From 822a06cd87496278298ab3167d6bb5968762ec20 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Mon, 18 Jun 2018 00:23:48 +0200 Subject: [PATCH] libdw: dwarf_peel_type break long chains/cycles. Limit the number of chained modifiers to 64 (that is 8 chains for all 8 modifiers, most of which cannot be chained). This prevents loops in the DWARF DIE DW_AT_type references. Signed-off-by: Mark Wielaard --- libdw/ChangeLog | 4 ++++ libdw/dwarf_peel_type.c | 23 ++++++++++++++--------- 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/libdw/ChangeLog b/libdw/ChangeLog index 1e41e72..2f7ac2c 100644 --- a/libdw/ChangeLog +++ b/libdw/ChangeLog @@ -1,5 +1,9 @@ 2018-06-18 Mark Wielaard + * dwarf_peel_type.c (dwarf_peel_type): Limit modifier chain to 64. + +2018-06-18 Mark Wielaard + * dwarf_aggregate_size.c (aggregate_size): Check die is not NULL. 2018-06-17 Luiz Angelo Daros de Luca diff --git a/libdw/dwarf_peel_type.c b/libdw/dwarf_peel_type.c index 6bbfd42..59fc6f1 100644 --- a/libdw/dwarf_peel_type.c +++ b/libdw/dwarf_peel_type.c @@ -46,14 +46,19 @@ dwarf_peel_type (Dwarf_Die *die, Dwarf_Die *result) *result = *die; tag = INTUSE (dwarf_tag) (result); - while (tag == DW_TAG_typedef - || tag == DW_TAG_const_type - || tag == DW_TAG_volatile_type - || tag == DW_TAG_restrict_type - || tag == DW_TAG_atomic_type - || tag == DW_TAG_immutable_type - || tag == DW_TAG_packed_type - || tag == DW_TAG_shared_type) + +/* Stack 8 of all these modifiers, after that it gets silly. */ +#define MAX_DEPTH (8 * 8) + int max_depth = MAX_DEPTH; + while ((tag == DW_TAG_typedef + || tag == DW_TAG_const_type + || tag == DW_TAG_volatile_type + || tag == DW_TAG_restrict_type + || tag == DW_TAG_atomic_type + || tag == DW_TAG_immutable_type + || tag == DW_TAG_packed_type + || tag == DW_TAG_shared_type) + && max_depth-- > 0) { Dwarf_Attribute attr_mem; Dwarf_Attribute *attr = INTUSE (dwarf_attr_integrate) (result, DW_AT_type, @@ -67,7 +72,7 @@ dwarf_peel_type (Dwarf_Die *die, Dwarf_Die *result) tag = INTUSE (dwarf_tag) (result); } - if (tag == DW_TAG_invalid) + if (tag == DW_TAG_invalid || max_depth <= 0) return -1; return 0; -- 2.7.4