commit 1b86808a86077722ee4f42ff97f836b12420bb2a
Author: Alan Modra <amodra@gmail.com>
Date:   Tue Sep 26 21:47:24 2017 +0930

    PR22209, invalid memory read in find_abstract_instance_name
    
    This patch adds bounds checking for DW_FORM_ref_addr die refs, and
    calculates them relative to the first .debug_info section.  See the
    big comment for why calculating relative to the current .debug_info
    section was wrong for relocatable object files.
    
    	PR 22209
    	* dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
    	(find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
    	to stash->info_ptr_memory, and check die_ref is within that memory.
    	Set info_ptr_end correctly when another CU is refd.  Check die_ref
    	for DW_FORM_ref4 etc. is within CU.

Upstream-Status: Backport

CVE: CVE-2017-15938
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>

Index: git/bfd/dwarf2.c
===================================================================
--- git.orig/bfd/dwarf2.c	2017-11-07 18:52:19.896253364 +0530
+++ git/bfd/dwarf2.c	2017-11-07 18:52:19.952253802 +0530
@@ -119,8 +119,7 @@
 
   /* A pointer to the memory block allocated for info_ptr.  Neither
      info_ptr nor sec_info_ptr are guaranteed to stay pointing to the
-     beginning of the malloc block.  This is used only to free the
-     memory later.  */
+     beginning of the malloc block.  */
   bfd_byte *info_ptr_memory;
 
   /* Pointer to the symbol table.  */
@@ -238,9 +237,6 @@
      by its reference.  */
   bfd_byte *info_ptr_unit;
 
-  /* Pointer to the start of the debug section, for DW_FORM_ref_addr.  */
-  bfd_byte *sec_info_ptr;
-
   /* The offset into .debug_line of the line number table.  */
   unsigned long line_offset;
 
@@ -2294,21 +2290,37 @@
   if (attr_ptr->form == DW_FORM_ref_addr)
     {
       /* We only support DW_FORM_ref_addr within the same file, so
-	 any relocations should be resolved already.  */
-      if (!die_ref)
+	 any relocations should be resolved already.  Check this by
+	 testing for a zero die_ref;  There can't be a valid reference
+	 to the header of a .debug_info section.
+	 DW_FORM_ref_addr is an offset relative to .debug_info.
+	 Normally when using the GNU linker this is accomplished by
+	 emitting a symbolic reference to a label, because .debug_info
+	 sections are linked at zero.  When there are multiple section
+	 groups containing .debug_info, as there might be in a
+	 relocatable object file, it would be reasonable to assume that
+	 a symbolic reference to a label in any .debug_info section
+	 might be used.  Since we lay out multiple .debug_info
+	 sections at non-zero VMAs (see place_sections), and read
+	 them contiguously into stash->info_ptr_memory, that means
+	 the reference is relative to stash->info_ptr_memory.  */
+      size_t total;
+
+      info_ptr = unit->stash->info_ptr_memory;
+      info_ptr_end = unit->stash->info_ptr_end;
+      total = info_ptr_end - info_ptr;
+      if (!die_ref || die_ref >= total)
 	{
 	  _bfd_error_handler
-	    (_("Dwarf Error: Abstract instance DIE ref zero."));
+	    (_("Dwarf Error: Invalid abstract instance DIE ref."));
 	  bfd_set_error (bfd_error_bad_value);
 	  return FALSE;
 	}
-
-      info_ptr = unit->sec_info_ptr + die_ref;
-      info_ptr_end = unit->end_ptr;
+      info_ptr += die_ref;
 
       /* Now find the CU containing this pointer.  */
       if (info_ptr >= unit->info_ptr_unit && info_ptr < unit->end_ptr)
-	;
+	info_ptr_end = unit->end_ptr;
       else
 	{
 	  /* Check other CUs to see if they contain the abbrev.  */
@@ -2324,7 +2336,10 @@
 		break;
 
 	  if (u)
-	    unit = u;
+	    {
+	      unit = u;
+	      info_ptr_end = unit->end_ptr;
+	    }
 	  /* else FIXME: What do we do now ?  */
 	}
     }
@@ -2346,8 +2361,22 @@
     }
   else
     {
-      info_ptr = unit->info_ptr_unit + die_ref;
+      /* DW_FORM_ref1, DW_FORM_ref2, DW_FORM_ref4, DW_FORM_ref8 or
+	 DW_FORM_ref_udata.  These are all references relative to the
+	 start of the current CU.  */
+      size_t total;
+
+      info_ptr = unit->info_ptr_unit;
       info_ptr_end = unit->end_ptr;
+      total = info_ptr_end - info_ptr;
+      if (!die_ref || die_ref >= total)
+	{
+	  _bfd_error_handler
+	    (_("Dwarf Error: Invalid abstract instance DIE ref."));
+	  bfd_set_error (bfd_error_bad_value);
+	  return FALSE;
+	}
+      info_ptr += die_ref;
     }
 
   abbrev_number = safe_read_leb128 (abfd, info_ptr, &bytes_read, FALSE, info_ptr_end);
@@ -2846,7 +2875,6 @@
   unit->end_ptr = end_ptr;
   unit->stash = stash;
   unit->info_ptr_unit = info_ptr_unit;
-  unit->sec_info_ptr = stash->sec_info_ptr;
 
   for (i = 0; i < abbrev->num_attrs; ++i)
     {
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog	2017-11-07 18:52:19.900253395 +0530
+++ git/bfd/ChangeLog	2017-11-07 18:53:29.668799630 +0530
@@ -1,3 +1,12 @@
+2017-09-26  Alan Modra  <amodra@gmail.com>
+
+       PR 22209
+       * dwarf2.c (struct comp_unit): Delete sec_info_ptr field.
+       (find_abstract_instance_name): Calculate DW_FORM_ref_addr relative
+       to stash->info_ptr_memory, and check die_ref is within that memory.
+       Set info_ptr_end correctly when another CU is refd.  Check die_ref
+       for DW_FORM_ref4 etc. is within CU.
+
 2017-09-24  Alan Modra  <amodra@gmail.com>
 
        PR 22187
