https://sourceware.org/bugzilla/show_bug.cgi?id=34644
Bug ID: 34644
Summary: libdw: DWARF5 indexed lookups can cross contribution
boundaries
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: libdw
Assignee: unassigned at sourceware dot org
Reporter: karankurani3k at gmail dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
Created attachment 17009
--> https://sourceware.org/bugzilla/attachment.cgi?id=17009&action=edit
Runtime controls and reproducers for cross-contribution .debug_str_offsets and
.debug_addr lookups on 7961c981.
Current main: 7961c9813a9e5f54ce4b7c64697ced742e09a1a9
Several DWARF5 indexed-table paths retain the CU table base but not the
corresponding contribution end, then validate indexes against the complete
section.
I reproduced this independently in two paths:
.debug_str_offsets:
A DW_FORM_strx1 belonging to contribution A can select an offset entry in
adjacent contribution B. Control returns name=A 3/3; the cross-contribution
fixture returns name=B-from-B 3/3.
.debug_addr:
A DW_OP_addrx belonging to contribution A can consume bytes from adjacent
contribution B. Control returns 0x1111111111111111 3/3; the cross-contribution
fixture returns 0x800050000000c 3/3.
ASan/UBSan reported no out-of-bounds dereference in these witnesses.
The common issue is that contribution size/end information is discarded after
resolving the CU base. DWP callers also commonly request only the offset from
dwarf_cu_dwp_section_info(), despite the contribution size being available.
The same base-only model is used by indexed rnglists/loclists consumers.
I have a central fix in progress that retains contribution/table bounds for
indexed DWARF5 lookups.
Reported-by: Karan Kurani <[email protected]>
--
You are receiving this mail because:
You are on the CC list for the bug.
