From: Mark Wielaard <mark@klomp.org>
Date: Fri, 8 Jun 2018 18:45:48 +0000 (+0200)
Subject: libdw: Check validity of dwarf_getabbrev arguments.
X-Git-Tag: elfutils-0.172~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=95e3d07a6742992cf22e239389cab12ba0d4d95d;p=thirdparty%2Felfutils.git

libdw: Check validity of dwarf_getabbrev arguments.

When the given Dwarf_Die was invalid we might crash and when the offset
was totally bogus we might succeed with a random abbrev.

Signed-off-by: Mark Wielaard <mark@klomp.org>
---

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 21cb03c24..1195cf6e8 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,7 @@
+2018-06-08  Mark Wielaard  <mark@klomp.org>
+
+	* dwarf_getabbrev.c (dwarf_getabbrev): Check die and offset.
+
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
 	* dwarf_get_units.c (dwarf_get_units): Handle existing error, no
diff --git a/libdw/dwarf_getabbrev.c b/libdw/dwarf_getabbrev.c
index 1e113dbe2..988d12c21 100644
--- a/libdw/dwarf_getabbrev.c
+++ b/libdw/dwarf_getabbrev.c
@@ -158,7 +158,21 @@ __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, Dwarf_Off offset,
 Dwarf_Abbrev *
 dwarf_getabbrev (Dwarf_Die *die, Dwarf_Off offset, size_t *lengthp)
 {
-  return __libdw_getabbrev (die->cu->dbg, die->cu,
-			    die->cu->orig_abbrev_offset + offset, lengthp,
-			    NULL);
+  if (die == NULL || die->cu == NULL)
+    return NULL;
+
+  Dwarf_CU *cu = die->cu;
+  Dwarf *dbg = cu->dbg;
+  Dwarf_Off abbrev_offset = cu->orig_abbrev_offset;
+  Elf_Data *data = dbg->sectiondata[IDX_debug_abbrev];
+  if (data == NULL)
+    return NULL;
+
+  if (offset >= data->d_size - abbrev_offset)
+    {
+      __libdw_seterrno (DWARF_E_INVALID_OFFSET);
+      return NULL;
+    }
+
+  return __libdw_getabbrev (dbg, cu, abbrev_offset + offset, lengthp, NULL);
 }
diff --git a/tests/ChangeLog b/tests/ChangeLog
index 25ed41e74..3b69a87c2 100644
--- a/tests/ChangeLog
+++ b/tests/ChangeLog
@@ -1,3 +1,8 @@
+2018-06-08  Mark Wielaard  <mark@klomp.org>
+
+	* get-units-invalid.c (main): Check invalid dwarf_getabbrev call.
+	* show-abbrev.c (main): Check illegal dwarf_getabbrev offset call.
+
 2018-06-08  Mark Wielaard  <mark@klomp.org>
 
 	* varlocs.c (main): Only assert when cfi_debug_bias != 0 if there
diff --git a/tests/get-units-invalid.c b/tests/get-units-invalid.c
index ba0f818d9..155e12db4 100644
--- a/tests/get-units-invalid.c
+++ b/tests/get-units-invalid.c
@@ -98,6 +98,12 @@ main (int argc, char *argv[])
 			  dwarf_diename (&subdie));
 		  return -1;
 		}
+	      if (dwarf_getabbrev (&subdie, 0, NULL) != NULL)
+		{
+		  printf ("Should NOT have an abbrev: %s\n",
+			  dwarf_diename (&subdie));
+		  return -1;
+		}
 	    }
 	  else if (unit_type == DW_UT_type)
 	    printf ("subdie: %s\n", dwarf_diename (&subdie));
diff --git a/tests/show-abbrev.c b/tests/show-abbrev.c
index b0af0297e..002ae25ef 100644
--- a/tests/show-abbrev.c
+++ b/tests/show-abbrev.c
@@ -51,6 +51,14 @@ main (int argc, char *argv[])
 	    /* Something went wrong.  */
 	    break;
 
+	  /* Test something obviously wrong.  */
+	  Dwarf_Abbrev *a = dwarf_getabbrev (&die, (Dwarf_Off) -1, NULL);
+	  if (a != NULL)
+	    {
+	      printf ("dwarf_getabbrev -1 succeeded?\n");
+	      break;
+	    }
+
 	  Dwarf_Off offset = 0;
 
 	  while (1)