From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
	id AFADD3858D1E; Mon,  6 Feb 2023 13:06:02 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AFADD3858D1E
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;
	s=default; t=1675688762;
	bh=ih4lQlWkpmiQcClcVGxRdKBG7OV/pc8jiLMFUrMH5MU=;
	h=From:To:Subject:Date:From;
	b=WbOD6pHkHYOGTJcMExC3p9fkdeNmv9IrBCqGZu37e5nBTLmBiFdBBqIWZ3ngrEhPk
	 uAHe97KGVrLzFXOnABCH44RQSaBPqRrctA1TcWTDtcCP9SyNTGQeNqJL9n1eqPa7hk
	 6KIYLyoDmeL2WUCMyHieLDU/3o4jy0OOH57X/2Qk=
From: "thaines.astro at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: elfutils-devel@sourceware.org
Subject: [Bug libdw/30085] New: Negative strides in dwarf_aggregate_size
Date: Mon, 06 Feb 2023 13:06:02 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: elfutils
X-Bugzilla-Component: libdw
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: enhancement
X-Bugzilla-Who: thaines.astro at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter cc target_milestone
Message-ID: <bug-30085-10460@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <elfutils-devel.sourceware.org>

https://sourceware.org/bugzilla/show_bug.cgi?id=3D30085

            Bug ID: 30085
           Summary: Negative strides in dwarf_aggregate_size
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: enhancement
          Priority: P2
         Component: libdw
          Assignee: unassigned at sourceware dot org
          Reporter: thaines.astro at gmail dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

In section 5.13 of DWARF5, the standard says

    Note that the stride can be negative

I don't see anywhere in the standard besides this footnote that indicates it
should be a signed value.

In the array_size helper, the stride is calculated as

  Dwarf_Word stride =3D eltsize;
  if (INTUSE(dwarf_attr_integrate)(die, DW_AT_byte_stride, attr_mem) !=3D N=
ULL) {
    if (INTUSE(dwarf_formudata)(attr_mem, &stride) !=3D 0)
      return -1;
  } else if (INTUSE(dwarf_attr_integrate)(die, DW_AT_bit_stride, attr_mem) =
!=3D
             NULL) {
    if (INTUSE(dwarf_formudata)(attr_mem, &stride) !=3D 0)
      return -1;
    if (stride % 8) /* XXX maybe compute in bits? */
      return -1;
    stride /=3D 8;
  }

Since we could be reading a negative integer, the use of dwarf_formudata wo=
uld
cause the total size to be incorrect.

I don't have a reproducer, and I've not seen any binaries that have run acr=
oss
this. I just noticed it while reading through the source.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=