Hi Sujal, Thanks for the patch, merged.
Aaron On Thu, Nov 5, 2026 at 3:32 AM Sujal Tuladhar <[email protected]> wrote: > > Hi, > > The attached patch fixes a heap out-of-bounds read in libdw when an inline > DW_FORM_string attribute is not null-terminated inside its unit. > > dwarf_formstring returns attrp->valp for DW_FORM_string without checking for > a terminating NUL. dwarf_getattrs passes each attribute to its callback > before __libdw_form_val_len validates the value, and dwarf_attr (through > __libdw_find_attr) returns the matching attribute without computing its > length, so a DW_FORM_string that runs to the end of its unit is returned > unterminated and callers read past the section data. Commit fda09f5f added > this guarantee for the .debug_str and .debug_line_str forms; the patch > extends it to DW_FORM_string by requiring a NUL before cu->endp, which covers > every caller. > > Reproducible with eu-readelf --debug-dump=info on a crafted ELF whose > zlib-compressed .debug_info ends in an unterminated DW_FORM_string; ASAN > reports a heap-buffer-overflow READ just past the decompressed section > buffer. The same overread happens in a plain dwarf_diename caller and inside > libdw in dwarf_getsrcfiles (read_srcfiles, unterminated DW_AT_comp_dir). The > patch (git format-patch, applies on HEAD 10b728d8) is attached. I have small > reproducer files for all three cases and can send them, or add them as a test > case, if that helps. > > Thanks, > Sujal Tuladhar
