This is the mail archive of the
elfutils-devel@sourceware.org
mailing list for the elfutils project.
[Bug libdw/24140] A Heap-buffer-overflow problem was discovered in the function __libdw_next_unit in dwarf_nextcu.c in libdw
- From: "mark at klomp dot org" <sourceware-bugzilla at sourceware dot org>
- To: elfutils-devel at sourceware dot org
- Date: Fri, 01 Feb 2019 13:10:35 +0000
- Subject: [Bug libdw/24140] A Heap-buffer-overflow problem was discovered in the function __libdw_next_unit in dwarf_nextcu.c in libdw
- Auto-submitted: auto-generated
- References: <bug-24140-10460@http.sourceware.org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=24140
Mark Wielaard <mark at klomp dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
CC| |mark at klomp dot org
Resolution|--- |FIXED
--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
Replicated under valgrind:
$ valgrind -q eu-nm -C ./POC.unit
src/nm: ./POC.unit: entry size in section 2 `.debug_info' is not what we expect
==15242== Invalid read of size 8
==15242== at 0x4850940: __libdw_next_unit (dwarf_nextcu.c:168)
==15242== by 0x4850C24: dwarf_next_unit (dwarf_nextcu.c:46)
==15242== by 0x4850C24: dwarf_nextcu (dwarf_nextcu.c:294)
==15242== by 0x10E73B: get_local_names (nm.c:627)
==15242== by 0x10E73B: show_symbols (nm.c:1285)
==15242== by 0x10FCEA: handle_elf (nm.c:1578)
==15242== by 0x110482: process_file (nm.c:374)
==15242== by 0x10D70D: main (nm.c:249)
==15242== Address 0x525481a is 26 bytes inside a block of size 32 alloc'd
==15242== at 0x483577F: malloc (vg_replace_malloc.c:299)
==15242== by 0x48A0358: convert_data (elf_getdata.c:157)
==15242== by 0x48A0358: __libelf_set_data_list_rdlock (elf_getdata.c:447)
==15242== by 0x48A0547: __elf_getdata_rdlock (elf_getdata.c:554)
==15242== by 0x484EFB0: check_section (dwarf_begin_elf.c:167)
==15242== by 0x484F522: global_read (dwarf_begin_elf.c:310)
==15242== by 0x484F522: dwarf_begin_elf (dwarf_begin_elf.c:445)
==15242== by 0x10E690: show_symbols (nm.c:1243)
==15242== by 0x10FCEA: handle_elf (nm.c:1578)
==15242== by 0x110482: process_file (nm.c:374)
==15242== by 0x10D70D: main (nm.c:249)
==15242==
==15242== Invalid read of size 2
==15242== at 0x485094B: __libdw_next_unit (dwarf_nextcu.c:168)
==15242== by 0x4850C24: dwarf_next_unit (dwarf_nextcu.c:46)
==15242== by 0x4850C24: dwarf_nextcu (dwarf_nextcu.c:294)
==15242== by 0x10E73B: get_local_names (nm.c:627)
==15242== by 0x10E73B: show_symbols (nm.c:1285)
==15242== by 0x10FCEA: handle_elf (nm.c:1578)
==15242== by 0x110482: process_file (nm.c:374)
==15242== by 0x10D70D: main (nm.c:249)
==15242== Address 0x5254822 is 2 bytes after a block of size 32 alloc'd
==15242== at 0x483577F: malloc (vg_replace_malloc.c:299)
==15242== by 0x48A0358: convert_data (elf_getdata.c:157)
==15242== by 0x48A0358: __libelf_set_data_list_rdlock (elf_getdata.c:447)
==15242== by 0x48A0547: __elf_getdata_rdlock (elf_getdata.c:554)
==15242== by 0x484EFB0: check_section (dwarf_begin_elf.c:167)
==15242== by 0x484F522: global_read (dwarf_begin_elf.c:310)
==15242== by 0x484F522: dwarf_begin_elf (dwarf_begin_elf.c:445)
==15242== by 0x10E690: show_symbols (nm.c:1243)
==15242== by 0x10FCEA: handle_elf (nm.c:1578)
==15242== by 0x110482: process_file (nm.c:374)
==15242== by 0x10D70D: main (nm.c:249)
==15242==
We do check we can read the initial unit lenght (4 bytes), but then fail to
check if we can read any extended length for a DWARF64 unit. We also fail to
check whether we can read the actual version or (DWARF5) unit type. After we
know the version and unit type we do sanity check the full header length (we
cannot really know before reading those three fields at least).
Fixed by:
commit e8f8dc465a1fa496aa627a330886c0f70f98d4c0
Author: Mark Wielaard <mark@klomp.org>
Date: Fri Feb 1 14:03:38 2019 +0100
libdw: Check there is enough space for CU 64bit length, version and type.
We only checked we could read the initial length and after knowing the
version and type whether the unit header was the right size. Also check
there are at least enough bytes to read the 64bit length, version and
unit type bytes.
https://sourceware.org/bugzilla/show_bug.cgi?id=24140
Signed-off-by: Mark Wielaard <mark@klomp.org>
--
You are receiving this mail because:
You are on the CC list for the bug.