Skip to content

Commit ed9851a

Browse files
igorkudrinigorkudrin
committed
[DWARF] Better detect errors in Address Range Tables.
The patch tries to cover most remaining cases of wrong data. Differential Revision: https://reviews.llvm.org/D71932
1 parent 6332990 commit ed9851a

File tree

2 files changed

+154
-11
lines changed

2 files changed

+154
-11
lines changed

‎llvm/lib/DebugInfo/DWARF/DWARFDebugArangeSet.cpp

Lines changed: 62 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,31 @@ Error DWARFDebugArangeSet::extract(DataExtractor data, uint64_t *offset_ptr) {
5959
// the segment selectors are omitted from all tuples, including
6060
// the terminating tuple.
6161

62+
constexpr unsigned CommonFieldsLength = 2 + // Version
63+
1 + // Address Size
64+
1; // Segment Selector Size
65+
constexpr unsigned DWARF32HeaderLength =
66+
dwarf::getUnitLengthFieldByteSize(dwarf::DWARF32) + CommonFieldsLength +
67+
dwarf::getDwarfOffsetByteSize(dwarf::DWARF32); // Debug Info Offset
68+
constexpr unsigned DWARF64HeaderLength =
69+
dwarf::getUnitLengthFieldByteSize(dwarf::DWARF64) + CommonFieldsLength +
70+
dwarf::getDwarfOffsetByteSize(dwarf::DWARF64); // Debug Info Offset
71+
72+
if (!data.isValidOffsetForDataOfSize(Offset, DWARF32HeaderLength))
73+
return createStringError(errc::invalid_argument,
74+
"section is not large enough to contain "
75+
"an address range table at offset 0x%" PRIx64,
76+
Offset);
77+
6278
dwarf::DwarfFormat format = dwarf::DWARF32;
6379
HeaderData.Length = data.getU32(offset_ptr);
6480
if (HeaderData.Length == dwarf::DW_LENGTH_DWARF64) {
81+
if (!data.isValidOffsetForDataOfSize(Offset, DWARF64HeaderLength))
82+
return createStringError(
83+
errc::invalid_argument,
84+
"section is not large enough to contain a DWARF64 "
85+
"address range table at offset 0x%" PRIx64,
86+
Offset);
6587
HeaderData.Length = data.getU64(offset_ptr);
6688
format = dwarf::DWARF64;
6789
} else if (HeaderData.Length >= dwarf::DW_LENGTH_lo_reserved) {
@@ -91,17 +113,38 @@ Error DWARFDebugArangeSet::extract(DataExtractor data, uint64_t *offset_ptr) {
91113
" has unsupported address size: %d "
92114
"(4 and 8 supported)",
93115
Offset, HeaderData.AddrSize);
116+
if (HeaderData.SegSize != 0)
117+
return createStringError(errc::not_supported,
118+
"non-zero segment selector size in address range "
119+
"table at offset 0x%" PRIx64 " is not supported",
120+
Offset);
94121

95-
// The first tuple following the header in each set begins at an offset
96-
// that is a multiple of the size of a single tuple (that is, twice the
97-
// size of an address). The header is padded, if necessary, to the
98-
// appropriate boundary.
99-
const uint32_t header_size = *offset_ptr - Offset;
122+
// The first tuple following the header in each set begins at an offset that
123+
// is a multiple of the size of a single tuple (that is, twice the size of
124+
// an address because we do not support non-zero segment selector sizes).
125+
// Therefore, the full length should also be a multiple of the tuple size.
100126
const uint32_t tuple_size = HeaderData.AddrSize * 2;
127+
if (full_length % tuple_size != 0)
128+
return createStringError(
129+
errc::invalid_argument,
130+
"address range table at offset 0x%" PRIx64
131+
" has length that is not a multiple of the tuple size",
132+
Offset);
133+
134+
// The header is padded, if necessary, to the appropriate boundary.
135+
const uint32_t header_size = *offset_ptr - Offset;
101136
uint32_t first_tuple_offset = 0;
102137
while (first_tuple_offset < header_size)
103138
first_tuple_offset += tuple_size;
104139

140+
// There should be space for at least one tuple.
141+
if (full_length <= first_tuple_offset)
142+
return createStringError(
143+
errc::invalid_argument,
144+
"address range table at offset 0x%" PRIx64
145+
" has an insufficient length to contain any entries",
146+
Offset);
147+
105148
*offset_ptr = Offset + first_tuple_offset;
106149

107150
Descriptor arangeDescriptor;
@@ -111,14 +154,23 @@ Error DWARFDebugArangeSet::extract(DataExtractor data, uint64_t *offset_ptr) {
111154
"Different datatypes for addresses and sizes!");
112155
assert(sizeof(arangeDescriptor.Address) >= HeaderData.AddrSize);
113156

114-
while (data.isValidOffset(*offset_ptr)) {
157+
uint64_t end_offset = Offset + full_length;
158+
while (*offset_ptr < end_offset) {
115159
arangeDescriptor.Address = data.getUnsigned(offset_ptr, HeaderData.AddrSize);
116160
arangeDescriptor.Length = data.getUnsigned(offset_ptr, HeaderData.AddrSize);
117161

118-
// Each set of tuples is terminated by a 0 for the address and 0
119-
// for the length.
120-
if (arangeDescriptor.Address == 0 && arangeDescriptor.Length == 0)
121-
return ErrorSuccess();
162+
if (arangeDescriptor.Length == 0) {
163+
// Each set of tuples is terminated by a 0 for the address and 0
164+
// for the length.
165+
if (arangeDescriptor.Address == 0 && *offset_ptr == end_offset)
166+
return ErrorSuccess();
167+
return createStringError(
168+
errc::invalid_argument,
169+
"address range table at offset 0x%" PRIx64
170+
" has an invalid tuple (length = 0) at offset 0x%" PRIx64,
171+
Offset, *offset_ptr - tuple_size);
172+
}
173+
122174
ArangeDescriptors.push_back(arangeDescriptor);
123175
}
124176

‎llvm/unittests/DebugInfo/DWARF/DWARFDebugArangeSetTest.cpp

Lines changed: 92 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,23 @@ TEST(DWARFDebugArangeSet, UnsupportedAddressSize) {
7373
"(4 and 8 supported)");
7474
}
7575

76+
TEST(DWARFDebugArangeSet, UnsupportedSegmentSelectorSize) {
77+
static const char DebugArangesSecRaw[] =
78+
"\x14\x00\x00\x00" // Length
79+
"\x02\x00" // Version
80+
"\x00\x00\x00\x00" // Debug Info Offset
81+
"\x04" // Address Size
82+
"\x04" // Segment Selector Size (not supported)
83+
// No padding
84+
"\x00\x00\x00\x00" // Termination tuple
85+
"\x00\x00\x00\x00"
86+
"\x00\x00\x00\x00";
87+
ExpectExtractError(
88+
DebugArangesSecRaw,
89+
"non-zero segment selector size in address range table at offset 0x0 "
90+
"is not supported");
91+
}
92+
7693
TEST(DWARFDebugArangeSet, NoTerminationEntry) {
7794
static const char DebugArangesSecRaw[] =
7895
"\x14\x00\x00\x00" // Length
@@ -90,12 +107,86 @@ TEST(DWARFDebugArangeSet, NoTerminationEntry) {
90107
}
91108

92109
TEST(DWARFDebugArangeSet, ReservedUnitLength) {
93-
static const char DebugArangesSecRaw[] =
110+
// Note: 12 is the minimum length to pass the basic check for the size of
111+
// the section. 1 will be automatically subtracted in ExpectExtractError().
112+
static const char DebugArangesSecRaw[12 + 1] =
94113
"\xf0\xff\xff\xff"; // Reserved unit length value
95114
ExpectExtractError(
96115
DebugArangesSecRaw,
97116
"address range table at offset 0x0 has unsupported reserved unit length "
98117
"of value 0xfffffff0");
99118
}
100119

120+
TEST(DWARFDebugArangeSet, SectionTooShort) {
121+
// Note: 1 will be automatically subtracted in ExpectExtractError().
122+
static const char DebugArangesSecRaw[11 + 1] = {0};
123+
ExpectExtractError(
124+
DebugArangesSecRaw,
125+
"section is not large enough to contain an address range table "
126+
"at offset 0x0");
127+
}
128+
129+
TEST(DWARFDebugArangeSet, SectionTooShortDWARF64) {
130+
// Note: 1 will be automatically subtracted in ExpectExtractError().
131+
static const char DebugArangesSecRaw[23 + 1] =
132+
"\xff\xff\xff\xff"; // DWARF64 mark
133+
ExpectExtractError(
134+
DebugArangesSecRaw,
135+
"section is not large enough to contain a DWARF64 address range table "
136+
"at offset 0x0");
137+
}
138+
139+
TEST(DWARFDebugArangeSet, NoSpaceForEntries) {
140+
static const char DebugArangesSecRaw[] =
141+
"\x0c\x00\x00\x00" // Length
142+
"\x02\x00" // Version
143+
"\x00\x00\x00\x00" // Debug Info Offset
144+
"\x04" // Address Size
145+
"\x00" // Segment Selector Size
146+
"\x00\x00\x00\x00" // Padding
147+
; // No entries
148+
ExpectExtractError(
149+
DebugArangesSecRaw,
150+
"address range table at offset 0x0 has an insufficient length "
151+
"to contain any entries");
152+
}
153+
154+
TEST(DWARFDebugArangeSet, UnevenLength) {
155+
static const char DebugArangesSecRaw[] =
156+
"\x1b\x00\x00\x00" // Length (not a multiple of tuple size)
157+
"\x02\x00" // Version
158+
"\x00\x00\x00\x00" // Debug Info Offset
159+
"\x04" // Address Size
160+
"\x00" // Segment Selector Size
161+
"\x00\x00\x00\x00" // Padding
162+
"\x00\x00\x00\x00" // Entry: Address
163+
"\x01\x00\x00\x00" // Length
164+
"\x00\x00\x00\x00" // Termination tuple
165+
"\x00\x00\x00\x00";
166+
ExpectExtractError(
167+
DebugArangesSecRaw,
168+
"address range table at offset 0x0 has length that is not a multiple "
169+
"of the tuple size");
170+
}
171+
172+
TEST(DWARFDebugArangeSet, ZeroLengthEntry) {
173+
static const char DebugArangesSecRaw[] =
174+
"\x24\x00\x00\x00" // Length
175+
"\x02\x00" // Version
176+
"\x00\x00\x00\x00" // Debug Info Offset
177+
"\x04" // Address Size
178+
"\x00" // Segment Selector Size
179+
"\x00\x00\x00\x00" // Padding
180+
"\x00\x00\x00\x00" // Entry1: Address
181+
"\x01\x00\x00\x00" // Length
182+
"\x01\x00\x00\x00" // Entry2: Address
183+
"\x00\x00\x00\x00" // Length (invalid)
184+
"\x00\x00\x00\x00" // Termination tuple
185+
"\x00\x00\x00\x00";
186+
ExpectExtractError(
187+
DebugArangesSecRaw,
188+
"address range table at offset 0x0 has an invalid tuple (length = 0) "
189+
"at offset 0x18");
190+
}
191+
101192
} // end anonymous namespace

0 commit comments

Comments
 (0)