[Bug libdw/30085] New: Negative strides in dwarf_aggregate_size

["thaines.astro at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30085

            Bug ID: 30085
           Summary: Negative strides in dwarf_aggregate_size
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: enhancement
          Priority: P2
         Component: libdw
          Assignee: unassigned at sourceware dot org
          Reporter: thaines.astro at gmail dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

In section 5.13 of DWARF5, the standard says

    Note that the stride can be negative

I don't see anywhere in the standard besides this footnote that indicates it
should be a signed value.

In the array_size helper, the stride is calculated as

  Dwarf_Word stride = eltsize;
  if (INTUSE(dwarf_attr_integrate)(die, DW_AT_byte_stride, attr_mem) != NULL) {
    if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
      return -1;
  } else if (INTUSE(dwarf_attr_integrate)(die, DW_AT_bit_stride, attr_mem) !=
             NULL) {
    if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
      return -1;
    if (stride % 8) /* XXX maybe compute in bits? */
      return -1;
    stride /= 8;
  }

Since we could be reading a negative integer, the use of dwarf_formudata would
cause the total size to be incorrect.

I don't have a reproducer, and I've not seen any binaries that have run across
this. I just noticed it while reading through the source.

-- 
You are receiving this mail because:
You are on the CC list for the bug.