Re: [patch] Fix CVE-2017-9778

[Sandra Loosemore <sandra@codesourcery.com>]

On 4/24/19 9:25 PM, Simon Marchi wrote:
> On 2019-04-24 20:56, Kevin Buettner wrote:
>> On Wed, 24 Apr 2019 10:27:39 -0600
>> Sandra Loosemore <sandra@codesourcery.com> wrote:
>>
>>>     GDB was failing to catch cases where a corrupt ELF or core file
>>>     contained an invalid length value in a Dwarf debug frame FDE header.
>>>     It was checking for buffer overflow but not cases where the 
>>> length was
>>>     negative or caused pointer wrap-around.
>>>
>>>     In addition to the additional validity check, this patch cleans 
>>> up the
>>>     multiple signed/unsigned conversions on the length field so that an
>>>     unsigned representation is used consistently throughout.
>>>
>>>     2019-04-24  Sandra Loosemore  <sandra@codesourcery.com>
>>>             Kang Li <kanglictf@gmail.com>
>>>
>>>         PR gdb/21600
>>>
>>>         * dwarf2-frame.c (read_initial_length): Be consistent about 
>>> using
>>>         unsigned representation of length.
>>>         (decode_frame_entry_1): Likewise.  Check for wraparound of
>>>         end pointer as well as buffer overflow.
>>
>> This is okay.
>>
>> Kevin
> 
> I would just suggest using a more descriptive commit title, stating what 
> the commit actually changes in the code.  It's still good to reference 
> the CVE number, but by itself is not very descriptive.

Done.  I pushed it as "Detect invalid length field in debug frame FDE 
header."

-Sandra