On Wed, Jun 27, 2018 at 11:01:25PM +0000, Sasha Da Rocha Pinheiro wrote:
> This is a binary that infinite loops with dwarf_next_cfi -1 because the
> offset is not updated.
> https://rice.box.com/s/yzul9oavplq1qdx12ozjpgssawea36xy
>
> A fix was done by saving the previous *next_off and comparing with the
> current, after getting -1 in the return value.
That is probably the best way to handle that.
Looking at the file I see it has (multiple) zero terminators, that
dwarf_next_cfi seems to not handle. Strangely these aren't described
in the Dwarf spec, but they are mentioned in the LSB exception frames
spec:
https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/ehframechpt.html#EHFRAME
Totally untested patch attached. If you could test it that would be
wonderful. I'll write a proper testcase tomorrow.
Thanks,
Mark
diff --git a/libdw/dwarf_next_cfi.c b/libdw/dwarf_next_cfi.c
index 53fc3697..fa28d99b 100644
--- a/libdw/dwarf_next_cfi.c
+++ b/libdw/dwarf_next_cfi.c
@@ -54,6 +54,7 @@ dwarf_next_cfi (const unsigned char e_ident[],
we don't know yet whether this is a 64-bit object or not. */
|| unlikely (off + 4 >= data->d_size))
{
+ done:
*next_off = (Dwarf_Off) -1l;
return 1;
}
@@ -79,6 +80,13 @@ dwarf_next_cfi (const unsigned char e_ident[],
}
length = read_8ubyte_unaligned_inc (&dw, bytes);
}
+
+ /* Not explicitly in the DWARF spec, but mentioned in the LSB exception
+ frames (.eh_frame) spec. If Length contains the value 0, then this
+ CIE shall be considered a terminator and processing shall end. */
+ if (length == 0)
+ goto done;
+
if (unlikely ((uint64_t) (limit - bytes) < length)
|| unlikely (length < offset_size + 1))
goto invalid;
