https://sourceware.org/bugzilla/show_bug.cgi?id=30085
Bug ID: 30085
Summary: Negative strides in dwarf_aggregate_size
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: libdw
Assignee: unassigned at sourceware dot org
Reporter: thaines.astro at gmail dot com
CC: elfutils-devel at sourceware dot org
Target Milestone: ---
In section 5.13 of DWARF5, the standard says
Note that the stride can be negative
I don't see anywhere in the standard besides this footnote that indicates it
should be a signed value.
In the array_size helper, the stride is calculated as
Dwarf_Word stride = eltsize;
if (INTUSE(dwarf_attr_integrate)(die, DW_AT_byte_stride, attr_mem) != NULL) {
if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
return -1;
} else if (INTUSE(dwarf_attr_integrate)(die, DW_AT_bit_stride, attr_mem) !=
NULL) {
if (INTUSE(dwarf_formudata)(attr_mem, &stride) != 0)
return -1;
if (stride % 8) /* XXX maybe compute in bits? */
return -1;
stride /= 8;
}
Since we could be reading a negative integer, the use of dwarf_formudata would
cause the total size to be incorrect.
I don't have a reproducer, and I've not seen any binaries that have run across
this. I just noticed it while reading through the source.
--
You are receiving this mail because:
You are on the CC list for the bug.
