On Thu, 2017-12-14 at 14:55 +0100, Ulf Hermann wrote:
> On 12/14/2017 02:43 PM, Mark Wielaard wrote:
> > The transformation seems correct. But if we can overflow/underflow
> > here, do we have the same problem in __libdw_offset_in_section
> > where we
> > check data->d_size - offset < size, with offset a Dwarf_Off?
>
> Probably we have the same problem there. I didn't catch any instances
> of it, though.
It is surprising we didn't see more issues with this code. There is
also the fake loc cu that fetches data from a different section. I
updated both functions as attached.
Cheers,
Mark
From 0d100f63db640c533748a7adaa099499b2d2d4b0 Mon Sep 17 00:00:00 2001
From: Ulf Hermann <ulf.herm...@qt.io>
Date: Tue, 9 May 2017 18:28:33 +0200
Subject: [PATCH 2/2] Don't overflow in __libdw_in_section and
__libdw_offset_in_section.
This exposes a bug in dwarf_formstring as detected by the dwarf-getmacros
test before we made sure to use the correct sec_idx for the CU.
Signed-off-by: Ulf Hermann <ulf.herm...@qt.io>
Signed-off-by: Mark Wielaard <m...@klomp.org>
---
libdw/ChangeLog | 7 +++++++
libdw/libdwP.h | 6 ++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 22b7bf4..eb1cb70 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,10 @@
+2017-05-09 Ulf Hermann <ulf.herm...@qt.io>
+ Mark Wielaard <m...@klomp.org>
+
+ * libdwP.h (__libdw_in_section): Fix check for the upper border of
+ the range.
+ (__libdw_offset_in_section): Likewise.
+
2017-12-20 Mark Wielaard <m...@klomp.org>
* libdwP.h (struct Dwarf_CU): Add sec_idx field.
diff --git a/libdw/libdwP.h b/libdw/libdwP.h
index f524347..82b47d0 100644
--- a/libdw/libdwP.h
+++ b/libdw/libdwP.h
@@ -628,7 +628,8 @@ __libdw_offset_in_section (Dwarf *dbg, int sec_index,
if (data == NULL)
return -1;
if (unlikely (offset > data->d_size)
- || unlikely (data->d_size - offset < size))
+ || unlikely (data->d_size < size)
+ || unlikely (offset > data->d_size - size))
{
__libdw_seterrno (DWARF_E_INVALID_OFFSET);
return -1;
@@ -645,7 +646,8 @@ __libdw_in_section (Dwarf *dbg, int sec_index,
if (data == NULL)
return false;
if (unlikely (addr < data->d_buf)
- || unlikely (data->d_size - (addr - data->d_buf) < size))
+ || unlikely (data->d_size < size)
+ || unlikely ((size_t)(addr - data->d_buf) > data->d_size - size))
{
__libdw_seterrno (DWARF_E_INVALID_OFFSET);
return false;
--
1.8.3.1
