Hi, When we added bounds checking to almost all data reading functions (commit 7a05347 libdw: Add get_uleb128 and get_sleb128 bounds checking) we also added extra checks to the abbrev reading. But since we didn't really have bounds for the "raw" Dwarf_Abbrev reading functions we just "guessed" the maximum of a uleb128. This wasn't really correct and not really needed. A struct Dwarf_Abbrev can only be created by __libdw_getabbrev, which checks the whole abbrev (code, tag, children and attribute names/forms) is valid already. So whenever we use the attrp pointer from the Dwarf_Abbrev to read the name/forms we already know they are in the .debug_abbrev bounds).
[PATCH 1/2] libdw: New get_uleb128_unchecked to use with already checked Dwarf_Abbrev. So the first patch introduces a get_uleb128_unchecked function that is used for re-reading such uleb128 values. The second patch reduces the size of the struct Dwarf_Abbrev by not storing the attrcnt and by using bitfields for has_children and code. [PATCH 2/2] libdw: Reduce size of struct Dwarf_Abbrev. The attrcnt was only used by the dwarf_getattrcnt function. Which is only used in one testcase. And which seems mostly unnecessary for real programs. The function now explicitly counts the attrs instead of using a cached value. The combined patches very slightly reduces the time for parsing abbrevs and make the abbrev cache somewhat smaller. On my machine eu-readelf -N --debug-dump=info libstdc++.so.debug goes down from 1.79 to 1.71 secs. And max rss goes down from 15.296 to 14.684 kbytes. Cheers, Mark