Use
diff --git a/libdw/dwarf_nextcu.c b/libdw/dwarf_nextcu.c
index 4b394f3..be11327 100644
--- a/libdw/dwarf_nextcu.c
+++ b/libdw/dwarf_nextcu.c
@@ -278,6 +278,11 @@ __libdw_next_unit (Dwarf *dwarf, bool v4_debug_types, Dwarf_Off off,
      or with offset == 8: 2 * 8 - 4 == 12.  */
   *next_off = off + 2 * offset_size - 4 + length;
 
+  /* This means that the length field is bogus, but return the CU anyway.
+     We just won't return anything after this.  */
+  if (*next_off <= off)
+    *next_off = (Dwarf_Off) -1;
+
   return 0;
 }
 
-- 
1.8.3.1

Re: [PATCH] libdw: Handle bogus CU length in dwarf_nextcu.

[Mark Wielaard]

On Fri, 2018-06-22 at 18:06 +0200, Mark Wielaard wrote:
> The length field could be so big that it would wrap around the next_offset.
> We don't really care that length is bogus, but we don't want to use it to
> calculate the next offset if it is.

Pushed to master.