0014-CVE-2022-38128-3.patch 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495
  1. From 695c6dfe7e85006b98c8b746f3fd5f913c94ebff Mon Sep 17 00:00:00 2001
  2. From: Alan Modra <amodra@gmail.com>
  3. Date: Thu, 21 Jul 2022 09:56:15 +0930
  4. Subject: [PATCH] PR29370, infinite loop in display_debug_abbrev
  5. The PR29370 testcase is a fuzzed object file with multiple
  6. .trace_abbrev sections. Multiple .trace_abbrev or .debug_abbrev
  7. sections are not a violation of the DWARF standard. The DWARF5
  8. standard even gives an example of multiple .debug_abbrev sections
  9. contained in groups. Caching and lookup of processed abbrevs thus
  10. needs to be done by section and offset rather than base and offset.
  11. (Why base anyway?) Or, since section contents are kept, by a pointer
  12. into the contents.
  13. PR 29370
  14. * dwarf.c (struct abbrev_list): Replace abbrev_base and
  15. abbrev_offset with raw field.
  16. (find_abbrev_list_by_abbrev_offset): Delete.
  17. (find_abbrev_list_by_raw_abbrev): New function.
  18. (process_abbrev_set): Set list->raw and list->next.
  19. (find_and_process_abbrev_set): Replace abbrev list lookup with
  20. new function. Don't set list abbrev_base, abbrev_offset or next.
  21. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=695c6dfe7e85006b98c8b746f3fd5f913c94ebff]
  22. Signed-off-by: Pgowda <pgowda.cve@gmail.com>
  23. ---
  24. binutils/dwarf.c | 19 ++++++-------------
  25. 1 file changed, 6 insertions(+), 13 deletions(-)
  26. diff --git a/binutils/dwarf.c b/binutils/dwarf.c
  27. index 2fc352f74c5..99fb3566994 100644
  28. --- a/binutils/dwarf.c
  29. +++ b/binutils/dwarf.c
  30. @@ -856,8 +856,7 @@ typedef struct abbrev_list
  31. {
  32. abbrev_entry * first_abbrev;
  33. abbrev_entry * last_abbrev;
  34. - dwarf_vma abbrev_base;
  35. - dwarf_vma abbrev_offset;
  36. + unsigned char * raw;
  37. struct abbrev_list * next;
  38. unsigned char * start_of_next_abbrevs;
  39. }
  40. @@ -946,14 +945,12 @@ free_all_abbrevs (void)
  41. }
  42. static abbrev_list *
  43. -find_abbrev_list_by_abbrev_offset (dwarf_vma abbrev_base,
  44. - dwarf_vma abbrev_offset)
  45. +find_abbrev_list_by_raw_abbrev (unsigned char *raw)
  46. {
  47. abbrev_list * list;
  48. for (list = abbrev_lists; list != NULL; list = list->next)
  49. - if (list->abbrev_base == abbrev_base
  50. - && list->abbrev_offset == abbrev_offset)
  51. + if (list->raw == raw)
  52. return list;
  53. return NULL;
  54. @@ -1040,6 +1037,7 @@ process_abbrev_set (struct dwarf_section
  55. abbrev_list *list = xmalloc (sizeof (*list));
  56. list->first_abbrev = NULL;
  57. list->last_abbrev = NULL;
  58. + list->raw = start;
  59. while (start < end)
  60. {
  61. @@ -1055,6 +1053,7 @@ process_abbrev_set (struct dwarf_section
  62. the caller. */
  63. if (start == end || entry == 0)
  64. {
  65. + list->next = NULL;
  66. list->start_of_next_abbrevs = start != end ? start : NULL;
  67. return list;
  68. }
  69. @@ -1144,16 +1143,10 @@ find_and_process_abbrev_set (struct dwar
  70. unsigned char *end = section->start + abbrev_base + abbrev_size;
  71. abbrev_list *list = NULL;
  72. if (free_list)
  73. - list = find_abbrev_list_by_abbrev_offset (abbrev_base, abbrev_offset);
  74. + list = find_abbrev_list_by_raw_abbrev (start);
  75. if (list == NULL)
  76. {
  77. list = process_abbrev_set (section, start, end);
  78. - if (list)
  79. - {
  80. - list->abbrev_base = abbrev_base;
  81. - list->abbrev_offset = abbrev_offset;
  82. - list->next = NULL;
  83. - }
  84. if (free_list)
  85. *free_list = list;
  86. }