Re: [PATCH] libelf: Don't return unaligned data returned from elf_getdata[_rawchunk].
On Wed, 2018-06-20 at 00:57 +0200, Mark Wielaard wrote: > For i386 and x86_64 we allow some unaligned data accesses. > We also return unaligned data from elf_getdata[_rawchunk]. > But that might go wrong if we then access the ELF types inside. > When build with gcc -O3 for example the compiler might vectorize > loops accessing ELF words or types. The instructions used do require > the data is naturally aligned. If the function returnes unaligned > data the program will segfault and crash. This happens for example > with the code in dwfl_module_getdwarf.c that tries to iterate over > the hash buckets gotten through elf_getdata_rawchunk based on the > DT_[GNU]_HASH value. > > This only happens when the underlying ELF file is mmapped, and it > is meant as optimization so that we don't have to copy data first > so that it is correctly aligned. In most cases the data is already > naturally aligned though. But it might not be for non-native ELF > files. > > Given that it might even happen in our own code base and these > are public functions that can be used by code that might rely on > the data returned being correctly aligned for the ELF data type > requested just always return correctly aligned data. Pushed to master.
[PATCH] libdw: Handle bogus CU length in dwarf_nextcu.
The length field could be so big that it would wrap around the next_offset. We don't really care that length is bogus, but we don't want to use it to calculate the next offset if it is. Found by afl-fuzz. Signed-off-by: Mark Wielaard --- libdw/ChangeLog | 5 + libdw/dwarf_nextcu.c | 5 + 2 files changed, 10 insertions(+) diff --git a/libdw/ChangeLog b/libdw/ChangeLog index 4280c55..11de763 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,3 +1,8 @@ +2018-06-22 Mark Wielaard + + * dwarf_nextcu.c (__libdw_next_unit): Set next_off to -1 when it would + wrap around. + 2018-06-18 Mark Wielaard * dwarf_aggregate_size.c (array_size): New depth argument. Use diff --git a/libdw/dwarf_nextcu.c b/libdw/dwarf_nextcu.c index 4b394f3..be11327 100644 --- a/libdw/dwarf_nextcu.c +++ b/libdw/dwarf_nextcu.c @@ -278,6 +278,11 @@ __libdw_next_unit (Dwarf *dwarf, bool v4_debug_types, Dwarf_Off off, or with offset == 8: 2 * 8 - 4 == 12. */ *next_off = off + 2 * offset_size - 4 + length; + /* This means that the length field is bogus, but return the CU anyway. + We just won't return anything after this. */ + if (*next_off <= off) +*next_off = (Dwarf_Off) -1; + return 0; } -- 1.8.3.1
