* [PATCH] libdw: check offset dwarf_formstring in all cases
@ 2023-11-16 21:29 vvvvvv
2023-11-17 15:31 ` Mark Wielaard
0 siblings, 1 reply; 2+ messages in thread
From: vvvvvv @ 2023-11-16 21:29 UTC (permalink / raw)
To: elfutils-devel; +Cc: kernel-team, maennich, vvvvvv
From: Aleksei Vetrov <vvvvvv@google.com>
This check was initially added to test if offset overflows the safe
prefix where any string will be null-terminated. However the check
was placed in a wrong place and didn't cover all `attrp->form` cases.
* libdw/dwarf_formstring.c (dwarf_formstring): Move offset check
right before returning the result.
Signed-off-by: Aleksei Vetrov <vvvvvv@google.com>
---
libdw/dwarf_formstring.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libdw/dwarf_formstring.c b/libdw/dwarf_formstring.c
index 0ee42411..65f03a5e 100644
--- a/libdw/dwarf_formstring.c
+++ b/libdw/dwarf_formstring.c
@@ -173,11 +173,11 @@ dwarf_formstring (Dwarf_Attribute *attrp)
off = read_4ubyte_unaligned (dbg, datap);
else
off = read_8ubyte_unaligned (dbg, datap);
-
- if (off >= data_size)
- goto invalid_offset;
}
+ if (off >= data_size)
+ goto invalid_offset;
+
return (const char *) data->d_buf + off;
}
INTDEF(dwarf_formstring)
--
2.43.0.rc1.413.gea7ed67945-goog
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] libdw: check offset dwarf_formstring in all cases
2023-11-16 21:29 [PATCH] libdw: check offset dwarf_formstring in all cases vvvvvv
@ 2023-11-17 15:31 ` Mark Wielaard
0 siblings, 0 replies; 2+ messages in thread
From: Mark Wielaard @ 2023-11-17 15:31 UTC (permalink / raw)
To: vvvvvv, elfutils-devel; +Cc: kernel-team, maennich
Hi Aleksei,
On Thu, 2023-11-16 at 21:29 +0000, vvvvvv@google.com wrote:
> This check was initially added to test if offset overflows the safe
> prefix where any string will be null-terminated. However the check
> was placed in a wrong place and didn't cover all `attrp->form` cases.
>
> * libdw/dwarf_formstring.c (dwarf_formstring): Move offset check
> right before returning the result.
Oops. I see how this happened for DW_FORM_strp and DW_FORM_line_strp we
use __libdw_read_offset which already check the section offset. But of
course those use d_size, not the string_section_size that was setup in
elf_begin_elf. So the check is also needed for them.
> Signed-off-by: Aleksei Vetrov <vvvvvv@google.com>
> ---
> libdw/dwarf_formstring.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/libdw/dwarf_formstring.c b/libdw/dwarf_formstring.c
> index 0ee42411..65f03a5e 100644
> --- a/libdw/dwarf_formstring.c
> +++ b/libdw/dwarf_formstring.c
> @@ -173,11 +173,11 @@ dwarf_formstring (Dwarf_Attribute *attrp)
> off = read_4ubyte_unaligned (dbg, datap);
> else
> off = read_8ubyte_unaligned (dbg, datap);
> -
> - if (off >= data_size)
> - goto invalid_offset;
> }
>
> + if (off >= data_size)
> + goto invalid_offset;
> +
> return (const char *) data->d_buf + off;
> }
> INTDEF(dwarf_formstring)
Applied.
Thanks,
Mark
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-11-17 15:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-11-16 21:29 [PATCH] libdw: check offset dwarf_formstring in all cases vvvvvv
2023-11-17 15:31 ` Mark Wielaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).