libdw: Skip zero entries in aranges

An address/length entry of two zeros is supposed to mark the end of a
table. But in some cases a producer might leave zero entries in the
table (for example when using gcc -ffunction-sections -gc-sections).

Since we know the lenght of the table we can just skip such entries
and continue to the end.

    * libdw/dwarf_getaranges.c (dwarf_getaranges): Calculate endp.
    When seeing two zero values, check we are at endp.

https://sourceware.org/bugzilla/show_bug.cgi?id=27805

Signed-off-by: Mark Wielaard <mark@klomp.org>

diff --git a/libdw/dwarf_getaranges.c b/libdw/dwarf_getaranges.c
index de5b81baa21080503fc93f77cc5bd9fb0f6ceaa0..27439d37212c25dc48cdc06597c1bab2866ef346 100644 (file)
--- a/libdw/dwarf_getaranges.c
+++ b/libdw/dwarf_getaranges.c
@@ -1,5 +1,6 @@
 /* Return list address ranges.
    Copyright (C) 2000-2010, 2016, 2017 Red Hat, Inc.
+   Copyright (C) 2023 Mark J. Wielaard <mark@klomp.org>
    This file is part of elfutils.
    Written by Ulrich Drepper <drepper@redhat.com>, 2000.
 
@@ -124,6 +125,10 @@ dwarf_getaranges (Dwarf *dbg, Dwarf_Aranges **aranges, size_t *naranges)
                         && length <= DWARF3_LENGTH_MAX_ESCAPE_CODE))
        goto invalid;
 
+      const unsigned char *endp = readp + length;
+      if (unlikely (endp > readendp))
+       goto invalid;
+
       if (unlikely (readp + 2 > readendp))
        goto invalid;
 
@@ -182,9 +187,17 @@ dwarf_getaranges (Dwarf *dbg, Dwarf_Aranges **aranges, size_t *naranges)
          else
            range_length = read_8ubyte_unaligned_inc (dbg, readp);
 
-         /* Two zero values mark the end.  */
+         /* Two zero values mark the end.  But in some cases (bugs)
+            there might be such entries in the middle of the table.
+            Ignore and continue, we'll check the actual length of
+            the table to see if we are really at the end.  */
          if (range_address == 0 && range_length == 0)
-           break;
+           {
+             if (readp >= endp)
+               break;
+             else
+               continue;
+           }
 
          /* We don't use alloca for these temporary structures because
             the total number of them can be quite large.  */