[PATCH] libdw: Fix crashing on illegal/zero Dwarf_Die.
Mark Wielaard
mark@klomp.org
Fri May 11 10:49:00 GMT 2018
In some cases we create an illegal Dwarf_Die by clearing all fields.
The idea is that dwarf_tag () on such a Dwarf_Die will return
DW_TAG_invalid, to indicate that the Dwarf_Die is unusable (and other
functions will also return errors). But when "reconstructing" the
Dwarf_Die addr we might use the cu before realizing the Dwarf_Die is
invalid. Fix this with an explicit NULL check and add a testcase.
Signed-off-by: Mark Wielaard <mark@klomp.org>
---
libdw/ChangeLog | 6 +++
libdw/dwarf_siblingof.c | 5 ++-
libdw/libdwP.h | 2 +
tests/ChangeLog | 9 ++++
tests/Makefile.am | 10 +++--
tests/get-units-invalid.c | 96 ++++++++++++++++++++++++++++++++++++++++++
tests/run-get-units-invalid.sh | 44 +++++++++++++++++++
7 files changed, 167 insertions(+), 5 deletions(-)
create mode 100644 tests/get-units-invalid.c
create mode 100755 tests/run-get-units-invalid.sh
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 5e2c0d8..86d2b78 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,9 @@
+2018-05-11 Mark Wielaard <mark@klomp.org>
+
+ * dwarf_siblingof.c (dwarf_siblingof): Don't reference cu till it is
+ known the Dwarf_Die is came from is valid.
+ * libdwP.h (__libdw_dieabbrev): Check cu is not NULL.
+
2018-05-08 Mark Wielaard <mark@klomp.org>
* dwarf_formref.c (__libdw_formref): Explicitly don't handle
diff --git a/libdw/dwarf_siblingof.c b/libdw/dwarf_siblingof.c
index df39c1c..613d209 100644
--- a/libdw/dwarf_siblingof.c
+++ b/libdw/dwarf_siblingof.c
@@ -58,8 +58,6 @@ dwarf_siblingof (Dwarf_Die *die, Dwarf_Die *result)
sibattr.cu = this_die.cu;
/* That's the address we start looking. */
unsigned char *addr = this_die.addr;
- /* End of the buffer. */
- unsigned char *endp = sibattr.cu->endp;
/* Search for the beginning of the next die on this level. We
must not return the dies for children of the given die. */
@@ -96,6 +94,8 @@ dwarf_siblingof (Dwarf_Die *die, Dwarf_Die *result)
/* This abbreviation has children. */
++level;
+ /* End of the buffer. */
+ unsigned char *endp = sibattr.cu->endp;
while (1)
{
@@ -125,6 +125,7 @@ dwarf_siblingof (Dwarf_Die *die, Dwarf_Die *result)
while (level > 0);
/* Maybe we reached the end of the CU. */
+ unsigned char *endp = sibattr.cu->endp;
if (addr >= endp)
return 1;
diff --git a/libdw/libdwP.h b/libdw/libdwP.h
index 751206d..7aa290e 100644
--- a/libdw/libdwP.h
+++ b/libdw/libdwP.h
@@ -615,6 +615,8 @@ __libdw_dieabbrev (Dwarf_Die *die, const unsigned char **readp)
/* Get the abbreviation code. */
unsigned int code;
const unsigned char *addr = die->addr;
+ if (die->cu == NULL)
+ return DWARF_END_ABBREV;
get_uleb128 (code, addr, die->cu->endp);
if (readp != NULL)
*readp = addr;
diff --git a/tests/ChangeLog b/tests/ChangeLog
index 8a098b4..b236ee7 100644
--- a/tests/ChangeLog
+++ b/tests/ChangeLog
@@ -1,3 +1,12 @@
+2018-05-11 Mark Wielaard <mark@klomp.org>
+
+ * Makefile.am (check_PROGRAMS): Add get-units-invalid.
+ (TESTS): Add run-get-units-invalid.sh.
+ (EXTRA_DIST): Likewise.
+ (get_units_invalid_LDADD): New variable.
+ * get-units-invalid.c: New test program.
+ * run-get-units-invalid.sh: New test program runner.
+
2018-05-05 Mark Wielaard <mark@klomp.org>
* testfile-dwarf-45.source: New file.
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 2f9ae23..ac16a5e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -55,7 +55,8 @@ check_PROGRAMS = arextract arsymtest newfile saridx scnnames sectiondump \
getsrc_die strptr newdata elfstrtab dwfl-proc-attach \
elfshphehdr elfstrmerge dwelfgnucompressed elfgetchdr \
elfgetzdata elfputzdata zstrptr emptyfile vendorelf \
- fillfile dwarf_default_lower_bound dwarf-die-addr-die
+ fillfile dwarf_default_lower_bound dwarf-die-addr-die \
+ get-units-invalid
asm_TESTS = asm-tst1 asm-tst2 asm-tst3 asm-tst4 asm-tst5 \
asm-tst6 asm-tst7 asm-tst8 asm-tst9
@@ -138,7 +139,8 @@ TESTS = run-arextract.sh run-arsymtest.sh run-ar.sh newfile test-nlist \
run-compress-test.sh \
run-readelf-zdebug.sh run-readelf-zdebug-rel.sh \
emptyfile vendorelf fillfile dwarf_default_lower_bound \
- run-dwarf-die-addr-die.sh
+ run-dwarf-die-addr-die.sh \
+ run-get-units-invalid.sh
if !BIARCH
export ELFUTILS_DISABLE_BIARCH = 1
@@ -358,7 +360,8 @@ EXTRA_DIST = run-arextract.sh run-arsymtest.sh run-ar.sh \
run-disasm-bpf.sh \
testfile-bpf-dis1.expect.bz2 testfile-bpf-dis1.o.bz2 \
testfile-m68k-core.bz2 testfile-m68k.bz2 testfile-m68k-s.bz2 \
- run-dwarf-die-addr-die.sh
+ run-dwarf-die-addr-die.sh \
+ run-get-units-invalid.sh
if USE_VALGRIND
valgrind_cmd='valgrind -q --leak-check=full --error-exitcode=1'
@@ -517,6 +520,7 @@ vendorelf_LDADD = $(libelf)
fillfile_LDADD = $(libelf)
dwarf_default_lower_bound_LDADD = $(libdw)
dwarf_die_addr_die_LDADD = $(libdw)
+get_units_invalid_LDADD = $(libdw)
# We want to test the libelf header against the system elf.h header.
# Don't include any -I CPPFLAGS.
diff --git a/tests/get-units-invalid.c b/tests/get-units-invalid.c
new file mode 100644
index 0000000..9ec16ee
--- /dev/null
+++ b/tests/get-units-invalid.c
@@ -0,0 +1,96 @@
+/* Test cudie and subdie properties.
+ Copyright (C) 2018 Red Hat, Inc.
+ This file is part of elfutils.
+
+ This file is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ elfutils is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>. */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <dwarf.h>
+#include ELFUTILS_HEADER(dw)
+#include <stdio.h>
+#include <inttypes.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+
+int
+main (int argc, char *argv[])
+{
+ for (int i = 1; i < argc; i++)
+ {
+ printf ("file: %s\n", argv[i]);
+ int fd = open (argv[i], O_RDONLY);
+ Dwarf *dbg = dwarf_begin (fd, DWARF_C_READ);
+ if (dbg == NULL)
+ {
+ printf ("%s not usable: %s\n", argv[i], dwarf_errmsg (-1));
+ return -1;
+ }
+
+ Dwarf_CU *cu = NULL;
+ Dwarf_Die cudie, subdie;
+ uint8_t unit_type;
+ while (dwarf_get_units (dbg, cu, &cu, NULL,
+ &unit_type, &cudie, &subdie) == 0)
+ {
+ printf ("Got cudie: %s, unit_type: %" PRIx8 "\n",
+ dwarf_diename (&cudie), unit_type);
+
+ int tag = dwarf_tag (&subdie);
+ if (unit_type == DW_UT_compile)
+ {
+ if (tag != DW_TAG_invalid)
+ {
+ printf ("Not invalid: %x\n", dwarf_tag (&subdie));
+ return -1;
+ }
+ if (dwarf_diename (&subdie) != NULL)
+ {
+ printf ("Should have NULL name: %s\n",
+ dwarf_diename (&subdie));
+ return -1;
+ }
+ Dwarf_Die result;
+ if (dwarf_siblingof (&subdie, &result) != -1)
+ {
+ printf ("Should NOT have a valid sibling: %s\n",
+ dwarf_diename (&result));
+ return -1;
+ }
+ if (dwarf_child (&subdie, &result) != -1)
+ {
+ printf ("Should NOT have a valid child: %s\n",
+ dwarf_diename (&result));
+ return -1;
+ }
+ }
+ else if (unit_type == DW_UT_type)
+ printf ("subdie: %s\n", dwarf_diename (&subdie));
+ else
+ printf ("subdie tag: %x\n", dwarf_tag (&subdie));
+ }
+
+ dwarf_end (dbg);
+ close (fd);
+
+ printf ("\n");
+ }
+
+ return 0;
+}
diff --git a/tests/run-get-units-invalid.sh b/tests/run-get-units-invalid.sh
new file mode 100755
index 0000000..66ef944
--- /dev/null
+++ b/tests/run-get-units-invalid.sh
@@ -0,0 +1,44 @@
+#! /bin/sh
+# Copyright (C) 2018 Red Hat, Inc.
+# This file is part of elfutils.
+#
+# This file is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# elfutils is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+. $srcdir/test-subr.sh
+
+# See run-typeiter.sh
+testfiles testfile-debug-types
+
+testrun ${abs_builddir}/get-units-invalid testfile-debug-types
+
+# see run-readelf-dwz-multi.sh
+testfiles testfile_multi_main testfile_multi.dwz
+
+testrun ${abs_builddir}/get-units-invalid testfile_multi_main
+
+# see tests/run-dwflsyms.sh
+testfiles testfilebazdbgppc64.debug
+
+testrun ${abs_builddir}/get-units-invalid testfilebazdbgppc64.debug
+
+# see tests/testfile-dwarf-45.source
+testfiles testfile-dwarf-4 testfile-dwarf-5
+
+testrun ${abs_builddir}/get-units-invalid testfile-dwarf-4
+testrun ${abs_builddir}/get-units-invalid testfile-dwarf-5
+
+# Self test
+testrun_on_self ${abs_builddir}/get-units-invalid
+
+exit 0
--
1.8.3.1
More information about the Elfutils-devel
mailing list