summaryrefslogtreecommitdiff
path: root/libdw
diff options
context:
space:
mode:
authorMark Wielaard <mark@klomp.org>2018-06-08 15:10:43 +0200
committerMark Wielaard <mark@klomp.org>2018-06-10 17:02:22 +0200
commitb7a5bc8aa3421cca4d343ce7e5bca9a7a704a71e (patch)
tree5b9800535fdf2d7d2e1f9e7d939b11c86bd30053 /libdw
parenta1a3aa9460d2bbc5172c4eae1fd9c20b8a1a5eae (diff)
downloadelfutils-b7a5bc8aa3421cca4d343ce7e5bca9a7a704a71e.tar.gz
libdw: Detect bad DWARF in store_implicit_value.
The afl fuzzer running against the varlocs test detected we didn't report the value block of a DW_OP_implicit_value consistently when the DWARF was bad. Although this doesn't cause a crash it might result in consumers using dwarf_getlocation_implicit_value seeing an inconsistent block length value. To fix this detect and report bad DWARF data earlier. Signed-off-by: Mark Wielaard <mark@klomp.org>
Diffstat (limited to 'libdw')
-rw-r--r--libdw/ChangeLog7
-rw-r--r--libdw/dwarf_getlocation.c25
2 files changed, 26 insertions, 6 deletions
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index ddd82966..23e11b9d 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,5 +1,12 @@
2018-06-08 Mark Wielaard <mark@klomp.org>
+ * dwarf_getlocation.c (store_implicit_value): Return error when
+ seeing bad DWARF or when tsearch runs out of memory.
+ (__libdw_intern_expression): Report error when store_implicit_value
+ reported an error.
+
+2018-06-08 Mark Wielaard <mark@klomp.org>
+
* dwarf_getsrclines.c (read_srclines): Sanity check ndirs and nfiles.
2018-06-08 Mark Wielaard <mark@klomp.org>
diff --git a/libdw/dwarf_getlocation.c b/libdw/dwarf_getlocation.c
index d293e75d..7f294fe3 100644
--- a/libdw/dwarf_getlocation.c
+++ b/libdw/dwarf_getlocation.c
@@ -120,19 +120,23 @@ loc_compare (const void *p1, const void *p2)
}
/* For each DW_OP_implicit_value, we store a special entry in the cache.
- This points us directly to the block data for later fetching. */
-static void
+ This points us directly to the block data for later fetching.
+ Returns zero on success, -1 on bad DWARF or 1 if tsearch failed. */
+static int
store_implicit_value (Dwarf *dbg, void **cache, Dwarf_Op *op)
{
struct loc_block_s *block = libdw_alloc (dbg, struct loc_block_s,
sizeof (struct loc_block_s), 1);
const unsigned char *data = (const unsigned char *) (uintptr_t) op->number2;
- // Ignored, equal to op->number. And data length already checked.
- (void) __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word));
+ uint64_t len = __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word));
+ if (unlikely (len != op->number))
+ return -1;
block->addr = op;
block->data = (unsigned char *) data;
block->length = op->number;
- (void) tsearch (block, cache, loc_compare);
+ if (unlikely (tsearch (block, cache, loc_compare) == NULL))
+ return 1;
+ return 0;
}
int
@@ -589,7 +593,16 @@ __libdw_intern_expression (Dwarf *dbg, bool other_byte_order,
result[n].offset = loclist->offset;
if (result[n].atom == DW_OP_implicit_value)
- store_implicit_value (dbg, cache, &result[n]);
+ {
+ int store = store_implicit_value (dbg, cache, &result[n]);
+ if (unlikely (store != 0))
+ {
+ if (store < 0)
+ goto invalid;
+ else
+ goto nomem;
+ }
+ }
struct loclist *loc = loclist;
loclist = loclist->next;