libdw: Break long or circular DIE ref chains in dwarf_[has]attr_integrate.

Bad DWARF could create a very long or circular DIE ref chain by linking
DW_AT_abstract_origin or DW_AT_specification to the DIE itself. Break
the chain after seeing a large number (16) of DIEs.

Signed-off-by: Mark Wielaard <mark@klomp.org>

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 1195cf6e882d60b25305fa4653c1032422cb7d93..07a1346b3b900152d096c66c0d0e2a8394b604b9 100644 (file)
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,9 @@
+2018-06-10  Mark Wielaard  <mark@klomp.org>
+
+       * dwarf_attr_integrate.c (dwarf_attr_integrate): Stop after 16 DIE
+       ref chains.
+       * dwarf_hasattr_integrate.c (dwarf_hasattr_integrate): Likewise.
+
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
        * dwarf_getabbrev.c (dwarf_getabbrev): Check die and offset.

diff --git a/libdw/dwarf_attr_integrate.c b/libdw/dwarf_attr_integrate.c
index 748d988dd7c8b15b99f4aaa8aab1bd74bc047c18..fc068638a202d3a124424f8613e95c22f2f625c0 100644 (file)
--- a/libdw/dwarf_attr_integrate.c
+++ b/libdw/dwarf_attr_integrate.c
@@ -38,7 +38,7 @@ dwarf_attr_integrate (Dwarf_Die *die, unsigned int search_name,
                      Dwarf_Attribute *result)
 {
   Dwarf_Die die_mem;
-
+  int chain = 16; /* Largest DIE ref chain we will follow.  */
   do
     {
       Dwarf_Attribute *attr = INTUSE(dwarf_attr) (die, search_name, result);
@@ -53,7 +53,7 @@ dwarf_attr_integrate (Dwarf_Die *die, unsigned int search_name,
 
       die = INTUSE(dwarf_formref_die) (attr, &die_mem);
     }
-  while (die != NULL);
+  while (die != NULL && chain-- != 0);
 
   /* Not NULL if it didn't have abstract_origin and specification
      attributes.  If it is a split CU then see if the skeleton

diff --git a/libdw/dwarf_hasattr_integrate.c b/libdw/dwarf_hasattr_integrate.c
index 4d4b4c541d854c7680979338984c2a70825fe43e..1d946280764e767c41b20f70aac8f97bdfd530fb 100644 (file)
--- a/libdw/dwarf_hasattr_integrate.c
+++ b/libdw/dwarf_hasattr_integrate.c
@@ -37,7 +37,7 @@ int
 dwarf_hasattr_integrate (Dwarf_Die *die, unsigned int search_name)
 {
   Dwarf_Die die_mem;
-
+  int chain = 16; /* Largest DIE ref chain we will follow.  */
   do
     {
       if (INTUSE(dwarf_hasattr) (die, search_name))
@@ -53,7 +53,7 @@ dwarf_hasattr_integrate (Dwarf_Die *die, unsigned int search_name)
 
       die = INTUSE(dwarf_formref_die) (attr, &die_mem);
     }
-  while (die != NULL);
+  while (die != NULL && chain-- != 0);
 
   /* Not NULL if it didn't have abstract_origin and specification
      attributes.  If it is a split CU then see if the skeleton