Check for truncated section in dwarf_child.

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index b0ba7e007a31783115d9b8117e8885049f5c5a61..e31fabf9e84ae7beffa5fc3be95ce69d72b3941a 100644 (file)
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,7 @@
+2011-03-09  Petr Machata  <pmachata@redhat.com>
+
+       * libdw/dwarf_child.c (dwarf_child): Check for section overrun.
+
 2011-02-23  Roland McGrath  <roland@redhat.com>
 
        * libdwP.h (struct Dwarf) [USE_ZLIB]: New member sectiondata_gzip_mask.

diff --git a/libdw/dwarf_child.c b/libdw/dwarf_child.c
index 0080cf9d9291a7acb9e8affd32647ad33537078b..1ec3704e4e12de1fececdbedd565053e05013c49 100644 (file)
--- a/libdw/dwarf_child.c
+++ b/libdw/dwarf_child.c
@@ -1,5 +1,5 @@
 /* Return child of current DIE.
-   Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Red Hat, Inc.
+   Copyright (C) 2003-2011 Red Hat, Inc.
    This file is part of Red Hat elfutils.
    Written by Ulrich Drepper <drepper@redhat.com>, 2003.
 
@@ -175,18 +175,27 @@ dwarf_child (die, result)
   if (addr == NULL)
     return -1;
 
+  /* RESULT can be the same as DIE.  So preserve what we need.  */
+  struct Dwarf_CU *cu = die->cu;
+
   /* It's kosher (just suboptimal) to have a null entry first thing (7.5.3).
      So if this starts with ULEB128 of 0 (even with silly encoding of 0),
      it is a kosher null entry and we do not really have any children.  */
   const unsigned char *code = addr;
-  while (unlikely (*code == 0x80))
-    ++code;
+  const unsigned char *endp = (cu->dbg->sectiondata[IDX_debug_info]->d_buf
+                              + cu->dbg->sectiondata[IDX_debug_info]->d_size);
+  while (1)
+    {
+      if (unlikely (code >= endp)) /* Truncated section.  */
+       return 1;
+      if (unlikely (*code == 0x80))
+       ++code;
+      else
+       break;
+    }
   if (unlikely (*code == '\0'))
     return 1;
 
-  /* RESULT can be the same as DIE.  So preserve what we need.  */
-  struct Dwarf_CU *cu = die->cu;
-
   /* Clear the entire DIE structure.  This signals we have not yet
      determined any of the information.  */
   memset (result, '\0', sizeof (Dwarf_Die));