When the given Dwarf_Die was invalid we might crash and when the offset
was totally bogus we might succeed with a random abbrev.
Signed-off-by: Mark Wielaard <m...@klomp.org>
---
libdw/ChangeLog | 4 ++++
libdw/dwarf_getabbrev.c | 20 +++++++++++++++++---
tests/ChangeLog | 5 +++++
tests/get-units-invalid.c | 6 ++++++
tests/show-abbrev.c | 8 ++++++++
5 files changed, 40 insertions(+), 3 deletions(-)
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 21cb03c..1195cf6 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,5 +1,9 @@
2018-06-08 Mark Wielaard <m...@klomp.org>
+ * dwarf_getabbrev.c (dwarf_getabbrev): Check die and offset.
+
+2018-06-08 Mark Wielaard <m...@klomp.org>
+
* dwarf_get_units.c (dwarf_get_units): Handle existing error, no
dwarf.
diff --git a/libdw/dwarf_getabbrev.c b/libdw/dwarf_getabbrev.c
index 1e113db..988d12c 100644
--- a/libdw/dwarf_getabbrev.c
+++ b/libdw/dwarf_getabbrev.c
@@ -158,7 +158,21 @@ __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu,
Dwarf_Off offset,
Dwarf_Abbrev *
dwarf_getabbrev (Dwarf_Die *die, Dwarf_Off offset, size_t *lengthp)
{
- return __libdw_getabbrev (die->cu->dbg, die->cu,
- die->cu->orig_abbrev_offset + offset, lengthp,
- NULL);
+ if (die == NULL || die->cu == NULL)
+ return NULL;
+
+ Dwarf_CU *cu = die->cu;
+ Dwarf *dbg = cu->dbg;
+ Dwarf_Off abbrev_offset = cu->orig_abbrev_offset;
+ Elf_Data *data = dbg->sectiondata[IDX_debug_abbrev];
+ if (data == NULL)
+ return NULL;
+
+ if (offset >= data->d_size - abbrev_offset)
+ {
+ __libdw_seterrno (DWARF_E_INVALID_OFFSET);
+ return NULL;
+ }
+
+ return __libdw_getabbrev (dbg, cu, abbrev_offset + offset, lengthp, NULL);
}
diff --git a/tests/ChangeLog b/tests/ChangeLog
index 25ed41e..3b69a87 100644
--- a/tests/ChangeLog
+++ b/tests/ChangeLog
@@ -1,5 +1,10 @@
2018-06-08 Mark Wielaard <m...@klomp.org>
+ * get-units-invalid.c (main): Check invalid dwarf_getabbrev call.
+ * show-abbrev.c (main): Check illegal dwarf_getabbrev offset call.
+
+2018-06-08 Mark Wielaard <m...@klomp.org>
+
* varlocs.c (main): Only assert when cfi_debug_bias != 0 if there
actually is a cfi_debug.
diff --git a/tests/get-units-invalid.c b/tests/get-units-invalid.c
index ba0f818..155e12d 100644
--- a/tests/get-units-invalid.c
+++ b/tests/get-units-invalid.c
@@ -98,6 +98,12 @@ main (int argc, char *argv[])
dwarf_diename (&subdie));
return -1;
}
+ if (dwarf_getabbrev (&subdie, 0, NULL) != NULL)
+ {
+ printf ("Should NOT have an abbrev: %s\n",
+ dwarf_diename (&subdie));
+ return -1;
+ }
}
else if (unit_type == DW_UT_type)
printf ("subdie: %s\n", dwarf_diename (&subdie));
diff --git a/tests/show-abbrev.c b/tests/show-abbrev.c
index b0af029..002ae25 100644
--- a/tests/show-abbrev.c
+++ b/tests/show-abbrev.c
@@ -51,6 +51,14 @@ main (int argc, char *argv[])
/* Something went wrong. */
break;
+ /* Test something obviously wrong. */
+ Dwarf_Abbrev *a = dwarf_getabbrev (&die, (Dwarf_Off) -1, NULL);
+ if (a != NULL)
+ {
+ printf ("dwarf_getabbrev -1 succeeded?\n");
+ break;
+ }
+
Dwarf_Off offset = 0;
while (1)
--
1.8.3.1
