diff mbox series

libdw: check offset dwarf_formstring in all cases

Message ID 20231116212922.4148717-1-vvvvvv@google.com
State Committed
Headers
Series libdw: check offset dwarf_formstring in all cases |

Commit Message

Aleksei Vetrov Nov. 16, 2023, 9:29 p.m. UTC 
  From: Aleksei Vetrov <vvvvvv@google.com>

This check was initially added to test if offset overflows the safe
prefix where any string will be null-terminated. However the check
was placed in a wrong place and didn't cover all `attrp->form` cases.

    * libdw/dwarf_formstring.c (dwarf_formstring): Move offset check
      right before returning the result.

Signed-off-by: Aleksei Vetrov <vvvvvv@google.com>
---
 libdw/dwarf_formstring.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Mark Wielaard Nov. 17, 2023, 3:31 p.m. UTC | #1 
Hi Aleksei,

On Thu, 2023-11-16 at 21:29 +0000, vvvvvv@google.com wrote:
> This check was initially added to test if offset overflows the safe
> prefix where any string will be null-terminated. However the check
> was placed in a wrong place and didn't cover all `attrp->form` cases.
> 
>     * libdw/dwarf_formstring.c (dwarf_formstring): Move offset check
>       right before returning the result.

Oops. I see how this happened for DW_FORM_strp and DW_FORM_line_strp we
use __libdw_read_offset which already check the section offset. But of
course those use d_size, not the string_section_size that was setup in
elf_begin_elf. So the check is also needed for them.

> Signed-off-by: Aleksei Vetrov <vvvvvv@google.com>
> ---
>  libdw/dwarf_formstring.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libdw/dwarf_formstring.c b/libdw/dwarf_formstring.c
> index 0ee42411..65f03a5e 100644
> --- a/libdw/dwarf_formstring.c
> +++ b/libdw/dwarf_formstring.c
> @@ -173,11 +173,11 @@ dwarf_formstring (Dwarf_Attribute *attrp)
>  	off = read_4ubyte_unaligned (dbg, datap);
>        else
>  	off = read_8ubyte_unaligned (dbg, datap);
> -
> -      if (off >= data_size)
> -	goto invalid_offset;
>      }
>  
> +  if (off >= data_size)
> +    goto invalid_offset;
> +
>    return (const char *) data->d_buf + off;
>  }
>  INTDEF(dwarf_formstring)

Applied.

Thanks,

Mark
diff mbox series

Patch

diff --git a/libdw/dwarf_formstring.c b/libdw/dwarf_formstring.c
index 0ee42411..65f03a5e 100644
--- a/libdw/dwarf_formstring.c
+++ b/libdw/dwarf_formstring.c
@@ -173,11 +173,11 @@  dwarf_formstring (Dwarf_Attribute *attrp)
 	off = read_4ubyte_unaligned (dbg, datap);
       else
 	off = read_8ubyte_unaligned (dbg, datap);
-
-      if (off >= data_size)
-	goto invalid_offset;
     }
 
+  if (off >= data_size)
+    goto invalid_offset;
+
   return (const char *) data->d_buf + off;
 }
 INTDEF(dwarf_formstring)