[Bug backends/23529] heap-buffer-overflow in eu-readelf

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=23529

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from Mark Wielaard <mark at klomp dot org> ---
commit 6983e59b727458a6c64d9659c85f08218bc4fcda
Author: Mark Wielaard <mark@klomp.org>
Date:   Sat Aug 18 19:51:27 2018 +0200

    libdw: Check end of attributes list consistently.

    dwarf_child (__libdw_find_attr), dwarf_getabbrevattr[_data] and
    dwarf_getattrs all assume the end of the attribute list is when
    both the name (code) and form of the attribute are zero.

    dwarf_getabbrev (__libdw_getabbrev) and dwarf_hasattr assume the
    end of the attribute list is when either the name (code) or the
    form of the attribute is zero.

    The DWARF spec says: "The series of attribute specifications ends
    with an entry containing 0 for the name and 0 for the form." So
    the first check is correct.

    Make sure dwarf_getabbrev and dwarf_hasattr use the same check.
    This is important since all other functions expect dwarf_getabbrev
    (__libdw_getabbrev) to have done a data sanity check of the attribute.
    So if the ending condition is different it could cause a crash.

    https://sourceware.org/bugzilla/show_bug.cgi?id=23529

    Signed-off-by: Mark Wielaard <mark@klomp.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.