libdw: Fix crashing on illegal/zero Dwarf_Die.

In some cases we create an illegal Dwarf_Die by clearing all fields.
The idea is that dwarf_tag () on such a Dwarf_Die will return
DW_TAG_invalid, to indicate that the Dwarf_Die is unusable (and other
functions will also return errors).  But when "reconstructing" the
Dwarf_Die addr we might use the cu before realizing the Dwarf_Die is
invalid.  Fix this with an explicit NULL check and add a testcase.

Signed-off-by: Mark Wielaard <mark@klomp.org>

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 5e2c0d8..86d2b78 100644 (file)
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,9 @@
+2018-05-11  Mark Wielaard  <mark@klomp.org>
+
+       * dwarf_siblingof.c (dwarf_siblingof): Don't reference cu till it is
+       known the Dwarf_Die is came from is valid.
+       * libdwP.h (__libdw_dieabbrev): Check cu is not NULL.
+
 2018-05-08  Mark Wielaard  <mark@klomp.org>
 
        * dwarf_formref.c (__libdw_formref): Explicitly don't handle

diff --git a/libdw/dwarf_siblingof.c b/libdw/dwarf_siblingof.c
index df39c1c..613d209 100644 (file)
--- a/libdw/dwarf_siblingof.c
+++ b/libdw/dwarf_siblingof.c
@@ -58,8 +58,6 @@ dwarf_siblingof (Dwarf_Die *die, Dwarf_Die *result)
   sibattr.cu = this_die.cu;
   /* That's the address we start looking.  */
   unsigned char *addr = this_die.addr;
-  /* End of the buffer.  */
-  unsigned char *endp = sibattr.cu->endp;
 
   /* Search for the beginning of the next die on this level.  We
      must not return the dies for children of the given die.  */
@@ -96,6 +94,8 @@ dwarf_siblingof (Dwarf_Die *die, Dwarf_Die *result)
        /* This abbreviation has children.  */
        ++level;
 
+      /* End of the buffer.  */
+      unsigned char *endp = sibattr.cu->endp;
 
       while (1)
        {
@@ -125,6 +125,7 @@ dwarf_siblingof (Dwarf_Die *die, Dwarf_Die *result)
   while (level > 0);
 
   /* Maybe we reached the end of the CU.  */
+  unsigned char *endp = sibattr.cu->endp;
   if (addr >= endp)
     return 1;
 

diff --git a/libdw/libdwP.h b/libdw/libdwP.h
index 751206d..7aa290e 100644 (file)
--- a/libdw/libdwP.h
+++ b/libdw/libdwP.h
@@ -615,6 +615,8 @@ __libdw_dieabbrev (Dwarf_Die *die, const unsigned char **readp)
       /* Get the abbreviation code.  */
       unsigned int code;
       const unsigned char *addr = die->addr;
+      if (die->cu == NULL)
+       return DWARF_END_ABBREV;
       get_uleb128 (code, addr, die->cu->endp);
       if (readp != NULL)
        *readp = addr;

diff --git a/tests/ChangeLog b/tests/ChangeLog
index 8a098b4..b236ee7 100644 (file)
--- a/tests/ChangeLog
+++ b/tests/ChangeLog
@@ -1,3 +1,12 @@
+2018-05-11  Mark Wielaard  <mark@klomp.org>
+
+       * Makefile.am (check_PROGRAMS): Add get-units-invalid.
+       (TESTS): Add run-get-units-invalid.sh.
+       (EXTRA_DIST): Likewise.
+       (get_units_invalid_LDADD): New variable.
+       * get-units-invalid.c: New test program.
+       * run-get-units-invalid.sh: New test program runner.
+
 2018-05-05  Mark Wielaard  <mark@klomp.org>
 
        * testfile-dwarf-45.source: New file.

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 2f9ae23..ac16a5e 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -55,7 +55,8 @@ check_PROGRAMS = arextract arsymtest newfile saridx scnnames sectiondump \
                  getsrc_die strptr newdata elfstrtab dwfl-proc-attach \
                  elfshphehdr elfstrmerge dwelfgnucompressed elfgetchdr \
                  elfgetzdata elfputzdata zstrptr emptyfile vendorelf \
-                 fillfile dwarf_default_lower_bound dwarf-die-addr-die
+                 fillfile dwarf_default_lower_bound dwarf-die-addr-die \
+                 get-units-invalid
 
 asm_TESTS = asm-tst1 asm-tst2 asm-tst3 asm-tst4 asm-tst5 \
            asm-tst6 asm-tst7 asm-tst8 asm-tst9
@@ -138,7 +139,8 @@ TESTS = run-arextract.sh run-arsymtest.sh run-ar.sh newfile test-nlist \
        run-compress-test.sh \
        run-readelf-zdebug.sh run-readelf-zdebug-rel.sh \
        emptyfile vendorelf fillfile dwarf_default_lower_bound \
-       run-dwarf-die-addr-die.sh
+       run-dwarf-die-addr-die.sh \
+       run-get-units-invalid.sh
 
 if !BIARCH
 export ELFUTILS_DISABLE_BIARCH = 1
@@ -358,7 +360,8 @@ EXTRA_DIST = run-arextract.sh run-arsymtest.sh run-ar.sh \
             run-disasm-bpf.sh \
             testfile-bpf-dis1.expect.bz2 testfile-bpf-dis1.o.bz2 \
             testfile-m68k-core.bz2 testfile-m68k.bz2 testfile-m68k-s.bz2 \
-            run-dwarf-die-addr-die.sh
+            run-dwarf-die-addr-die.sh \
+            run-get-units-invalid.sh
 
 if USE_VALGRIND
 valgrind_cmd='valgrind -q --leak-check=full --error-exitcode=1'
@@ -517,6 +520,7 @@ vendorelf_LDADD = $(libelf)
 fillfile_LDADD = $(libelf)
 dwarf_default_lower_bound_LDADD = $(libdw)
 dwarf_die_addr_die_LDADD = $(libdw)
+get_units_invalid_LDADD = $(libdw)
 
 # We want to test the libelf header against the system elf.h header.
 # Don't include any -I CPPFLAGS.

diff --git a/tests/get-units-invalid.c b/tests/get-units-invalid.c
new file mode 100644 (file)
index 0000000..9ec16ee
--- /dev/null
+++ b/tests/get-units-invalid.c
@@ -0,0 +1,96 @@
+/* Test cudie and subdie properties.
+   Copyright (C) 2018 Red Hat, Inc.
+   This file is part of elfutils.
+
+   This file is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   elfutils is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <dwarf.h>
+#include ELFUTILS_HEADER(dw)
+#include <stdio.h>
+#include <inttypes.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+
+int
+main (int argc, char *argv[])
+{
+  for (int i = 1; i < argc; i++)
+    {
+      printf ("file: %s\n", argv[i]);
+      int fd = open (argv[i], O_RDONLY);
+      Dwarf *dbg = dwarf_begin (fd, DWARF_C_READ);
+      if (dbg == NULL)
+       {
+         printf ("%s not usable: %s\n", argv[i], dwarf_errmsg (-1));
+         return -1;
+       }
+
+      Dwarf_CU *cu = NULL;
+      Dwarf_Die cudie, subdie;
+      uint8_t unit_type;
+      while (dwarf_get_units (dbg, cu, &cu, NULL,
+                             &unit_type, &cudie, &subdie) == 0)
+       {
+         printf ("Got cudie: %s, unit_type: %" PRIx8 "\n",
+                 dwarf_diename (&cudie), unit_type);
+
+         int tag = dwarf_tag (&subdie);
+         if (unit_type == DW_UT_compile)
+           {
+             if (tag != DW_TAG_invalid)
+               {
+                 printf ("Not invalid: %x\n", dwarf_tag (&subdie));
+                 return -1;
+               }
+             if (dwarf_diename (&subdie) != NULL)
+               {
+                 printf ("Should have NULL name: %s\n",
+                         dwarf_diename (&subdie));
+                 return -1;
+               }
+             Dwarf_Die result;
+             if (dwarf_siblingof (&subdie, &result) != -1)
+               {
+                 printf ("Should NOT have a valid sibling: %s\n",
+                         dwarf_diename (&result));
+                 return -1;
+               }
+             if (dwarf_child (&subdie, &result) != -1)
+               {
+                 printf ("Should NOT have a valid child: %s\n",
+                         dwarf_diename (&result));
+                 return -1;
+               }
+           }
+         else if (unit_type == DW_UT_type)
+           printf ("subdie: %s\n", dwarf_diename (&subdie));
+         else
+           printf ("subdie tag: %x\n", dwarf_tag (&subdie));
+       }
+
+      dwarf_end (dbg);
+      close (fd);
+
+      printf ("\n");
+    }
+
+  return 0;
+}

diff --git a/tests/run-get-units-invalid.sh b/tests/run-get-units-invalid.sh
new file mode 100755 (executable)
index 0000000..66ef944
--- /dev/null
+++ b/tests/run-get-units-invalid.sh
@@ -0,0 +1,44 @@
+#! /bin/sh
+# Copyright (C) 2018 Red Hat, Inc.
+# This file is part of elfutils.
+#
+# This file is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# elfutils is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+. $srcdir/test-subr.sh
+
+# See run-typeiter.sh
+testfiles testfile-debug-types
+
+testrun ${abs_builddir}/get-units-invalid testfile-debug-types
+
+# see run-readelf-dwz-multi.sh
+testfiles testfile_multi_main testfile_multi.dwz
+
+testrun ${abs_builddir}/get-units-invalid testfile_multi_main
+
+# see tests/run-dwflsyms.sh
+testfiles testfilebazdbgppc64.debug
+
+testrun ${abs_builddir}/get-units-invalid testfilebazdbgppc64.debug
+
+# see tests/testfile-dwarf-45.source
+testfiles testfile-dwarf-4 testfile-dwarf-5
+
+testrun ${abs_builddir}/get-units-invalid testfile-dwarf-4
+testrun ${abs_builddir}/get-units-invalid testfile-dwarf-5
+
+# Self test
+testrun_on_self ${abs_builddir}/get-units-invalid
+
+exit 0