https://sourceware.org/bugzilla/show_bug.cgi?id=24116
--- Comment #6 from Mark Wielaard <mark at klomp dot org> ---
(In reply to wcventure from comment #5)
> Created attachment 11581 [details]
> Regression
Running with:
valgrind -q src/readelf --debug-dump=line ./RegressionPOC
will produce:
==57142== Invalid read of size 2
==57142== at 0x12F431: print_debug_line_section (readelf.c:8807)
==57142== by 0x11E2C0: print_debug (readelf.c:11212)
==57142== by 0x1201C0: process_elf_file (readelf.c:998)
==57142== by 0x1201C0: process_dwflmod (readelf.c:760)
==57142== by 0x486D6A0: dwfl_getmodules (dwfl_getmodules.c:86)
==57142== by 0x11414F: process_file (readelf.c:868)
==57142== by 0x111C33: main (readelf.c:350)
==57142== Address 0x4f20a83 is 0 bytes after a block of size 339 alloc'd
==57142== at 0x483577F: malloc (vg_replace_malloc.c:299)
==57142== by 0x48A0358: convert_data (elf_getdata.c:157)
==57142== by 0x48A0358: __libelf_set_data_list_rdlock (elf_getdata.c:447)
==57142== by 0x48A0547: __elf_getdata_rdlock (elf_getdata.c:554)
==57142== by 0x484EFB0: check_section (dwarf_begin_elf.c:167)
==57142== by 0x484F522: global_read (dwarf_begin_elf.c:310)
==57142== by 0x484F522: dwarf_begin_elf (dwarf_begin_elf.c:445)
==57142== by 0x486F9A7: load_dw (dwfl_module_getdwarf.c:1342)
==57142== by 0x486FBCB: find_dw (dwfl_module_getdwarf.c:1392)
==57142== by 0x486FBCB: dwfl_module_getdwarf (dwfl_module_getdwarf.c:1447)
==57142== by 0x11DD4A: print_debug (readelf.c:10943)
==57142== by 0x1201C0: process_elf_file (readelf.c:998)
==57142== by 0x1201C0: process_dwflmod (readelf.c:760)
==57142== by 0x486D6A0: dwfl_getmodules (dwfl_getmodules.c:86)
==57142== by 0x11414F: process_file (readelf.c:868)
==57142== by 0x111C33: main (readelf.c:350)
==57142==
Fixed by:
commit cad9595592730fd8c9d0d9236d38f62ec8cfbcef
Author: Mark Wielaard <m...@klomp.org>
Date: Fri Feb 1 09:08:14 2019 +0100
readelf: Check there is enough data to read DWARF line opcodes arguments.
When reading the debug_line opcode arguments we have to make sure there
is enough data to read the arguments (if there are any(.
The similar code in dwarf_getsrclines already had these checks.
https://sourceware.org/bugzilla/show_bug.cgi?id=24116
Signed-off-by: Mark Wielaard <m...@klomp.org>
--
You are receiving this mail because:
You are on the CC list for the bug.
