[PATCH] libdw: Skip zero entries in aranges

[Mark Wielaard <mark@klomp.org>]

An address/length entry of two zeros is supposed to mark the end of a
table. But in some cases a producer might leave zero entries in the
table (for example when using gcc -ffunction-sections -gc-sections).

Since we know the lenght of the table we can just skip such entries
and continue to the end.

    * libdw/dwarf_getaranges.c (dwarf_getaranges): Calculate endp.
    When seeing two zero values, check we are at endp.

https://sourceware.org/bugzilla/show_bug.cgi?id=27805

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libdw/dwarf_getaranges.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/libdw/dwarf_getaranges.c b/libdw/dwarf_getaranges.c
index de5b81ba..27439d37 100644
--- a/libdw/dwarf_getaranges.c
+++ b/libdw/dwarf_getaranges.c
@@ -1,5 +1,6 @@
 /* Return list address ranges.
    Copyright (C) 2000-2010, 2016, 2017 Red Hat, Inc.
+   Copyright (C) 2023 Mark J. Wielaard <mark@klomp.org>
    This file is part of elfutils.
    Written by Ulrich Drepper <drepper@redhat.com>, 2000.
 
@@ -124,6 +125,10 @@ dwarf_getaranges (Dwarf *dbg, Dwarf_Aranges **aranges, size_t *naranges)
 			 && length <= DWARF3_LENGTH_MAX_ESCAPE_CODE))
 	goto invalid;
 
+      const unsigned char *endp = readp + length;
+      if (unlikely (endp > readendp))
+	goto invalid;
+
       if (unlikely (readp + 2 > readendp))
 	goto invalid;
 
@@ -182,9 +187,17 @@ dwarf_getaranges (Dwarf *dbg, Dwarf_Aranges **aranges, size_t *naranges)
 	  else
 	    range_length = read_8ubyte_unaligned_inc (dbg, readp);
 
-	  /* Two zero values mark the end.  */
+	  /* Two zero values mark the end.  But in some cases (bugs)
+	     there might be such entries in the middle of the table.
+	     Ignore and continue, we'll check the actual length of
+	     the table to see if we are really at the end.  */
 	  if (range_address == 0 && range_length == 0)
-	    break;
+	    {
+	      if (readp >= endp)
+		break;
+	      else
+		continue;
+	    }
 
 	  /* We don't use alloca for these temporary structures because
 	     the total number of them can be quite large.  */
-- 
2.41.0