public inbox for
 help / color / mirror / Atom feed
From: "thaines.astro at gmail dot com" <>
Subject: [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size
Date: Mon, 06 Feb 2023 13:06:02 +0000	[thread overview]
Message-ID: <> (raw)

            Bug ID: 30085
           Summary: Negative strides in dwarf_aggregate_size
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: enhancement
          Priority: P2
         Component: libdw
          Assignee: unassigned at sourceware dot org
          Reporter: thaines.astro at gmail dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

In section 5.13 of DWARF5, the standard says

    Note that the stride can be negative

I don't see anywhere in the standard besides this footnote that indicates it
should be a signed value.

In the array_size helper, the stride is calculated as

  Dwarf_Word stride = eltsize;
  if (INTUSE(dwarf_attr_integrate)(die, DW_AT_byte_stride, attr_mem) != NULL) {
    if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
      return -1;
  } else if (INTUSE(dwarf_attr_integrate)(die, DW_AT_bit_stride, attr_mem) !=
             NULL) {
    if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
      return -1;
    if (stride % 8) /* XXX maybe compute in bits? */
      return -1;
    stride /= 8;

Since we could be reading a negative integer, the use of dwarf_formudata would
cause the total size to be incorrect.

I don't have a reproducer, and I've not seen any binaries that have run across
this. I just noticed it while reading through the source.

You are receiving this mail because:
You are on the CC list for the bug.

             reply	other threads:[~2023-02-06 13:06 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-02-06 13:06 thaines.astro at gmail dot com [this message]
2023-02-15 20:18 ` [Bug libdw/30085] " mark at klomp dot org
2023-02-21 16:03 ` mark at klomp dot org
2023-02-21 16:43 ` thaines.astro at gmail dot com

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).