aboutsummaryrefslogtreecommitdiff
path: root/binutils
diff options
context:
space:
mode:
Diffstat (limited to 'binutils')
-rw-r--r--binutils/ChangeLog13
-rw-r--r--binutils/dwarf.c91
2 files changed, 81 insertions, 23 deletions
diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 86c8555..542d788 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,16 @@
+2014-11-26 Nick Clifton <nickc@redhat.com>
+
+ PR binutils/17512
+ * dwarf.c (display_block): Do nothing if the block starts after
+ the end of the buffer.
+ (read_and_display_attr_value): Add range checks.
+ (struct Frame_Chunk): Make the ncols and ra fields unsigned.
+ (frame_need_space): Test for an ncols of zero.
+ (read_cie): Fail if the augmentation data extends off the end of
+ the buffer.
+ (display_debug_frames): Add checks for read_cie failing. Add
+ range checks.
+
2014-11-25 H.J. Lu <hongjiu.lu@intel.com>
* objdump.c (objdump_print_symname): Replace
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 8213f4d..622fe91 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -861,6 +861,8 @@ display_block (unsigned char *data,
dwarf_vma maxlen;
printf (_(" %s byte block: "), dwarf_vmatoa ("u", length));
+ if (data > end)
+ return (unsigned char *) end;
maxlen = (dwarf_vma) (end - data);
length = length > maxlen ? maxlen : length;
@@ -1654,6 +1656,12 @@ read_and_display_attr_value (unsigned long attribute,
case DW_FORM_exprloc:
uvalue = read_uleb128 (data, & bytes_read, end);
block_start = data + bytes_read;
+ if (block_start >= end)
+ {
+ warn (_("Block ends prematurely\n"));
+ uvalue = 0;
+ block_start = end;
+ }
/* PR 17512: file: 008-103549-0.001:0.1. */
if (block_start + uvalue > end)
{
@@ -1669,6 +1677,12 @@ read_and_display_attr_value (unsigned long attribute,
case DW_FORM_block1:
SAFE_BYTE_GET (uvalue, data, 1, end);
block_start = data + 1;
+ if (block_start >= end)
+ {
+ warn (_("Block ends prematurely\n"));
+ uvalue = 0;
+ block_start = end;
+ }
if (block_start + uvalue > end)
{
warn (_("Corrupt attribute block length: %lx\n"), (long) uvalue);
@@ -1683,6 +1697,12 @@ read_and_display_attr_value (unsigned long attribute,
case DW_FORM_block2:
SAFE_BYTE_GET (uvalue, data, 2, end);
block_start = data + 2;
+ if (block_start >= end)
+ {
+ warn (_("Block ends prematurely\n"));
+ uvalue = 0;
+ block_start = end;
+ }
if (block_start + uvalue > end)
{
warn (_("Corrupt attribute block length: %lx\n"), (long) uvalue);
@@ -1697,6 +1717,13 @@ read_and_display_attr_value (unsigned long attribute,
case DW_FORM_block4:
SAFE_BYTE_GET (uvalue, data, 4, end);
block_start = data + 4;
+ /* PR 17512: file: 3371-3907-0.004. */
+ if (block_start >= end)
+ {
+ warn (_("Block ends prematurely\n"));
+ uvalue = 0;
+ block_start = end;
+ }
if (block_start + uvalue > end)
{
warn (_("Corrupt attribute block length: %lx\n"), (long) uvalue);
@@ -5080,7 +5107,7 @@ typedef struct Frame_Chunk
{
struct Frame_Chunk *next;
unsigned char *chunk_start;
- int ncols;
+ unsigned int ncols;
/* DW_CFA_{undefined,same_value,offset,register,unreferenced} */
short int *col_type;
int *col_offset;
@@ -5091,7 +5118,7 @@ typedef struct Frame_Chunk
dwarf_vma pc_range;
int cfa_reg;
int cfa_offset;
- int ra;
+ unsigned int ra;
unsigned char fde_encoding;
unsigned char cfa_exp;
unsigned char ptr_size;
@@ -5106,13 +5133,13 @@ static unsigned int dwarf_regnames_count;
in the frame info. */
#define DW_CFA_unreferenced (-1)
-/* Return 0 if not more space is needed, 1 if more space is needed,
+/* Return 0 if no more space is needed, 1 if more space is needed,
-1 for invalid reg. */
static int
frame_need_space (Frame_Chunk *fc, unsigned int reg)
{
- int prev = fc->ncols;
+ unsigned int prev = fc->ncols;
if (reg < (unsigned int) fc->ncols)
return 0;
@@ -5122,6 +5149,11 @@ frame_need_space (Frame_Chunk *fc, unsigned int reg)
return -1;
fc->ncols = reg + 1;
+ /* PR 17512: file: 10450-2643-0.004.
+ If reg == -1 then this can happen... */
+ if (fc->ncols == 0)
+ return -1;
+
fc->col_type = (short int *) xcrealloc (fc->col_type, fc->ncols,
sizeof (short int));
fc->col_offset = (int *) xcrealloc (fc->col_offset, fc->ncols, sizeof (int));
@@ -5280,9 +5312,9 @@ regname (unsigned int regno, int row)
}
static void
-frame_display_row (Frame_Chunk *fc, int *need_col_headers, int *max_regs)
+frame_display_row (Frame_Chunk *fc, int *need_col_headers, unsigned int *max_regs)
{
- int r;
+ unsigned int r;
char tmp[100];
if (*max_regs < fc->ncols)
@@ -5422,6 +5454,12 @@ read_cie (unsigned char *start, unsigned char *end,
augmentation_data_len = LEB ();
augmentation_data = start;
start += augmentation_data_len;
+ /* PR 17512: file: 11042-2589-0.004. */
+ if (start > end)
+ {
+ warn (_("Augmentation data too long: 0x%lx"), augmentation_data_len);
+ return end;
+ }
}
if (augmentation_data_len)
@@ -5430,7 +5468,7 @@ read_cie (unsigned char *start, unsigned char *end,
p = (unsigned char *) fc->augmentation + 1;
q = augmentation_data;
- while (1)
+ while (p < end && q < augmentation_data + augmentation_data_len)
{
if (*p == 'L')
q++;
@@ -5469,7 +5507,7 @@ display_debug_frames (struct dwarf_section *section,
Frame_Chunk *rs;
int is_eh = strcmp (section->name, ".eh_frame") == 0;
unsigned int length_return;
- int max_regs = 0;
+ unsigned int max_regs = 0;
const char *bad_reg = _("bad register: ");
int saved_eh_addr_size = eh_addr_size;
@@ -5534,18 +5572,19 @@ display_debug_frames (struct dwarf_section *section,
|| (offset_size == 8 && cie_id == DW64_CIE_ID)))
{
int version;
- int mreg;
+ unsigned int mreg;
start = read_cie (start, end, &cie, &version,
&augmentation_data_len, &augmentation_data);
/* PR 17512: file: 027-135133-0.005. */
if (cie == NULL)
break;
+
fc = cie;
fc->next = chunks;
chunks = fc;
fc->chunk_start = saved_start;
- mreg = max_regs - 1;
+ mreg = max_regs > 0 ? max_regs - 1 : 0;
if (mreg < fc->ra)
mreg = fc->ra;
frame_need_space (fc, mreg);
@@ -5578,8 +5617,11 @@ display_debug_frames (struct dwarf_section *section,
if (augmentation_data_len)
{
unsigned long i;
+
printf (" Augmentation data: ");
for (i = 0; i < augmentation_data_len; ++i)
+ /* FIXME: If do_wide is FALSE, then we should
+ add carriage returns at 80 columns... */
printf (" %02x", augmentation_data[i]);
putchar ('\n');
}
@@ -5635,14 +5677,20 @@ display_debug_frames (struct dwarf_section *section,
|| (off_size == 8 && c_id == DW64_CIE_ID)))
{
int version;
- int mreg;
+ unsigned int mreg;
read_cie (cie_scan, end, &cie, &version,
&augmentation_data_len, &augmentation_data);
+ /* PR 17512: file: 3450-2098-0.004. */
+ if (cie == NULL)
+ {
+ warn (_("Failed to read CIE information\n"));
+ break;
+ }
cie->next = forward_refs;
forward_refs = cie;
cie->chunk_start = look_for;
- mreg = max_regs - 1;
+ mreg = max_regs > 0 ? max_regs - 1 : 0;
if (mreg < cie->ra)
mreg = cie->ra;
frame_need_space (cie, mreg);
@@ -5665,7 +5713,7 @@ display_debug_frames (struct dwarf_section *section,
fc->ncols = 0;
fc->col_type = (short int *) xmalloc (sizeof (short int));
fc->col_offset = (int *) xmalloc (sizeof (int));
- frame_need_space (fc, max_regs - 1);
+ frame_need_space (fc, max_regs > 0 ? max_regs - 1 : 0);
cie = fc;
fc->augmentation = "";
fc->fde_encoding = 0;
@@ -5688,7 +5736,7 @@ display_debug_frames (struct dwarf_section *section,
fc->cfa_reg = cie->cfa_reg;
fc->cfa_offset = cie->cfa_offset;
fc->ra = cie->ra;
- frame_need_space (fc, max_regs - 1);
+ frame_need_space (fc, max_regs > 0 ? max_regs - 1: 0);
fc->fde_encoding = cie->fde_encoding;
}
@@ -6167,10 +6215,9 @@ display_debug_frames (struct dwarf_section *section,
case DW_CFA_def_cfa_expression:
ul = LEB ();
- if (start >= block_end)
+ if (start >= block_end || start + ul > block_end)
{
- printf (" DW_CFA_def_cfa_expression: <corrupt>\n");
- warn (_("Corrupt length field in DW_CFA_def_cfa_expression\n"));
+ printf (_(" DW_CFA_def_cfa_expression: <corrupt len %lu>\n"), ul);
break;
}
if (! do_debug_frames_interp)
@@ -6190,10 +6237,9 @@ display_debug_frames (struct dwarf_section *section,
if (reg >= (unsigned int) fc->ncols)
reg_prefix = bad_reg;
/* PR 17512: file: 069-133014-0.006. */
- if (start >= block_end)
+ if (start >= block_end || start + ul > block_end)
{
- printf (" DW_CFA_expression: <corrupt>\n");
- warn (_("Corrupt length field in DW_CFA_expression\n"));
+ printf (_(" DW_CFA_expression: <corrupt len %lu>\n"), ul);
break;
}
if (! do_debug_frames_interp || *reg_prefix != '\0')
@@ -6214,10 +6260,9 @@ display_debug_frames (struct dwarf_section *section,
ul = LEB ();
if (reg >= (unsigned int) fc->ncols)
reg_prefix = bad_reg;
- if (start >= block_end)
+ if (start >= block_end || start + ul > block_end)
{
- printf (" DW_CFA_val_expression: <corrupt>\n");
- warn (_("Corrupt length field in DW_CFA_val_expression\n"));
+ printf (" DW_CFA_val_expression: <corrupt len %lu>\n", ul);
break;
}
if (! do_debug_frames_interp || *reg_prefix != '\0')
generated by cgit v1.1 at 2024-11-25 08:24:22 +0000