openharmony/third_party_elfutils
1
0
Fork 0
mirror of https://github.com/openharmony/third_party_elfutils.git synced 2026-07-19 19:43:34 -04:00
Code Issues Packages Projects Releases Wiki Activity

libdw: Fix overflow in read_encoded_value for the DW_EH_PE_indirect case.

Browse Source 
If we are going to dereference a pointer there should be at least enough
data to hold a pointer. Found by afl-fuzz.

Signed-off-by: Mark Wielaard <mjw@redhat.com>
This commit is contained in:
Mark Wielaard
2015-05-27 14:05:15 +02:00
parent e115bda377
commit 1ae83ee854
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libdw/ChangeLog
+5
View File
@@ -1,3 +1,8 @@
2015-05-27 Mark Wielaard <mjw@redhat.com>
* encoded-value.h (read_encoded_value): Check data d_size contains
at least enough data to hold a pointer for DW_EH_PE_indirect.
2015-05-22 Mark Wielaard <mjw@redhat.com>
* dwarf_getsrclines.c (read_srclines): Limit stack usage of lines
libdw/encoded-value.h
+4 -3
View File
@@ -214,9 +214,10 @@ read_encoded_value (const Dwarf_CFI *cache, uint8_t encoding,
if (unlikely (*result < cache->frame_vaddr))
return true;
*result -= cache->frame_vaddr;
if (unlikely (*result > (cache->data->d.d_size
- encoded_value_size (NULL, cache->e_ident,
DW_EH_PE_absptr, NULL))))
size_t ptrsize = encoded_value_size (NULL, cache->e_ident,
DW_EH_PE_absptr, NULL);
if (unlikely (cache->data->d.d_size < ptrsize
|| *result > (cache->data->d.d_size - ptrsize)))
return true;
const uint8_t *ptr = cache->data->d.d_buf + *result;
if (unlikely (__libdw_cfi_read_address_inc (cache, &ptr, 0, result)