From patchwork Wed Apr 24 16:27:39 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sandra Loosemore X-Patchwork-Id: 32403 Received: (qmail 80989 invoked by alias); 24 Apr 2019 16:27:47 -0000 Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org Delivered-To: mailing list gdb-patches@sourceware.org Received: (qmail 80981 invoked by uid 89); 24 Apr 2019 16:27:47 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-19.4 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_NUMSUBJECT, RCVD_IN_DNSWL_NONE, SPF_PASS autolearn=ham version=3.3.1 spammy=H*r:0700, loosemore, sandra@codesourcery.com, sandracodesourcerycom X-HELO: relay1.mentorg.com Received: from relay1.mentorg.com (HELO relay1.mentorg.com) (192.94.38.131) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 24 Apr 2019 16:27:46 +0000 Received: from svr-orw-mbx-03.mgc.mentorg.com ([147.34.90.203]) by relay1.mentorg.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256) id 1hJKkK-0002c4-Kp from Sandra_Loosemore@mentor.com for gdb-patches@sourceware.org; Wed, 24 Apr 2019 09:27:44 -0700 Received: from [127.0.0.1] (147.34.91.1) by svr-orw-mbx-03.mgc.mentorg.com (147.34.90.203) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Wed, 24 Apr 2019 09:27:42 -0700 To: "gdb-patches@sourceware.org" From: Sandra Loosemore Subject: [patch] Fix CVE-2017-9778 Message-ID: Date: Wed, 24 Apr 2019 10:27:39 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 We had a request from a customer to fix CVE-2017-9778 (aka PR gdb/21600). They don't really care about this particular bug, just that they can cross it off the list of known vulnerabilities in GDB. This patch is based on the one attached to the issue. I also cleaned up a bunch of pointless conversions between signed and unsigned representations of the length field, and made sure the length == 0 case retains its special meaning. OK to commit? -Sandra commit 30d251c35871b0e8aff16d60df3db3d327e34bfa Author: Sandra Loosemore Date: Wed Apr 24 08:53:26 2019 -0700 Fix CVE-2017-9778. GDB was failing to catch cases where a corrupt ELF or core file contained an invalid length value in a Dwarf debug frame FDE header. It was checking for buffer overflow but not cases where the length was negative or caused pointer wrap-around. In addition to the additional validity check, this patch cleans up the multiple signed/unsigned conversions on the length field so that an unsigned representation is used consistently throughout. 2019-04-24 Sandra Loosemore Kang Li PR gdb/21600 * dwarf2-frame.c (read_initial_length): Be consistent about using unsigned representation of length. (decode_frame_entry_1): Likewise. Check for wraparound of end pointer as well as buffer overflow. diff --git a/gdb/ChangeLog b/gdb/ChangeLog index 5c40683..deab585 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,3 +1,13 @@ +2019-04-24 Sandra Loosemore + Kang Li + + PR gdb/21600 + + * dwarf2-frame.c (read_initial_length): Be consistent about using + unsigned representation of length. + (decode_frame_entry_1): Likewise. Check for wraparound of + end pointer as well as buffer overflow. + 2019-04-23 Andrew Burgess * s12z-tdep.c (s12z_unwind_pc): Delete. diff --git a/gdb/dwarf2-frame.c b/gdb/dwarf2-frame.c index e2bf61b..b697afa 100644 --- a/gdb/dwarf2-frame.c +++ b/gdb/dwarf2-frame.c @@ -1487,7 +1487,7 @@ static ULONGEST read_initial_length (bfd *abfd, const gdb_byte *buf, unsigned int *bytes_read_ptr) { - LONGEST result; + ULONGEST result; result = bfd_get_32 (abfd, buf); if (result == 0xffffffff) @@ -1788,7 +1788,7 @@ decode_frame_entry_1 (struct comp_unit *unit, const gdb_byte *start, { struct gdbarch *gdbarch = get_objfile_arch (unit->objfile); const gdb_byte *buf, *end; - LONGEST length; + ULONGEST length; unsigned int bytes_read; int dwarf64_p; ULONGEST cie_id; @@ -1799,15 +1799,15 @@ decode_frame_entry_1 (struct comp_unit *unit, const gdb_byte *start, buf = start; length = read_initial_length (unit->abfd, buf, &bytes_read); buf += bytes_read; - end = buf + length; - - /* Are we still within the section? */ - if (end > unit->dwarf_frame_buffer + unit->dwarf_frame_size) - return NULL; + end = buf + (size_t) length; if (length == 0) return end; + /* Are we still within the section? */ + if (end <= buf || end > unit->dwarf_frame_buffer + unit->dwarf_frame_size) + return NULL; + /* Distinguish between 32 and 64-bit encoded frame info. */ dwarf64_p = (bytes_read == 12);