FEX-Emu/libunwind
1
0
Fork 0
mirror of https://github.com/FEX-Emu/libunwind.git synced 2024-11-30 18:00:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Check that the CIE is within the segment

Browse Source 
Due to a bug in the gold linker[1], the .eh_frame and .eh_frame_hdr
sections contains garbage. When dwarf_extract_proc_info_from_fde tried
to look up the begin of the CIE subsection, it would underflow the
.eh_frame segment, resulting in a crash[2].

This patch avoids that crash by checking whether the CIE pointer is
located after the begin of the .eh_frame section. The variable "base"
was misused in various places as a boolean (decode as .debug_frame or
decode as .eh_frame). These instances have been renamed to
is_debug_frame where applicable.

Tested on Linux x86_64.

 [1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17639
 [2]: http://lists.nongnu.org/archive/html/libunwind-devel/2014-11/msg00009.html

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
This commit is contained in:
Peter Wu 2014-11-25 22:10:33 +01:00 committed by Arun Sharma
parent 6e3254ea6e
commit 68a2910bae
3 changed files with 29 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/dwarf.h
View File

@ -423,8 +423,9 @@ extern int dwarf_extract_proc_info_from_fde (unw_addr_space_t as,
unw_accessors_t *a,
unw_word_t *fde_addr,
unw_proc_info_t *pi,
int need_unwind_info,
unw_word_t base,
int need_unwind_info,
int is_debug_frame,
void *arg);
extern int dwarf_find_save_locs (struct dwarf_cursor *c);
extern int dwarf_create_state_record (struct dwarf_cursor *c,

27
src/dwarf/Gfde.c
View File

@ -45,7 +45,7 @@ is_cie_id (unw_word_t val, int is_debug_frame)
static inline int
parse_cie (unw_addr_space_t as, unw_accessors_t *a, unw_word_t addr,
const unw_proc_info_t *pi, struct dwarf_cie_info *dci,
unw_word_t base, void *arg)
int is_debug_frame, void *arg)
{
uint8_t version, ch, augstr[5], fde_encoding, handler_encoding;
unw_word_t len, cie_end_addr, aug_size;
@ -79,7 +79,7 @@ parse_cie (unw_addr_space_t as, unw_accessors_t *a, unw_word_t addr,
/* the CIE is in the 32-bit DWARF format */
uint32_t cie_id;
/* DWARF says CIE id should be 0xffffffff, but in .eh_frame, it's 0 */
const uint32_t expected_id = (base) ? 0xffffffff : 0;
const uint32_t expected_id = (is_debug_frame) ? 0xffffffff : 0;
len = u32val;
cie_end_addr = addr + len;
@ -97,7 +97,7 @@ parse_cie (unw_addr_space_t as, unw_accessors_t *a, unw_word_t addr,
uint64_t cie_id;
/* DWARF says CIE id should be 0xffffffffffffffff, but in
.eh_frame, it's 0 */
const uint64_t expected_id = (base) ? 0xffffffffffffffffull : 0;
const uint64_t expected_id = (is_debug_frame) ? 0xffffffffffffffffull : 0;
if ((ret = dwarf_readu64 (as, a, &addr, &u64val, arg)) < 0)
return ret;
@ -220,7 +220,8 @@ parse_cie (unw_addr_space_t as, unw_accessors_t *a, unw_word_t addr,
HIDDEN int
dwarf_extract_proc_info_from_fde (unw_addr_space_t as, unw_accessors_t *a,
unw_word_t *addrp, unw_proc_info_t *pi,
int need_unwind_info, unw_word_t base,
unw_word_t base,
int need_unwind_info, int is_debug_frame,
void *arg)
{
unw_word_t fde_end_addr, cie_addr, cie_offset_addr, aug_end_addr = 0;
@ -251,14 +252,18 @@ dwarf_extract_proc_info_from_fde (unw_addr_space_t as, unw_accessors_t *a,
*addrp = fde_end_addr = addr + u32val;
cie_offset_addr = addr;
/* CIE must be within the segment. */
if (cie_offset_addr < base)
return -UNW_ENOINFO;
if ((ret = dwarf_reads32 (as, a, &addr, &cie_offset, arg)) < 0)
return ret;
if (is_cie_id (cie_offset, base != 0))
if (is_cie_id (cie_offset, is_debug_frame))
/* ignore CIEs (happens during linear searches) */
return 0;
if (base != 0)
if (is_debug_frame)
cie_addr = base + cie_offset;
else
/* DWARF says that the CIE_pointer in the FDE is a
@ -279,14 +284,18 @@ dwarf_extract_proc_info_from_fde (unw_addr_space_t as, unw_accessors_t *a,
*addrp = fde_end_addr = addr + u64val;
cie_offset_addr = addr;
/* CIE must be within the segment. */
if (cie_offset_addr < base)
return -UNW_ENOINFO;
if ((ret = dwarf_reads64 (as, a, &addr, &cie_offset, arg)) < 0)
return ret;
if (is_cie_id (cie_offset, base != 0))
if (is_cie_id (cie_offset, is_debug_frame))
/* ignore CIEs (happens during linear searches) */
return 0;
if (base != 0)
if (is_debug_frame)
cie_addr = base + cie_offset;
else
/* DWARF says that the CIE_pointer in the FDE is a
@ -298,7 +307,7 @@ dwarf_extract_proc_info_from_fde (unw_addr_space_t as, unw_accessors_t *a,
Debug (15, "looking for CIE at address %lx\n", (long) cie_addr);
if ((ret = parse_cie (as, a, cie_addr, pi, &dci, base, arg)) < 0)
if ((ret = parse_cie (as, a, cie_addr, pi, &dci, is_debug_frame, arg)) < 0)
return ret;
/* IP-range has same encoding as FDE pointers, except that it's

14
src/dwarf/Gfind_proc_info-lsb.c
View File

@ -59,8 +59,9 @@ linear_search (unw_addr_space_t as, unw_word_t ip,
while (i++ < fde_count && addr < eh_frame_end)
{
fde_addr = addr;
if ((ret = dwarf_extract_proc_info_from_fde (as, a, &addr, pi, 0, 0, arg))
< 0)
if ((ret = dwarf_extract_proc_info_from_fde (as, a, &addr, pi,
eh_frame_start,
0, 0, arg)) < 0)
return ret;
if (ip >= pi->start_ip && ip < pi->end_ip)
@ -69,6 +70,7 @@ linear_search (unw_addr_space_t as, unw_word_t ip,
return 1;
addr = fde_addr;
if ((ret = dwarf_extract_proc_info_from_fde (as, a, &addr, pi,
eh_frame_start,
need_unwind_info, 0,
arg))
< 0)
@ -468,8 +470,8 @@ dwarf_find_debug_frame (int found, unw_dyn_info_t *di_debug, unw_word_t ip,
err = dwarf_extract_proc_info_from_fde (unw_local_addr_space,
a, &fde_addr,
&this_pi, 0,
(uintptr_t) buf,
&this_pi,
(uintptr_t) buf, 0, 1,
NULL);
if (err == 0)
{
@ -902,8 +904,10 @@ dwarf_search_unwind_table (unw_addr_space_t as, unw_word_t ip,
"fde_addr = %lx\n", (long) e->fde_offset, (long) segbase,
(long) debug_frame_base, (long) fde_addr);
if ((ret = dwarf_extract_proc_info_from_fde (as, a, &fde_addr, pi,
debug_frame_base ?
debug_frame_base : segbase,
need_unwind_info,
debug_frame_base, arg)) < 0)
debug_frame_base != 0, arg)) < 0)
return ret;
/* .debug_frame uses an absolute encoding that does not know about any