0014-CVE-2022-38128-2.patch 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536
  1. From 175b91507b83ad42607d2f6dadaf55b7b511bdbe Mon Sep 17 00:00:00 2001
  2. From: Alan Modra <amodra@gmail.com>
  3. Date: Wed, 20 Jul 2022 18:28:50 +0930
  4. Subject: [PATCH] miscellaneous dwarf.c tidies
  5. * dwarf.c: Leading and trailing whitespace fixes.
  6. (free_abbrev_list): New function.
  7. (free_all_abbrevs): Use the above. Free cu_abbrev_map here too.
  8. (process_abbrev_set): Print actual section name on error.
  9. (get_type_abbrev_from_form): Add overflow check.
  10. (free_debug_memory): Don't free cu_abbrev_map here..
  11. (process_debug_info): ..or here. Warn on another case of not
  12. finding a neeeded abbrev.
  13. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=175b91507b83ad42607d2f6dadaf55b7b511bdbe]
  14. Signed-off-by: Pgowda <pgowda.cve@gmail.com>
  15. ---
  16. binutils/dwarf.c | 216 +++++++++++++++++++++++------------------------
  17. 1 file changed, 106 insertions(+), 110 deletions(-)
  18. diff --git a/binutils/dwarf.c b/binutils/dwarf.c
  19. index 2b1eec49422..267ed3bb382 100644
  20. --- a/binutils/dwarf.c
  21. +++ b/binutils/dwarf.c
  22. @@ -806,7 +806,7 @@ fetch_indexed_value (dwarf_vma idx,
  23. pointer_size = 4;
  24. bias = 12;
  25. }
  26. -
  27. +
  28. dwarf_vma offset = idx * pointer_size;
  29. /* Offsets are biased by the size of the section header
  30. @@ -908,38 +908,41 @@ record_abbrev_list_for_cu (dwarf_vma sta
  31. next_free_abbrev_map_entry ++;
  32. }
  33. -static void
  34. -free_all_abbrevs (void)
  35. +static abbrev_list *
  36. +free_abbrev_list (abbrev_list *list)
  37. {
  38. - abbrev_list * list;
  39. + abbrev_entry *abbrv = list->first_abbrev;
  40. - for (list = abbrev_lists; list != NULL;)
  41. + while (abbrv)
  42. {
  43. - abbrev_list * next = list->next;
  44. - abbrev_entry * abbrv;
  45. + abbrev_attr *attr = abbrv->first_attr;
  46. - for (abbrv = list->first_abbrev; abbrv != NULL;)
  47. + while (attr)
  48. {
  49. - abbrev_entry * next_abbrev = abbrv->next;
  50. - abbrev_attr * attr;
  51. -
  52. - for (attr = abbrv->first_attr; attr;)
  53. - {
  54. - abbrev_attr *next_attr = attr->next;
  55. -
  56. - free (attr);
  57. - attr = next_attr;
  58. - }
  59. -
  60. - free (abbrv);
  61. - abbrv = next_abbrev;
  62. + abbrev_attr *next_attr = attr->next;
  63. + free (attr);
  64. + attr = next_attr;
  65. }
  66. - free (list);
  67. - list = next;
  68. + abbrev_entry *next_abbrev = abbrv->next;
  69. + free (abbrv);
  70. + abbrv = next_abbrev;
  71. }
  72. - abbrev_lists = NULL;
  73. + abbrev_list *next = list->next;
  74. + free (list);
  75. + return next;
  76. +}
  77. +
  78. +static void
  79. +free_all_abbrevs (void)
  80. +{
  81. + while (abbrev_lists)
  82. + abbrev_lists = free_abbrev_list (abbrev_lists);
  83. +
  84. + free (cu_abbrev_map);
  85. + cu_abbrev_map = NULL;
  86. + next_free_abbrev_map_entry = 0;
  87. }
  88. static abbrev_list *
  89. @@ -971,7 +974,7 @@ find_abbrev_map_by_offset (dwarf_vma off
  90. && cu_abbrev_map[i].end > offset)
  91. return cu_abbrev_map + i;
  92. - return NULL;
  93. + return NULL;
  94. }
  95. static void
  96. @@ -1094,7 +1097,7 @@ process_abbrev_set (struct dwarf_section
  97. }
  98. /* Report the missing single zero which ends the section. */
  99. - error (_(".debug_abbrev section not zero terminated\n"));
  100. + error (_("%s section not zero terminated\n"), section->name);
  101. free (list);
  102. return NULL;
  103. @@ -1875,7 +1878,7 @@ fetch_alt_indirect_string (dwarf_vma off
  104. dwarf_vmatoa ("x", offset));
  105. return _("<offset is too big>");
  106. }
  107. -
  108. +
  109. static const char *
  110. get_AT_name (unsigned long attribute)
  111. {
  112. @@ -2157,7 +2160,8 @@ get_type_abbrev_from_form (unsigned long
  113. case DW_FORM_ref4:
  114. case DW_FORM_ref8:
  115. case DW_FORM_ref_udata:
  116. - if (uvalue + cu_offset > (size_t) (cu_end - section->start))
  117. + if (uvalue + cu_offset < uvalue
  118. + || uvalue + cu_offset > (size_t) (cu_end - section->start))
  119. {
  120. warn (_("Unable to resolve ref form: uvalue %lx + cu_offset %lx > CU size %lx\n"),
  121. uvalue, (long) cu_offset, (long) (cu_end - section->start));
  122. @@ -2194,7 +2198,7 @@ get_type_abbrev_from_form (unsigned long
  123. else
  124. *map_return = NULL;
  125. }
  126. -
  127. +
  128. READ_ULEB (abbrev_number, data, section->start + section->size);
  129. for (entry = map->list->first_abbrev; entry != NULL; entry = entry->next)
  130. @@ -2783,10 +2787,10 @@ read_and_display_attr_value (unsigned lo
  131. if (form == DW_FORM_loclistx)
  132. {
  133. if (dwo)
  134. - {
  135. - index = fetch_indexed_value (uvalue, loclists_dwo, 0);
  136. - index += (offset_size == 8) ? 20 : 12;
  137. - }
  138. + {
  139. + index = fetch_indexed_value (uvalue, loclists_dwo, 0);
  140. + index += (offset_size == 8) ? 20 : 12;
  141. + }
  142. else if (debug_info_p == NULL)
  143. {
  144. index = fetch_indexed_value (uvalue, loclists, 0);
  145. @@ -2804,21 +2808,21 @@ read_and_display_attr_value (unsigned lo
  146. else if (form == DW_FORM_rnglistx)
  147. {
  148. if (dwo)
  149. - {
  150. - index = fetch_indexed_value (uvalue, rnglists_dwo, 0);
  151. - index += (offset_size == 8) ? 20 : 12;
  152. - }
  153. + {
  154. + index = fetch_indexed_value (uvalue, rnglists_dwo, 0);
  155. + index += (offset_size == 8) ? 20 : 12;
  156. + }
  157. else
  158. - {
  159. - if (debug_info_p == NULL)
  160. - base = 0;
  161. - else
  162. - base = debug_info_p->rnglists_base;
  163. - /* We do not have a cached value this time, so we perform the
  164. - computation manually. */
  165. - index = fetch_indexed_value (uvalue, rnglists, base);
  166. - index += base;
  167. - }
  168. + {
  169. + if (debug_info_p == NULL)
  170. + base = 0;
  171. + else
  172. + base = debug_info_p->rnglists_base;
  173. + /* We do not have a cached value this time, so we perform the
  174. + computation manually. */
  175. + index = fetch_indexed_value (uvalue, rnglists, base);
  176. + index += base;
  177. + }
  178. }
  179. else
  180. {
  181. @@ -2844,7 +2848,7 @@ read_and_display_attr_value (unsigned lo
  182. if (!do_loc)
  183. printf ("%c<0x%s>", delimiter, dwarf_vmatoa ("x", uvalue + cu_offset));
  184. break;
  185. -
  186. +
  187. default:
  188. warn (_("Unrecognized form: 0x%lx\n"), form);
  189. /* What to do? Consume a byte maybe? */
  190. @@ -2869,9 +2873,9 @@ read_and_display_attr_value (unsigned lo
  191. case DW_AT_rnglists_base:
  192. if (debug_info_p->rnglists_base)
  193. warn (_("CU @ 0x%s has multiple rnglists_base values (0x%s and 0x%s)"),
  194. - dwarf_vmatoa ("x", debug_info_p->cu_offset),
  195. - dwarf_vmatoa ("x", debug_info_p->rnglists_base),
  196. - dwarf_vmatoa ("x", uvalue));
  197. + dwarf_vmatoa ("x", debug_info_p->cu_offset),
  198. + dwarf_vmatoa ("x", debug_info_p->rnglists_base),
  199. + dwarf_vmatoa ("x", uvalue));
  200. debug_info_p->rnglists_base = uvalue;
  201. break;
  202. case DW_AT_str_offsets_base:
  203. @@ -3021,7 +3025,7 @@ read_and_display_attr_value (unsigned lo
  204. case DW_FORM_strx3:
  205. case DW_FORM_strx4:
  206. add_dwo_name (fetch_indexed_string (uvalue, this_set, offset_size, false,
  207. - debug_info_p->str_offsets_base),
  208. + debug_info_p->str_offsets_base),
  209. cu_offset);
  210. break;
  211. case DW_FORM_string:
  212. @@ -3055,7 +3059,7 @@ read_and_display_attr_value (unsigned lo
  213. case DW_FORM_strx3:
  214. case DW_FORM_strx4:
  215. add_dwo_dir (fetch_indexed_string (uvalue, this_set, offset_size, false,
  216. - debug_info_p->str_offsets_base),
  217. + debug_info_p->str_offsets_base),
  218. cu_offset);
  219. break;
  220. case DW_FORM_string:
  221. @@ -3686,11 +3690,8 @@ process_debug_info (struct dwarf_section
  222. introduce (section, false);
  223. free_all_abbrevs ();
  224. - free (cu_abbrev_map);
  225. - cu_abbrev_map = NULL;
  226. - next_free_abbrev_map_entry = 0;
  227. - /* In order to be able to resolve DW_FORM_ref_attr forms we need
  228. + /* In order to be able to resolve DW_FORM_ref_addr forms we need
  229. to load *all* of the abbrevs for all CUs in this .debug_info
  230. section. This does effectively mean that we (partially) read
  231. every CU header twice. */
  232. @@ -4045,12 +4046,11 @@ process_debug_info (struct dwarf_section
  233. /* Scan through the abbreviation list until we reach the
  234. correct entry. */
  235. - if (list == NULL)
  236. - continue;
  237. -
  238. - for (entry = list->first_abbrev; entry != NULL; entry = entry->next)
  239. - if (entry->number == abbrev_number)
  240. - break;
  241. + entry = NULL;
  242. + if (list != NULL)
  243. + for (entry = list->first_abbrev; entry != NULL; entry = entry->next)
  244. + if (entry->number == abbrev_number)
  245. + break;
  246. if (entry == NULL)
  247. {
  248. @@ -4074,7 +4074,7 @@ process_debug_info (struct dwarf_section
  249. break;
  250. case DW_TAG_compile_unit:
  251. case DW_TAG_skeleton_unit:
  252. - need_base_address = 1;
  253. + need_base_address = 1;
  254. need_dwo_info = do_loc;
  255. break;
  256. case DW_TAG_entry_point:
  257. @@ -4459,7 +4459,7 @@ display_debug_sup (struct dwarf_section
  258. SAFE_BYTE_GET_AND_INC (is_supplementary, start, 1, end);
  259. if (is_supplementary != 0 && is_supplementary != 1)
  260. - warn (_("corrupt .debug_sup section: is_supplementary not 0 or 1\n"));
  261. + warn (_("corrupt .debug_sup section: is_supplementary not 0 or 1\n"));
  262. sup_filename = start;
  263. if (is_supplementary && sup_filename[0] != 0)
  264. @@ -5638,7 +5638,7 @@ display_debug_lines_decoded (struct dwar
  265. printf ("%s %11d %#18" DWARF_VMA_FMT "x",
  266. newFileName, state_machine_regs.line,
  267. state_machine_regs.address);
  268. - }
  269. + }
  270. else
  271. {
  272. if (xop == -DW_LNE_end_sequence)
  273. @@ -6092,7 +6092,7 @@ display_debug_macro (struct dwarf_sectio
  274. load_debug_section_with_follow (str, file);
  275. load_debug_section_with_follow (line, file);
  276. load_debug_section_with_follow (str_index, file);
  277. -
  278. +
  279. introduce (section, false);
  280. while (curr < end)
  281. @@ -6537,7 +6537,7 @@ display_loc_list (struct dwarf_section *
  282. /* Check base address specifiers. */
  283. if (is_max_address (begin, pointer_size)
  284. - && !is_max_address (end, pointer_size))
  285. + && !is_max_address (end, pointer_size))
  286. {
  287. base_address = end;
  288. print_dwarf_vma (begin, pointer_size);
  289. @@ -6715,7 +6715,7 @@ display_loclists_list (struct dwarf_sect
  290. case DW_LLE_default_location:
  291. begin = end = 0;
  292. break;
  293. -
  294. +
  295. case DW_LLE_offset_pair:
  296. READ_ULEB (begin, start, section_end);
  297. begin += base_address;
  298. @@ -7011,7 +7011,7 @@ display_offset_entry_loclists (struct dw
  299. unsigned char * start = section->start;
  300. unsigned char * const end = start + section->size;
  301. - introduce (section, false);
  302. + introduce (section, false);
  303. do
  304. {
  305. @@ -7060,14 +7060,14 @@ display_offset_entry_loclists (struct dw
  306. section->name, segment_selector_size);
  307. return 0;
  308. }
  309. -
  310. +
  311. if (offset_entry_count == 0)
  312. {
  313. warn (_("The %s section contains a table without offset\n"),
  314. section->name);
  315. return 0;
  316. }
  317. -
  318. +
  319. printf (_("\n Offset Entries starting at 0x%lx:\n"),
  320. (long)(start - section->start));
  321. @@ -8229,7 +8229,7 @@ display_debug_rnglists (struct dwarf_sec
  322. start = display_debug_rnglists_list
  323. (start, end, address_size, offset, 0, offset_size);
  324. if (start >= end)
  325. - break;
  326. + break;
  327. }
  328. start = end;
  329. @@ -8347,12 +8347,12 @@ display_debug_ranges (struct dwarf_secti
  330. next = section_begin + offset + debug_info_p->rnglists_base;
  331. /* If multiple DWARF entities reference the same range then we will
  332. - have multiple entries in the `range_entries' list for the same
  333. - offset. Thanks to the sort above these will all be consecutive in
  334. - the `range_entries' list, so we can easily ignore duplicates
  335. - here. */
  336. + have multiple entries in the `range_entries' list for the same
  337. + offset. Thanks to the sort above these will all be consecutive in
  338. + the `range_entries' list, so we can easily ignore duplicates
  339. + here. */
  340. if (i > 0 && last_offset == offset)
  341. - continue;
  342. + continue;
  343. last_offset = offset;
  344. if (dwarf_check != 0 && i > 0)
  345. @@ -10286,7 +10286,7 @@ display_debug_names (struct dwarf_sectio
  346. printf (_("Out of %lu items there are %zu bucket clashes"
  347. " (longest of %zu entries).\n"),
  348. (unsigned long) name_count, hash_clash_count, longest_clash);
  349. -
  350. +
  351. if (name_count != buckets_filled + hash_clash_count)
  352. warn (_("The name_count (%lu) is not the same as the used bucket_count (%lu) + the hash clash count (%lu)"),
  353. (unsigned long) name_count,
  354. @@ -10390,7 +10390,7 @@ display_debug_names (struct dwarf_sectio
  355. break;
  356. if (tagno >= 0)
  357. printf ("%s<%lu>",
  358. - (tagno == 0 && second_abbrev_tag == 0 ? " " : "\n\t"),
  359. + (tagno == 0 && second_abbrev_tag == 0 ? " " : "\n\t"),
  360. (unsigned long) abbrev_tag);
  361. for (entry = abbrev_lookup;
  362. @@ -10919,7 +10919,7 @@ process_cu_tu_index (struct dwarf_sectio
  363. Check for integer overflow (can occur when size_t is 32-bit)
  364. with overlarge ncols or nused values. */
  365. if (nused == -1u
  366. - || _mul_overflow ((size_t) ncols, 4, &temp)
  367. + || _mul_overflow ((size_t) ncols, 4, &temp)
  368. || _mul_overflow ((size_t) nused + 1, temp, &total)
  369. || total > (size_t) (limit - ppool))
  370. {
  371. @@ -10927,7 +10927,7 @@ process_cu_tu_index (struct dwarf_sectio
  372. section->name);
  373. return 0;
  374. }
  375. -
  376. +
  377. if (do_display)
  378. {
  379. printf (_(" Offset table\n"));
  380. @@ -11431,8 +11431,8 @@ add_separate_debug_file (const char * fi
  381. static bool
  382. debuginfod_fetch_separate_debug_info (struct dwarf_section * section,
  383. - char ** filename,
  384. - void * file)
  385. + char ** filename,
  386. + void * file)
  387. {
  388. size_t build_id_len;
  389. unsigned char * build_id;
  390. @@ -11450,14 +11450,14 @@ debuginfod_fetch_separate_debug_info (st
  391. filelen = strnlen ((const char *)section->start, section->size);
  392. if (filelen == section->size)
  393. - /* Corrupt debugaltlink. */
  394. - return false;
  395. + /* Corrupt debugaltlink. */
  396. + return false;
  397. build_id = section->start + filelen + 1;
  398. build_id_len = section->size - (filelen + 1);
  399. if (build_id_len == 0)
  400. - return false;
  401. + return false;
  402. }
  403. else
  404. return false;
  405. @@ -11469,25 +11469,25 @@ debuginfod_fetch_separate_debug_info (st
  406. client = debuginfod_begin ();
  407. if (client == NULL)
  408. - return false;
  409. + return false;
  410. /* Query debuginfod servers for the target file. If found its path
  411. - will be stored in filename. */
  412. + will be stored in filename. */
  413. fd = debuginfod_find_debuginfo (client, build_id, build_id_len, filename);
  414. debuginfod_end (client);
  415. /* Only free build_id if we allocated space for a hex string
  416. - in get_build_id (). */
  417. + in get_build_id (). */
  418. if (build_id_len == 0)
  419. - free (build_id);
  420. + free (build_id);
  421. if (fd >= 0)
  422. - {
  423. - /* File successfully retrieved. Close fd since we want to
  424. - use open_debug_file () on filename instead. */
  425. - close (fd);
  426. - return true;
  427. - }
  428. + {
  429. + /* File successfully retrieved. Close fd since we want to
  430. + use open_debug_file () on filename instead. */
  431. + close (fd);
  432. + return true;
  433. + }
  434. }
  435. return false;
  436. @@ -11500,7 +11500,7 @@ load_separate_debug_info (const char *
  437. parse_func_type parse_func,
  438. check_func_type check_func,
  439. void * func_data,
  440. - void * file ATTRIBUTE_UNUSED)
  441. + void * file ATTRIBUTE_UNUSED)
  442. {
  443. const char * separate_filename;
  444. char * debug_filename;
  445. @@ -11616,11 +11616,11 @@ load_separate_debug_info (const char *
  446. & tmp_filename,
  447. file))
  448. {
  449. - /* File successfully downloaded from server, replace
  450. - debug_filename with the file's path. */
  451. - free (debug_filename);
  452. - debug_filename = tmp_filename;
  453. - goto found;
  454. + /* File successfully downloaded from server, replace
  455. + debug_filename with the file's path. */
  456. + free (debug_filename);
  457. + debug_filename = tmp_filename;
  458. + goto found;
  459. }
  460. }
  461. #endif
  462. @@ -11787,12 +11787,12 @@ load_build_id_debug_file (const char * m
  463. /* In theory we should extract the contents of the section into
  464. a note structure and then check the fields. For now though
  465. just use hard coded offsets instead:
  466. -
  467. +
  468. Field Bytes Contents
  469. NSize 0...3 4
  470. DSize 4...7 8+
  471. Type 8..11 3 (NT_GNU_BUILD_ID)
  472. - Name 12.15 GNU\0
  473. + Name 12.15 GNU\0
  474. Data 16.... */
  475. /* FIXME: Check the name size, name and type fields. */
  476. @@ -11804,7 +11804,7 @@ load_build_id_debug_file (const char * m
  477. warn (_(".note.gnu.build-id data size is too small\n"));
  478. return;
  479. }
  480. -
  481. +
  482. if (build_id_size > (section->size - 16))
  483. {
  484. warn (_(".note.gnu.build-id data size is too bug\n"));
  485. @@ -12100,10 +12100,6 @@ free_debug_memory (void)
  486. free_all_abbrevs ();
  487. - free (cu_abbrev_map);
  488. - cu_abbrev_map = NULL;
  489. - next_free_abbrev_map_entry = 0;
  490. -
  491. free (shndx_pool);
  492. shndx_pool = NULL;
  493. shndx_pool_size = 0;