Fix erroneous decoding of LEB128 values.

Resolves: #188716
This commit is contained in:
Nick Clifton 2020-10-21 15:08:45 +01:00
parent 842839bbb1
commit 9051ca66fa
2 changed files with 130 additions and 1 deletions

View File

@ -0,0 +1,121 @@
--- binutils.orig/binutils/dwarf.c 2020-10-21 14:15:47.101351869 +0100
+++ binutils-2.35.1/binutils/dwarf.c 2020-10-21 14:17:44.608585923 +0100
@@ -1868,7 +1868,7 @@ skip_attr_bytes (unsigned long
case DW_FORM_ref_addr:
if (dwarf_version == 2)
SAFE_BYTE_GET_AND_INC (uvalue, data, pointer_size, end);
- else if (dwarf_version == 3 || dwarf_version == 4)
+ else if (dwarf_version > 2)
SAFE_BYTE_GET_AND_INC (uvalue, data, offset_size, end);
else
return NULL;
@@ -1920,6 +1920,7 @@ skip_attr_bytes (unsigned long
case DW_FORM_ref8:
case DW_FORM_data8:
+ case DW_FORM_ref_sig8:
data += 8;
break;
@@ -1934,6 +1935,7 @@ skip_attr_bytes (unsigned long
case DW_FORM_block:
case DW_FORM_exprloc:
READ_ULEB (uvalue, data, end);
+ data += uvalue;
break;
case DW_FORM_block1:
@@ -1951,12 +1953,12 @@ skip_attr_bytes (unsigned long
data += 4 + uvalue;
break;
- case DW_FORM_ref_sig8:
- data += 8;
- break;
-
case DW_FORM_indirect:
- /* FIXME: Handle this form. */
+ READ_ULEB (form, data, end);
+ if (form == DW_FORM_implicit_const)
+ SKIP_ULEB (data, end);
+ return skip_attr_bytes (form, data, end, pointer_size, offset_size, dwarf_version, value_return);
+
default:
return NULL;
}
@@ -1978,7 +1980,7 @@ get_type_signedness (unsigned char *
dwarf_vma offset_size,
int dwarf_version,
bfd_boolean * is_signed,
- bfd_boolean is_nested)
+ unsigned int nesting)
{
unsigned long abbrev_number;
abbrev_entry * entry;
@@ -1997,6 +1999,14 @@ get_type_signedness (unsigned char *
/* FIXME: Issue a warning ? */
return;
+#define MAX_NESTING 20
+ if (nesting > MAX_NESTING)
+ {
+ /* FIXME: Warn - or is this expected ?
+ NB/ We need to avoid infinite recursion. */
+ return;
+ }
+
for (attr = entry->first_attr;
attr != NULL && attr->attribute;
attr = attr->next)
@@ -2019,16 +2029,12 @@ get_type_signedness (unsigned char *
#endif
case DW_AT_type:
/* Recurse. */
- if (is_nested)
- {
- /* FIXME: Warn - or is this expected ?
- NB/ We need to avoid infinite recursion. */
- return;
- }
if (uvalue >= (size_t) (end - start))
return;
- get_type_signedness (start, start + uvalue, end, pointer_size,
- offset_size, dwarf_version, is_signed, TRUE);
+ /* We cannot correctly process DW_FORM_ref_addr at the moment. */
+ if (attr->form != DW_FORM_ref_addr)
+ get_type_signedness (start, start + uvalue, end, pointer_size,
+ offset_size, dwarf_version, is_signed, nesting + 1);
break;
case DW_AT_encoding:
@@ -2206,7 +2212,6 @@ read_and_display_attr_value (unsigned lo
SAFE_BYTE_GET_AND_INC (uvalue, data, offset_size, end);
else
error (_("Internal error: DWARF version is not 2, 3 or 4.\n"));
-
break;
case DW_FORM_addr:
@@ -2246,8 +2251,8 @@ read_and_display_attr_value (unsigned lo
uvalue = svalue;
break;
- case DW_FORM_GNU_str_index:
case DW_FORM_ref_udata:
+ case DW_FORM_GNU_str_index:
case DW_FORM_udata:
case DW_FORM_GNU_addr_index:
READ_ULEB (uvalue, data, end);
@@ -2663,8 +2668,10 @@ read_and_display_attr_value (unsigned lo
{
bfd_boolean is_signed = FALSE;
- get_type_signedness (start, start + uvalue, end, pointer_size,
- offset_size, dwarf_version, & is_signed, FALSE);
+ /* We cannot correctly process DW_FORM_ref_addr at the moment. */
+ if (form != DW_FORM_ref_addr)
+ get_type_signedness (start, start + uvalue, end, pointer_size,
+ offset_size, dwarf_version, & is_signed, 0);
level_type_signed[level] = is_signed;
}
break;

View File

@ -2,7 +2,7 @@
Summary: A GNU collection of binary utilities
Name: %{?cross}binutils%{?_with_debug:-debug}
Version: 2.35.1
Release: 6%{?dist}
Release: 7%{?dist}
License: GPLv3+
URL: https://sourceware.org/binutils
@ -254,6 +254,11 @@ Patch26: binutils-plugin-as-needed.patch
# Lifetime: Fixed in 2.36
Patch27: binutils-recursive-debuglink-following.patch
# Purpose: Fix the DWARF parser to skip DW_FORM_ref_addr types
# when attempting to determine a type's signedness.
# Lifetime: Fixed in 2.36
Patch28: binutils-dwarf-type-sign.patch
#----------------------------------------------------------------------------
Provides: bundled(libiberty)
@ -827,6 +832,9 @@ exit 0
#----------------------------------------------------------------------------
%changelog
* Wed Oct 21 2020 Nick Clifton <nickc@redhat.com> - 2.35.1-7
- Fix erroneous decoding of LEB128 values. (#188716)
* Thu Oct 15 2020 Nick Clifton <nickc@redhat.com> - 2.35.1-6
- Make readelf and objdump recursively follow debug links. (PR 26595)