public inbox for gcc-patches@gcc.gnu.org
 help / color / mirror / Atom feed
* libbacktrace patch: fix memory allocation buglet on DWARF line table with zero dirs
@ 2017-05-12 14:04 Than McIntosh via gcc-patches
  2017-05-19 13:32 ` Than McIntosh via gcc-patches
  0 siblings, 1 reply; 3+ messages in thread
From: Than McIntosh via gcc-patches @ 2017-05-12 14:04 UTC (permalink / raw)
  To: Ian Lance Taylor; +Cc: gcc-patches

Hello,

The attached patch to libbacktrace is intended to fix a memory
allocation bug involving reading of line table information.

The scenario of interest takes place when libbacktrace reads a DWARF
line table whose directory count is zero (an unusual case). If the
memory allocator invocation triggers a call to mmap, this can cause
the size passed to mmap to be zero, resulting in an EINVAL error.  The
fix is to detect the zero-directory case and avoid invoking the
allocation helper with a zero size.

Questions + comments welcome.

Thanks, Than

---

diff --git a/libbacktrace/dwarf.c b/libbacktrace/dwarf.c
index 80c64034092..bcb2c0991ef 100644
--- a/libbacktrace/dwarf.c
+++ b/libbacktrace/dwarf.c
@@ -1563,16 +1563,15 @@ add_line (struct backtrace_state *state,
struct dwarf_data *ddata,
   return 1;
 }

-/* Free the line header information.  If FREE_FILENAMES is true we
-   free the file names themselves, otherwise we leave them, as there
-   may be line structures pointing to them.  */
+/* Free the line header information.  */

 static void
 free_line_header (struct backtrace_state *state, struct line_header *hdr,
   backtrace_error_callback error_callback, void *data)
 {
-  backtrace_free (state, hdr->dirs, hdr->dirs_count * sizeof (const char *),
-  error_callback, data);
+  if (hdr->dirs_count != 0)
+    backtrace_free (state, hdr->dirs, hdr->dirs_count * sizeof (const char *),
+                    error_callback, data);
   backtrace_free (state, hdr->filenames,
   hdr->filenames_count * sizeof (char *),
   error_callback, data);
@@ -1633,12 +1632,16 @@ read_line_header (struct backtrace_state
*state, struct unit *u,
       ++hdr->dirs_count;
     }

-  hdr->dirs = ((const char **)
-       backtrace_alloc (state,
- hdr->dirs_count * sizeof (const char *),
- line_buf->error_callback, line_buf->data));
-  if (hdr->dirs == NULL)
-    return 0;
+  hdr->dirs = NULL;
+  if (hdr->dirs_count != 0)
+    {
+      hdr->dirs = ((const char **)
+                   backtrace_alloc (state,
+                                    hdr->dirs_count * sizeof (const char *),
+                                    line_buf->error_callback, line_buf->data));
+      if (hdr->dirs == NULL)
+        return 0;
+    }

   i = 0;
   while (*hdr_buf.buf != '\0')

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-05-19 16:08 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-12 14:04 libbacktrace patch: fix memory allocation buglet on DWARF line table with zero dirs Than McIntosh via gcc-patches
2017-05-19 13:32 ` Than McIntosh via gcc-patches
2017-05-19 16:13   ` Ian Lance Taylor via gcc-patches

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).