[Bug libdw/24398] New: An invalid address deference problem was discovered in the print_debug_macinfo_section function __libdw_next_unit in libdw/dwarf_filesrc.c in libdw

[Bug libdw/24398] New: An invalid address deference problem was discovered in the print_debug_macinfo_section function __libdw_next_unit in libdw/dwarf_filesrc.c in libdw

[wcventure at 126 dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=24398

            Bug ID: 24398
           Summary: An invalid address deference problem was discovered in
                    the print_debug_macinfo_section function
                    __libdw_next_unit in libdw/dwarf_filesrc.c in libdw
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libdw
          Assignee: unassigned at sourceware dot org
          Reporter: wcventure at 126 dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 11709
  --> https://sourceware.org/bugzilla/attachment.cgi?id=11709&action=edit
POC

Hi, 

An invalid address deference problem was discovered in the
print_debug_macinfo_section function __libdw_next_unit in libdw/dwarf_filesrc.c
in libdw, as distributed in Elfutils 0.176(release version). A crafted ELF
input can cause segment faults and I have confirmed them with address sanitizer
too.

Here are the POC files. Please use "./eu-readelf -w $POC" to reproduce the
error.

> ASAN:SIGSEGV
> =================================================================
> ==7264==ERROR: AddressSanitizer: SEGV on unknown address 0x02007c2b0d91 (pc 0x7fe377095ed7 bp 0x7fff0ae365f0 sp 0x7fff0ae36380 T0)
>     #0 0x7fe377095ed6 in dwarf_filesrc /elfutils-0.176/libdw/dwarf_filesrc.c:41
>     #1 0x435ca5 in print_debug_macinfo_section /elfutils-0.176/src/readelf.c:9701
>     #2 0x4553a6 in print_debug /elfutils-0.176/src/readelf.c:11222
>     #3 0x45c74e in process_elf_file /elfutils-0.176/src/readelf.c:998
>     #4 0x4639cf in process_dwflmod /elfutils-0.176/src/readelf.c:760
>     #5 0x7fe3771220b8 in dwfl_getmodules /elfutils-0.176/libdwfl/dwfl_getmodules.c:86
>     #6 0x40c28b in process_file /elfutils-0.176/src/readelf.c:868
>     #7 0x405a8a in main /elfutils-0.176/src/readelf.c:350
>     #8 0x7fe3767ac82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
>     #9 0x406cd8 in _start (/elfutils-0.176_ASAN/build/bin/eu-readelf+0x406cd8)
> 
> AddressSanitizer can not provide additional info.
> SUMMARY: AddressSanitizer: SEGV /elfutils-0.176/libdw/dwarf_filesrc.c:41 dwarf_filesrc
> ==7264==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug tools/24398] eu-readelf print_debug_macinfo_section might read past end of CU list

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=24398

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |mark at klomp dot org
          Component|libdw                       |tools
         Resolution|---                         |FIXED
            Summary|An invalid address          |eu-readelf
                   |deference problem was       |print_debug_macinfo_section
                   |discovered in the           |might read past end of CU
                   |print_debug_macinfo_section |list
                   |function __libdw_next_unit  |
                   |in libdw/dwarf_filesrc.c in |
                   |libdw                       |

--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
Under valgrind -q --track-origins=yes eu-readelf --debug-dump=macinfo
POC.macinfo it shows:

==8148== Conditional jump or move depends on uninitialised value(s)
==8148==    at 0x8059AC3: print_debug_macinfo_section (readelf.c:9693)
==8148==    by 0x8056509: print_debug (readelf.c:11222)
==8148==    by 0x8058790: process_elf_file (readelf.c:998)
==8148==    by 0x805970B: process_dwflmod (readelf.c:760)
==8148==    by 0x40628B6: dwfl_getmodules (dwfl_getmodules.c:86)
==8148==    by 0x804D9C2: process_file (readelf.c:868)
==8148==    by 0x804B03F: main (readelf.c:350)
==8148==  Uninitialised value was created by a stack allocation
==8148==    at 0x8059756: print_debug_macinfo_section (readelf.c:9565)
==8148== 

That is this code:

          /* Find the CU DIE for this file.  */
          size_t macoff = readp - (const unsigned char *) data->d_buf;
          const char *fname = "???";
          if (macoff >= cus[0].offset)
            {
              while (macoff >= cus[1].offset && cus[1].offset != data->d_size)
                ++cus;

              if (cus[0].files == NULL
                && dwarf_getsrcfiles (&cus[0].die, &cus[0].files, NULL) != 0)
                cus[0].files = (Dwarf_Files *) -1l;

              if (cus[0].files != (Dwarf_Files *) -1l)
                fname = (dwarf_filesrc (cus[0].files, u128_2, NULL, NULL)
                         ?: "???");
            }

The cus[1].offset != data->d_size makes sure we don't go past the end of the
cus list. The last element of cus is the sentinel:

  /* Add sentinel.  */
  cus[nculist].offset = data->d_size;
  cus[nculist].files = (Dwarf_Files *) -1l;
  if (nculist > 0)
    {
      for (size_t cnt = nculist - 1; culist != NULL; --cnt)
        {
          assert (cnt < nculist);
          cus[cnt] = *culist;
          culist = culist->next;
        }

      /* Sort the array according to the offset in the .debug_macinfo
         section.  Note we keep the sentinel at the end.  */
      qsort (cus, nculist, sizeof (*cus), mac_compare);
    }

The issue here is that there are no cus at all, so cus[0] is the sentinal.
But that is not checked. Fixed by:

diff --git a/src/readelf.c b/src/readelf.c
index 33706bd..0bb9800 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -9688,7 +9688,7 @@ print_debug_macinfo_section (Dwfl_Module *dwflmod
__attribute__ ((unused)),
          /* Find the CU DIE for this file.  */
          size_t macoff = readp - (const unsigned char *) data->d_buf;
          const char *fname = "???";
-         if (macoff >= cus[0].offset)
+         if (macoff >= cus[0].offset && cus[0].offset != data->d_size)
            {
              while (macoff >= cus[1].offset && cus[1].offset != data->d_size)
                ++cus;

commit 34ff3ca2e86f8a4915500b92a8e00d6f52aa546c
Author: Mark Wielaard <mark@klomp.org>
Date:   Fri Mar 29 10:53:27 2019 +0100

    readelf: print_debug_macinfo_section, check cus[0] is not the sentinel.

    If there are no CUs at all we can not find any CU DIE file.

    https://sourceware.org/bugzilla/show_bug.cgi?id=24398

    Signed-off-by: Mark Wielaard <mark@klomp.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.