From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 60205 invoked by alias); 1 Feb 2019 13:10:40 -0000 Mailing-List: contact elfutils-devel-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Post: List-Help: List-Subscribe: Sender: elfutils-devel-owner@sourceware.org Received: (qmail 56298 invoked by uid 48); 1 Feb 2019 13:10:35 -0000 From: "mark at klomp dot org" To: elfutils-devel@sourceware.org Subject: [Bug libdw/24140] A Heap-buffer-overflow problem was discovered in the function __libdw_next_unit in dwarf_nextcu.c in libdw Date: Fri, 01 Feb 2019 13:10:00 -0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: elfutils X-Bugzilla-Component: libdw X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: critical X-Bugzilla-Who: mark at klomp dot org X-Bugzilla-Status: RESOLVED X-Bugzilla-Resolution: FIXED X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_status cc resolution Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-SW-Source: 2019-q1/txt/msg00119.txt.bz2 https://sourceware.org/bugzilla/show_bug.cgi?id=3D24140 Mark Wielaard changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED CC| |mark at klomp dot org Resolution|--- |FIXED --- Comment #1 from Mark Wielaard --- Replicated under valgrind: $ valgrind -q eu-nm -C ./POC.unit=20 src/nm: ./POC.unit: entry size in section 2 `.debug_info' is not what we ex= pect =3D=3D15242=3D=3D Invalid read of size 8 =3D=3D15242=3D=3D at 0x4850940: __libdw_next_unit (dwarf_nextcu.c:168) =3D=3D15242=3D=3D by 0x4850C24: dwarf_next_unit (dwarf_nextcu.c:46) =3D=3D15242=3D=3D by 0x4850C24: dwarf_nextcu (dwarf_nextcu.c:294) =3D=3D15242=3D=3D by 0x10E73B: get_local_names (nm.c:627) =3D=3D15242=3D=3D by 0x10E73B: show_symbols (nm.c:1285) =3D=3D15242=3D=3D by 0x10FCEA: handle_elf (nm.c:1578) =3D=3D15242=3D=3D by 0x110482: process_file (nm.c:374) =3D=3D15242=3D=3D by 0x10D70D: main (nm.c:249) =3D=3D15242=3D=3D Address 0x525481a is 26 bytes inside a block of size 32 = alloc'd =3D=3D15242=3D=3D at 0x483577F: malloc (vg_replace_malloc.c:299) =3D=3D15242=3D=3D by 0x48A0358: convert_data (elf_getdata.c:157) =3D=3D15242=3D=3D by 0x48A0358: __libelf_set_data_list_rdlock (elf_getda= ta.c:447) =3D=3D15242=3D=3D by 0x48A0547: __elf_getdata_rdlock (elf_getdata.c:554) =3D=3D15242=3D=3D by 0x484EFB0: check_section (dwarf_begin_elf.c:167) =3D=3D15242=3D=3D by 0x484F522: global_read (dwarf_begin_elf.c:310) =3D=3D15242=3D=3D by 0x484F522: dwarf_begin_elf (dwarf_begin_elf.c:445) =3D=3D15242=3D=3D by 0x10E690: show_symbols (nm.c:1243) =3D=3D15242=3D=3D by 0x10FCEA: handle_elf (nm.c:1578) =3D=3D15242=3D=3D by 0x110482: process_file (nm.c:374) =3D=3D15242=3D=3D by 0x10D70D: main (nm.c:249) =3D=3D15242=3D=3D=20 =3D=3D15242=3D=3D Invalid read of size 2 =3D=3D15242=3D=3D at 0x485094B: __libdw_next_unit (dwarf_nextcu.c:168) =3D=3D15242=3D=3D by 0x4850C24: dwarf_next_unit (dwarf_nextcu.c:46) =3D=3D15242=3D=3D by 0x4850C24: dwarf_nextcu (dwarf_nextcu.c:294) =3D=3D15242=3D=3D by 0x10E73B: get_local_names (nm.c:627) =3D=3D15242=3D=3D by 0x10E73B: show_symbols (nm.c:1285) =3D=3D15242=3D=3D by 0x10FCEA: handle_elf (nm.c:1578) =3D=3D15242=3D=3D by 0x110482: process_file (nm.c:374) =3D=3D15242=3D=3D by 0x10D70D: main (nm.c:249) =3D=3D15242=3D=3D Address 0x5254822 is 2 bytes after a block of size 32 al= loc'd =3D=3D15242=3D=3D at 0x483577F: malloc (vg_replace_malloc.c:299) =3D=3D15242=3D=3D by 0x48A0358: convert_data (elf_getdata.c:157) =3D=3D15242=3D=3D by 0x48A0358: __libelf_set_data_list_rdlock (elf_getda= ta.c:447) =3D=3D15242=3D=3D by 0x48A0547: __elf_getdata_rdlock (elf_getdata.c:554) =3D=3D15242=3D=3D by 0x484EFB0: check_section (dwarf_begin_elf.c:167) =3D=3D15242=3D=3D by 0x484F522: global_read (dwarf_begin_elf.c:310) =3D=3D15242=3D=3D by 0x484F522: dwarf_begin_elf (dwarf_begin_elf.c:445) =3D=3D15242=3D=3D by 0x10E690: show_symbols (nm.c:1243) =3D=3D15242=3D=3D by 0x10FCEA: handle_elf (nm.c:1578) =3D=3D15242=3D=3D by 0x110482: process_file (nm.c:374) =3D=3D15242=3D=3D by 0x10D70D: main (nm.c:249) =3D=3D15242=3D=3D=20 We do check we can read the initial unit lenght (4 bytes), but then fail to check if we can read any extended length for a DWARF64 unit. We also fail to check whether we can read the actual version or (DWARF5) unit type. After we know the version and unit type we do sanity check the full header length (we cannot really know before reading those three fields at least). Fixed by: commit e8f8dc465a1fa496aa627a330886c0f70f98d4c0 Author: Mark Wielaard Date: Fri Feb 1 14:03:38 2019 +0100 libdw: Check there is enough space for CU 64bit length, version and typ= e. We only checked we could read the initial length and after knowing the version and type whether the unit header was the right size. Also check there are at least enough bytes to read the 64bit length, version and unit type bytes. https://sourceware.org/bugzilla/show_bug.cgi?id=3D24140 Signed-off-by: Mark Wielaard --=20 You are receiving this mail because: You are on the CC list for the bug.