From dfbc689c699b3a15f11e8eb09cb05629f60b36b3 Mon Sep 17 00:00:00 2001 From: Alan Modra <amodra@gmail.com> Date: Thu, 4 Aug 2022 21:43:22 +0930 Subject: [PATCH] Sanity check loc_offsets index Fixes a segfault found by the fuzzers. * dwarf.c (fetch_indexed_value): Return -1 on error. (read_and_display_attr_value): Don't display string when fetch_indexed_value returns an error. Sanity check loc_offsets index. --- binutils/dwarf.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/binutils/dwarf.c b/binutils/dwarf.c index 6574b45ffdf..d862e16388b 100644 --- a/binutils/dwarf.c +++ b/binutils/dwarf.c @@ -779,7 +779,7 @@ fetch_indexed_addr (dwarf_vma offset, uint32_t num_bytes) /* Fetch a value from a debug section that has been indexed by something in another section (eg DW_FORM_loclistx or DW_FORM_rnglistx). - Returns 0 if the value could not be found. */ + Returns -1 if the value could not be found. */ static dwarf_vma fetch_indexed_value (dwarf_vma idx, @@ -791,7 +791,7 @@ fetch_indexed_value (dwarf_vma idx, if (section->start == NULL) { warn (_("Unable to locate %s section\n"), section->uncompressed_name); - return 0; + return -1; } uint32_t pointer_size, bias; @@ -820,7 +820,7 @@ fetch_indexed_value (dwarf_vma idx, { warn (_("Offset into section %s too big: 0x%s\n"), section->name, dwarf_vmatoa ("x", offset)); - return 0; + return -1; } return byte_get (section->start + offset, pointer_size); @@ -2782,7 +2782,8 @@ read_and_display_attr_value (unsigned long attribute, if (dwo) { idx = fetch_indexed_value (uvalue, loclists_dwo, 0); - idx += (offset_size == 8) ? 20 : 12; + if (idx != (dwarf_vma) -1) + idx += (offset_size == 8) ? 20 : 12; } else if (debug_info_p == NULL) { @@ -2795,7 +2796,13 @@ read_and_display_attr_value (unsigned long attribute, idx += debug_info_p->loclists_base; Fortunately we already have that sum cached in the loc_offsets array. */ - idx = debug_info_p->loc_offsets [uvalue]; + if (uvalue < debug_info_p->num_loc_offsets) + idx = debug_info_p->loc_offsets [uvalue]; + else + { + warn (_("loc_offset %" PRIu64 " too big\n"), uvalue); + idx = -1; + } } } else if (form == DW_FORM_rnglistx) @@ -2803,7 +2810,8 @@ read_and_display_attr_value (unsigned long attribute, if (dwo) { idx = fetch_indexed_value (uvalue, rnglists_dwo, 0); - idx += (offset_size == 8) ? 20 : 12; + if (idx != (dwarf_vma) -1) + idx += (offset_size == 8) ? 20 : 12; } else { @@ -2814,7 +2822,8 @@ read_and_display_attr_value (unsigned long attribute, /* We do not have a cached value this time, so we perform the computation manually. */ idx = fetch_indexed_value (uvalue, rnglists, base); - idx += base; + if (idx != (dwarf_vma) -1) + idx += base; } } else @@ -2831,9 +2840,10 @@ read_and_display_attr_value (unsigned long attribute, } /* We have already displayed the form name. */ - printf (_("%c(index: 0x%s): %s"), delimiter, - dwarf_vmatoa ("x", uvalue), - dwarf_vmatoa ("x", idx)); + if (idx != (dwarf_vma) -1) + printf (_("%c(index: 0x%s): %s"), delimiter, + dwarf_vmatoa ("x", uvalue), + dwarf_vmatoa ("x", idx)); } break;