OpenE2K
/
binutils-gdb
12
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Detect invalid length field in debug frame FDE header. 

GDB was failing to catch cases where a corrupt ELF or core file
contained an invalid length value in a Dwarf debug frame FDE header.
It was checking for buffer overflow but not cases where the length was
negative or caused pointer wrap-around.

In addition to the additional validity check, this patch cleans up the
multiple signed/unsigned conversions on the length field so that an
unsigned representation is used consistently throughout.

This patch fixes CVE-2017-9778 and PR gdb/21600.

2019-04-25  Sandra Loosemore  <sandra@codesourcery.com>
	    Kang Li <kanglictf@gmail.com>

	PR gdb/21600

	* dwarf2-frame.c (read_initial_length): Be consistent about using
	unsigned representation of length.
	(decode_frame_entry_1): Likewise.  Check for wraparound of
	end pointer as well as buffer overflow.
This commit is contained in:
Sandra Loosemore 2019-04-25 07:27:02 -07:00
parent 68bb0359ee
commit 723adb650a
2 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
gdb/ChangeLog
View File

@ -1,3 +1,13 @@
2019-04-25 Sandra Loosemore <sandra@codesourcery.com>
Kang Li <kanglictf@gmail.com>
PR gdb/21600
* dwarf2-frame.c (read_initial_length): Be consistent about using
unsigned representation of length.
(decode_frame_entry_1): Likewise. Check for wraparound of
end pointer as well as buffer overflow.
2019-04-24 Sergio Durigan Junior <sergiodj@redhat.com>
* aarch64-tdep.c (aarch64_gdbarch_init): Use "pulongest" to print

14
gdb/dwarf2-frame.c
View File

@ -1487,7 +1487,7 @@ static ULONGEST
read_initial_length (bfd *abfd, const gdb_byte *buf,
unsigned int *bytes_read_ptr)
{
LONGEST result;
ULONGEST result;
result = bfd_get_32 (abfd, buf);
if (result == 0xffffffff)
@ -1788,7 +1788,7 @@ decode_frame_entry_1 (struct comp_unit *unit, const gdb_byte *start,
{
struct gdbarch *gdbarch = get_objfile_arch (unit->objfile);
const gdb_byte *buf, *end;
LONGEST length;
ULONGEST length;
unsigned int bytes_read;
int dwarf64_p;
ULONGEST cie_id;
@ -1799,15 +1799,15 @@ decode_frame_entry_1 (struct comp_unit *unit, const gdb_byte *start,
buf = start;
length = read_initial_length (unit->abfd, buf, &bytes_read);
buf += bytes_read;
end = buf + length;
/* Are we still within the section? */
if (end > unit->dwarf_frame_buffer + unit->dwarf_frame_size)
return NULL;
end = buf + (size_t) length;
if (length == 0)
return end;
/* Are we still within the section? */
if (end <= buf || end > unit->dwarf_frame_buffer + unit->dwarf_frame_size)
return NULL;
/* Distinguish between 32 and 64-bit encoded frame info. */
dwarf64_p = (bytes_read == 12);