From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from barracuda.ebox.ca (barracuda.ebox.ca [96.127.255.19]) by sourceware.org (Postfix) with ESMTPS id 7DF443947429 for ; Wed, 20 Jan 2021 05:39:27 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 7DF443947429 X-ASG-Debug-ID: 1611121166-0c856e6cd571f1e0001-fS2M51 Received: from smtp.ebox.ca (smtp.ebox.ca [96.127.255.82]) by barracuda.ebox.ca with ESMTP id oqIp4sqkDiS0sFDP (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 20 Jan 2021 00:39:26 -0500 (EST) X-Barracuda-Envelope-From: simon.marchi@polymtl.ca X-Barracuda-RBL-Trusted-Forwarder: 96.127.255.82 Received: from simark.localdomain (192-222-157-6.qc.cable.ebox.net [192.222.157.6]) by smtp.ebox.ca (Postfix) with ESMTP id 29C18441D66; Wed, 20 Jan 2021 00:39:26 -0500 (EST) From: Simon Marchi X-Barracuda-RBL-IP: 192.222.157.6 X-Barracuda-Effective-Source-IP: 192-222-157-6.qc.cable.ebox.net[192.222.157.6] X-Barracuda-Apparent-Source-IP: 192.222.157.6 To: gdb-patches@sourceware.org Cc: Zoran Zaric , Simon Marchi Subject: [PATCH 03/13] gdb/dwarf: add missing bound check to read_loclist_index Date: Wed, 20 Jan 2021 00:39:15 -0500 X-ASG-Orig-Subj: [PATCH 03/13] gdb/dwarf: add missing bound check to read_loclist_index Message-Id: <20210120053925.142862-4-simon.marchi@polymtl.ca> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210120053925.142862-1-simon.marchi@polymtl.ca> References: <20210120053925.142862-1-simon.marchi@polymtl.ca> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Barracuda-Connect: smtp.ebox.ca[96.127.255.82] X-Barracuda-Start-Time: 1611121166 X-Barracuda-Encrypted: DHE-RSA-AES256-SHA X-Barracuda-URL: https://96.127.255.19:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at ebox.ca X-Barracuda-Scan-Msg-Size: 2150 X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.00 X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=8.0 tests= X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.87375 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- X-Spam-Status: No, score=-24.5 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_QUARANTINE, KAM_DMARC_STATUS, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_SOFTFAIL, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Jan 2021 05:39:29 -0000 From: Simon Marchi read_rnglist_index has a bound check to make sure that we don't go past the end of the section while reading the offset, but read_loclist_index doesn't. Add it to read_loclist_index. gdb/ChangeLog: * dwarf2/read.c (read_loclist_index): Add bound check for the end of the offset. Change-Id: Ic4b55c88860fdc3e007740949c78ec84cdb4da60 --- gdb/dwarf2/read.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c index f3bc35644c8a..848c15330435 100644 --- a/gdb/dwarf2/read.c +++ b/gdb/dwarf2/read.c @@ -20186,6 +20186,11 @@ read_loclist_index (struct dwarf2_cu *cu, ULONGEST loclist_index) struct objfile *objfile = per_objfile->objfile; bfd *abfd = objfile->obfd; ULONGEST loclist_base = lookup_loclist_base (cu); + + /* Offset in .debug_loclists of the offset for LOCLIST_INDEX. */ + ULONGEST start_offset = + loclist_base + loclist_index * cu->header.offset_size; + struct dwarf2_section_info *section = cu_debug_loc_section (cu); section->read (objfile); @@ -20200,14 +20205,18 @@ read_loclist_index (struct dwarf2_cu *cu, ULONGEST loclist_index) ".debug_loclists offset array [in module %s]"), objfile_name (objfile)); - if (loclist_base + loclist_index * cu->header.offset_size - >= section->size) + if (start_offset >= section->size) error (_("DW_FORM_loclistx pointing outside of " ".debug_loclists section [in module %s]"), objfile_name (objfile)); - const gdb_byte *info_ptr - = section->buffer + loclist_base + loclist_index * cu->header.offset_size; + /* Validate that reading won't go beyond the end of the section. */ + if (start_offset + cu->header.offset_size > section->size) + error (_("Reading DW_FORM_loclistx index beyond end of" + ".debug_loclists section [in module %s]"), + objfile_name (objfile)); + + const gdb_byte *info_ptr = section->buffer + start_offset; if (cu->header.offset_size == 4) return bfd_get_32 (abfd, info_ptr) + loclist_base; -- 2.30.0