diff options
| author | Mark Wielaard <mark@klomp.org> | 2018-06-21 00:54:57 +0200 |
|---|---|---|
| committer | Mark Wielaard <mark@klomp.org> | 2018-06-25 16:52:27 +0200 |
| commit | e3b2060bb6a687587500c8d6c74145ef1d320c5c (patch) | |
| tree | c2467298de2a7f4b7e6502cef088691f46afce1f /libdw | |
| parent | dd813335c352adb53972bdc63495650dba0c987f (diff) | |
libdw: Handle bogus CU length in dwarf_nextcu.
The length field could be so big that it would wrap around the next_offset.
We don't really care that length is bogus, but we don't want to use it to
calculate the next offset if it is.
Found by afl-fuzz.
Signed-off-by: Mark Wielaard <mark@klomp.org>
Diffstat (limited to 'libdw')
| -rw-r--r-- | libdw/ChangeLog | 5 | ||||
| -rw-r--r-- | libdw/dwarf_nextcu.c | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/libdw/ChangeLog b/libdw/ChangeLog index 4280c553..11de763f 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,3 +1,8 @@ +2018-06-22 Mark Wielaard <mark@klomp.org> + + * dwarf_nextcu.c (__libdw_next_unit): Set next_off to -1 when it would + wrap around. + 2018-06-18 Mark Wielaard <mark@klomp.org> * dwarf_aggregate_size.c (array_size): New depth argument. Use diff --git a/libdw/dwarf_nextcu.c b/libdw/dwarf_nextcu.c index 4b394f32..be113270 100644 --- a/libdw/dwarf_nextcu.c +++ b/libdw/dwarf_nextcu.c @@ -278,6 +278,11 @@ __libdw_next_unit (Dwarf *dwarf, bool v4_debug_types, Dwarf_Off off, or with offset == 8: 2 * 8 - 4 == 12. */ *next_off = off + 2 * offset_size - 4 + length; + /* This means that the length field is bogus, but return the CU anyway. + We just won't return anything after this. */ + if (*next_off <= off) + *next_off = (Dwarf_Off) -1; + return 0; } |