From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from barracuda.ebox.ca (barracuda.ebox.ca [96.127.255.19]) by sourceware.org (Postfix) with ESMTPS id 65DE1386F419 for ; Wed, 20 Jan 2021 05:39:27 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 65DE1386F419 X-ASG-Debug-ID: 1611121166-0c856e67e246f720001-fS2M51 Received: from smtp.ebox.ca (smtp.ebox.ca [96.127.255.82]) by barracuda.ebox.ca with ESMTP id FbmbcPzt9qpThg6O (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 20 Jan 2021 00:39:26 -0500 (EST) X-Barracuda-Envelope-From: simon.marchi@polymtl.ca X-Barracuda-RBL-Trusted-Forwarder: 96.127.255.82 Received: from simark.localdomain (192-222-157-6.qc.cable.ebox.net [192.222.157.6]) by smtp.ebox.ca (Postfix) with ESMTP id 16387441D65; Wed, 20 Jan 2021 00:39:26 -0500 (EST) From: Simon Marchi X-Barracuda-RBL-IP: 192.222.157.6 X-Barracuda-Effective-Source-IP: 192-222-157-6.qc.cable.ebox.net[192.222.157.6] X-Barracuda-Apparent-Source-IP: 192.222.157.6 To: gdb-patches@sourceware.org Cc: Zoran Zaric , Simon Marchi Subject: [PATCH 02/13] gdb/dwarf: fix bound check in read_rnglist_index Date: Wed, 20 Jan 2021 00:39:14 -0500 X-ASG-Orig-Subj: [PATCH 02/13] gdb/dwarf: fix bound check in read_rnglist_index Message-Id: <20210120053925.142862-3-simon.marchi@polymtl.ca> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210120053925.142862-1-simon.marchi@polymtl.ca> References: <20210120053925.142862-1-simon.marchi@polymtl.ca> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Barracuda-Connect: smtp.ebox.ca[96.127.255.82] X-Barracuda-Start-Time: 1611121166 X-Barracuda-Encrypted: DHE-RSA-AES256-SHA X-Barracuda-URL: https://96.127.255.19:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at ebox.ca X-Barracuda-Scan-Msg-Size: 1951 X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.50 X-Barracuda-Spam-Status: No, SCORE=0.50 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=8.0 tests=BSF_RULE7568M X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.87375 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.50 BSF_RULE7568M Custom Rule 7568M X-Spam-Status: No, score=-24.4 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_QUARANTINE, KAM_DMARC_STATUS, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_SOFTFAIL, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Jan 2021 05:39:28 -0000 From: Simon Marchi I think this check in read_rnglist_index is wrong: /* Validate that reading won't go beyond the end of the section. */ if (start_offset + cu->header.offset_size > rnglist_base + section->size) error (_("Reading DW_FORM_rnglistx index beyond end of" ".debug_rnglists section [in module %s]"), objfile_name (objfile)); The addition `rnglist_base + section->size` doesn't make sense. rnglist_base is an offset into `section`, so it doesn't make sense to add it to `section`'s size. `start_offset` also is an offset into `section`, so we should just compare it to just `section->size`. gdb/ChangeLog: * dwarf2/read.c (read_rnglist_index): Fix bound check. Change-Id: If0ff7c73f4f80f79aac447518f4e8f131f2db8f2 --- gdb/dwarf2/read.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c index 2b76ed001616..f3bc35644c8a 100644 --- a/gdb/dwarf2/read.c +++ b/gdb/dwarf2/read.c @@ -20229,6 +20229,8 @@ read_rnglist_index (struct dwarf2_cu *cu, ULONGEST rnglist_index, : RNGLIST_HEADER_SIZE64); ULONGEST rnglist_base = (cu->dwo_unit != nullptr) ? rnglist_header_size : cu->ranges_base; + + /* Offset in .debug_rnglists of the offset for RNGLIST_INDEX. */ ULONGEST start_offset = rnglist_base + rnglist_index * cu->header.offset_size; @@ -20257,7 +20259,7 @@ read_rnglist_index (struct dwarf2_cu *cu, ULONGEST rnglist_index, objfile_name (objfile)); /* Validate that reading won't go beyond the end of the section. */ - if (start_offset + cu->header.offset_size > rnglist_base + section->size) + if (start_offset + cu->header.offset_size > section->size) error (_("Reading DW_FORM_rnglistx index beyond end of" ".debug_rnglists section [in module %s]"), objfile_name (objfile)); -- 2.30.0