/usr/src/binutils/patches/pr22905.diff is in binutils-source 2.30-15ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 | # DP: Prevent illegal memory accesses triggered by integer overflow
# DP: when parsing corrupt DWARF information on a 32-bit host.
From d11ae95ea3403559f052903ab053f43ad7821e37 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Thu, 1 Mar 2018 16:14:08 +0000
Subject: [PATCH] Prevent illegal memory accesses triggered by integer overflow
when parsing corrupt DWARF information on a 32-bit host.
PR 22905
* dwarf.c (display_debug_ranges): Check that the offset loaded
from the range_entry structure is valid.
---
binutils/ChangeLog | 6 ++++++
binutils/dwarf.c | 15 +++++++++++++++
2 files changed, 21 insertions(+)
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 6aca9b7..17896e6 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -387,6 +387,9 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Read AMOUNT bytes from PTR and store them in VAL as an unsigned value.
+ Checks to make sure that the read will not reach or pass END
+ and that VAL is big enough to hold AMOUNT bytes. */
#define SAFE_BYTE_GET(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -415,6 +418,7 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Like SAFE_BYTE_GET, but also increments PTR by AMOUNT. */
#define SAFE_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -423,6 +427,7 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Like SAFE_BYTE_GET, but reads a signed value. */
#define SAFE_SIGNED_BYTE_GET(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -441,6 +446,7 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Like SAFE_SIGNED_BYTE_GET, but also increments PTR by AMOUNT. */
#define SAFE_SIGNED_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -6543,6 +6549,7 @@ display_debug_ranges_list (unsigned char *start, unsigned char *finish,
break;
SAFE_SIGNED_BYTE_GET_AND_INC (end, start, pointer_size, finish);
+
printf (" %8.8lx ", offset);
if (begin == 0 && end == 0)
@@ -6810,6 +6817,13 @@ display_debug_ranges (struct dwarf_section *section,
continue;
}
+ if (next < section_begin || next >= finish)
+ {
+ warn (_("Corrupt offset (%#8.8lx) in range entry %u\n"),
+ (unsigned long) offset, i);
+ continue;
+ }
+
if (dwarf_check != 0 && i > 0)
{
if (start < next)
@@ -6825,6 +6839,7 @@ display_debug_ranges (struct dwarf_section *section,
(unsigned long) (next - section_begin), section->name);
}
}
+
start = next;
last_start = next;
--
2.9.3
|