[PATCH 03/13] gdb/dwarf: add missing bound check to read_loclist_index

Simon Marchi via Gdb-patches
2021-01-20T05:39:38Z

From: Simon Marchi <simon.marchi@efficios.com>

read_rnglist_index has a bound check to make sure that we don't go past
the end of the section while reading the offset, but read_loclist_index
doesn't. Add it to read_loclist_index.

gdb/ChangeLog:

* dwarf2/read.c (read_loclist_index): Add bound check for the end
of the offset.

Change-Id: Ic4b55c88860fdc3e007740949c78ec84cdb4da60
---
gdb/dwarf2/read.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/gdb/dwarf2/read.c b/gdb/dwarf2/read.c
index f3bc35644c8a..848c15330435 100644
--- a/gdb/dwarf2/read.c
+++ b/gdb/dwarf2/read.c
@@ -20186,6 +20186,11 @@ read_loclist_index (struct dwarf2_cu *cu, ULONGEST loclist_index)
struct objfile *objfile = per_objfile->objfile;
bfd *abfd = objfile->obfd;
ULONGEST loclist_base = lookup_loclist_base (cu);
+
+ /* Offset in .debug_loclists of the offset for LOCLIST_INDEX. */
+ ULONGEST start_offset =
+ loclist_base + loclist_index * cu->header.offset_size;
+
struct dwarf2_section_info *section = cu_debug_loc_section (cu);

section->read (objfile);
@@ -20200,14 +20205,18 @@ read_loclist_index (struct dwarf2_cu *cu, ULONGEST loclist_index)
".debug_loclists offset array [in module %s]"),
objfile_name (objfile));

- if (loclist_base + loclist_index * cu->header.offset_size
- >= section->size)
+ if (start_offset >= section->size)
error (_("DW_FORM_loclistx pointing outside of "
".debug_loclists section [in module %s]"),
objfile_name (objfile));

- const gdb_byte *info_ptr
- = section->buffer + loclist_base + loclist_index * cu->header.offset_size;
+ /* Validate that reading won't go beyond the end of the section. */
+ if (start_offset + cu->header.offset_size > section->size)
+ error (_("Reading DW_FORM_loclistx index beyond end of"
+ ".debug_loclists section [in module %s]"),
+ objfile_name (objfile));
+
+ const gdb_byte *info_ptr = section->buffer + start_offset;

if (cu->header.offset_size == 4)
return bfd_get_32 (abfd, info_ptr) + loclist_base;
--
2.30.0