1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
From: Alan Modra <amodra@gmail.com>
Date: Sun, 30 Oct 2022 08:38:51 +0000 (+1030)
Subject: Pool section entries for DWP version 1
X-Git-Tag: gdb-13-branchpoint~664
X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=28750e3b967da2207d51cbce9fc8be262817ee59
Pool section entries for DWP version 1
Ref: https://gcc.gnu.org/wiki/DebugFissionDWP?action=recall&rev=3
Fuzzers have found a weakness in the code stashing pool section
entries. With random nonsensical values in the index entries (rather
than each index pointing to its own set distinct from other sets),
it's possible to overflow the space allocated, losing the NULL
terminator. Without a terminator, find_section_in_set can run off the
end of the shndx_pool buffer. Fix this by scanning the pool directly.
binutils/
* dwarf.c (add_shndx_to_cu_tu_entry): Delete range check.
(end_cu_tu_entry): Likewise.
(process_cu_tu_index): Fill shndx_pool by directly scanning
pool, rather than indirectly from index entries.
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff_plain;f=binutils/dwarf.c;h=7730293326ac1049451eb4a037ac86d827030700;hp=c6340a28906114e9df29d7401472c7dc0a98c2b1;hb=28750e3b967da2207d51cbce9fc8be262817ee59;hpb=60095ba3b8f8ba26a6389dded732fa446422c98f]
CVE: CVE-2022-44840
Signed-off-by: yash shinde <yash.shinde@windriver.com>
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index c6340a28906..7730293326a 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -10652,22 +10652,12 @@ prealloc_cu_tu_list (unsigned int nshndx)
static void
add_shndx_to_cu_tu_entry (unsigned int shndx)
{
- if (shndx_pool_used >= shndx_pool_size)
- {
- error (_("Internal error: out of space in the shndx pool.\n"));
- return;
- }
shndx_pool [shndx_pool_used++] = shndx;
}
static void
end_cu_tu_entry (void)
{
- if (shndx_pool_used >= shndx_pool_size)
- {
- error (_("Internal error: out of space in the shndx pool.\n"));
- return;
- }
shndx_pool [shndx_pool_used++] = 0;
}
@@ -10773,53 +10763,55 @@ process_cu_tu_index (struct dwarf_section *section, int do_display)
if (version == 1)
{
+ unsigned char *shndx_list;
+ unsigned int shndx;
+
if (!do_display)
- prealloc_cu_tu_list ((limit - ppool) / 4);
- for (i = 0; i < nslots; i++)
{
- unsigned char *shndx_list;
- unsigned int shndx;
-
- SAFE_BYTE_GET (signature, phash, 8, limit);
- if (signature != 0)
+ prealloc_cu_tu_list ((limit - ppool) / 4);
+ for (shndx_list = ppool + 4; shndx_list <= limit - 4; shndx_list += 4)
{
- SAFE_BYTE_GET (j, pindex, 4, limit);
- shndx_list = ppool + j * 4;
- /* PR 17531: file: 705e010d. */
- if (shndx_list < ppool)
- {
- warn (_("Section index pool located before start of section\n"));
- return 0;
- }
+ shndx = byte_get (shndx_list, 4);
+ add_shndx_to_cu_tu_entry (shndx);
+ }
+ end_cu_tu_entry ();
+ }
+ else
+ for (i = 0; i < nslots; i++)
+ {
+ SAFE_BYTE_GET (signature, phash, 8, limit);
+ if (signature != 0)
+ {
+ SAFE_BYTE_GET (j, pindex, 4, limit);
+ shndx_list = ppool + j * 4;
+ /* PR 17531: file: 705e010d. */
+ if (shndx_list < ppool)
+ {
+ warn (_("Section index pool located before start of section\n"));
+ return 0;
+ }
- if (do_display)
printf (_(" [%3d] Signature: 0x%s Sections: "),
i, dwarf_vmatoa ("x", signature));
- for (;;)
- {
- if (shndx_list >= limit)
- {
- warn (_("Section %s too small for shndx pool\n"),
- section->name);
- return 0;
- }
- SAFE_BYTE_GET (shndx, shndx_list, 4, limit);
- if (shndx == 0)
- break;
- if (do_display)
+ for (;;)
+ {
+ if (shndx_list >= limit)
+ {
+ warn (_("Section %s too small for shndx pool\n"),
+ section->name);
+ return 0;
+ }
+ SAFE_BYTE_GET (shndx, shndx_list, 4, limit);
+ if (shndx == 0)
+ break;
printf (" %d", shndx);
- else
- add_shndx_to_cu_tu_entry (shndx);
- shndx_list += 4;
- }
- if (do_display)
+ shndx_list += 4;
+ }
printf ("\n");
- else
- end_cu_tu_entry ();
- }
- phash += 8;
- pindex += 4;
- }
+ }
+ phash += 8;
+ pindex += 4;
+ }
}
else if (version == 2)
{
|
