diff options
| author | Mark Wielaard <mark@klomp.org> | 2018-06-08 15:10:43 +0200 |
|---|---|---|
| committer | Mark Wielaard <mark@klomp.org> | 2018-06-10 17:02:22 +0200 |
| commit | b7a5bc8aa3421cca4d343ce7e5bca9a7a704a71e (patch) | |
| tree | 5b9800535fdf2d7d2e1f9e7d939b11c86bd30053 /libdw | |
| parent | a1a3aa9460d2bbc5172c4eae1fd9c20b8a1a5eae (diff) | |
| download | elfutils-b7a5bc8aa3421cca4d343ce7e5bca9a7a704a71e.tar.gz | |
libdw: Detect bad DWARF in store_implicit_value.
The afl fuzzer running against the varlocs test detected we didn't report
the value block of a DW_OP_implicit_value consistently when the DWARF was
bad. Although this doesn't cause a crash it might result in consumers
using dwarf_getlocation_implicit_value seeing an inconsistent block length
value. To fix this detect and report bad DWARF data earlier.
Signed-off-by: Mark Wielaard <mark@klomp.org>
Diffstat (limited to 'libdw')
| -rw-r--r-- | libdw/ChangeLog | 7 | ||||
| -rw-r--r-- | libdw/dwarf_getlocation.c | 25 |
2 files changed, 26 insertions, 6 deletions
diff --git a/libdw/ChangeLog b/libdw/ChangeLog index ddd82966..23e11b9d 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,5 +1,12 @@ 2018-06-08 Mark Wielaard <mark@klomp.org> + * dwarf_getlocation.c (store_implicit_value): Return error when + seeing bad DWARF or when tsearch runs out of memory. + (__libdw_intern_expression): Report error when store_implicit_value + reported an error. + +2018-06-08 Mark Wielaard <mark@klomp.org> + * dwarf_getsrclines.c (read_srclines): Sanity check ndirs and nfiles. 2018-06-08 Mark Wielaard <mark@klomp.org> diff --git a/libdw/dwarf_getlocation.c b/libdw/dwarf_getlocation.c index d293e75d..7f294fe3 100644 --- a/libdw/dwarf_getlocation.c +++ b/libdw/dwarf_getlocation.c @@ -120,19 +120,23 @@ loc_compare (const void *p1, const void *p2) } /* For each DW_OP_implicit_value, we store a special entry in the cache. - This points us directly to the block data for later fetching. */ -static void + This points us directly to the block data for later fetching. + Returns zero on success, -1 on bad DWARF or 1 if tsearch failed. */ +static int store_implicit_value (Dwarf *dbg, void **cache, Dwarf_Op *op) { struct loc_block_s *block = libdw_alloc (dbg, struct loc_block_s, sizeof (struct loc_block_s), 1); const unsigned char *data = (const unsigned char *) (uintptr_t) op->number2; - // Ignored, equal to op->number. And data length already checked. - (void) __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word)); + uint64_t len = __libdw_get_uleb128 (&data, data + len_leb128 (Dwarf_Word)); + if (unlikely (len != op->number)) + return -1; block->addr = op; block->data = (unsigned char *) data; block->length = op->number; - (void) tsearch (block, cache, loc_compare); + if (unlikely (tsearch (block, cache, loc_compare) == NULL)) + return 1; + return 0; } int @@ -589,7 +593,16 @@ __libdw_intern_expression (Dwarf *dbg, bool other_byte_order, result[n].offset = loclist->offset; if (result[n].atom == DW_OP_implicit_value) - store_implicit_value (dbg, cache, &result[n]); + { + int store = store_implicit_value (dbg, cache, &result[n]); + if (unlikely (store != 0)) + { + if (store < 0) + goto invalid; + else + goto nomem; + } + } struct loclist *loc = loclist; loclist = loclist->next; |