This is an archive of the discontinued LLVM Phabricator instance.

Fix buffer overflow for fixed_form_sizes
ClosedPublic

Authored by tberghammer on Aug 21 2015, 7:12 AM.

Details

Summary

Fix buffer overflow for fixed_form_sizes

The array is indexed by the value in the DW_FORM filed what can be
bigger then the size of the array. This CL add bound checking to avoid
buffer overflows.

Note: This CL is part of a long series of CLs to add fission support to LLDB

Diff Detail

Event Timeline

tberghammer retitled this revision from to Fix buffer overflow for fixed_form_sizes.
tberghammer updated this object.
tberghammer added reviewers: labath, clayborg.
tberghammer added a subscriber: lldb-commits.
labath added inline comments.Aug 21 2015, 7:35 AM
source/Plugins/SymbolFile/DWARF/DWARFFormValue.cpp
25

Will these be linker-initialized? As I understand it, we are trying to avoid static constructors..

source/Plugins/SymbolFile/DWARF/DWARFFormValue.h
39

I don't think hiding const in the type name is a good idea. It makes it quite hard to tell you are declaring constant arrays below.

clayborg requested changes to this revision.Aug 21 2015, 9:28 AM
clayborg edited edge metadata.

See inlined comments.

source/Plugins/SymbolFile/DWARF/DWARFCompileUnit.cpp
179–180

Please don't use auto for simple types. For template types yes (for things like "std::vector<int>::iterator", but not for simple types.

665–666

Please don't use auto for simple types. For template types yes (for things like "std::vector<int>::iterator", but not for simple types.

source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
161

This should be a method on DWARFFormValue::FixedFormSizes.

1281

This should be a method on DWARFFormValue::FixedFormSizes.

source/Plugins/SymbolFile/DWARF/DWARFDebugPubnames.cpp
90–92

"DWARFFormValue::FixedFormSizes *" instead of "auto".

source/Plugins/SymbolFile/DWARF/DWARFFormValue.cpp
24–25

You could probably leave these as "static uint8_t g_form_sizes_addr4[]" and then have the new DWARFFormValue::FixedFormSizes struct/class that we make get intialized with these const arrays and do the bounds checking. This would avoid static constructors and also provide bounds checking.

63–64

You could probably leave these as "static uint8_t g_form_sizes_addr8[]" and then have the new DWARFFormValue::FixedFormSizes struct/class that we make get intialized with these const arrays and do the bounds checking. This would avoid static constructors and also provide bounds checking.

103–104

Ditto above comment.

139–154

Change this function to use the original static arrays and construct a DWARFFormValue::FixedFormSizes with a pointer and array size to provide bounds checking. No need to use a std::vector for const data.

source/Plugins/SymbolFile/DWARF/DWARFFormValue.h
39

Make this a struct and add a method to access the form size by form so we don't have the following code in multiple places:

const uint8_t fixed_skip_size = form < fixed_form_sizes->size() ? fixed_form_sizes->at(form) : 0;
source/Plugins/SymbolFile/DWARF/SymbolFileDWARF.cpp
4045–4048

No auto

4050

use DWARFFormValue::FixedFormSizes form accessor function.

4072–4075

no auto

4077

use DWARFFormValue::FixedFormSizes form accessor function.

source/Symbol/ClangASTContext.cpp
8944–8946

no auto

9465–9467

no auto

9825–9827

no auto

10403–10405

no auto

10581–10583

no auto

This revision now requires changes to proceed.Aug 21 2015, 9:28 AM
tberghammer edited edge metadata.

Address review comments

tberghammer added inline comments.Aug 24 2015, 4:56 AM
source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h
165

Note: Get attributes have to make a copy of fixed_form_sizes because it query a new fixed_form_sizes object if an empty object was passed in.

clayborg accepted this revision.Aug 24 2015, 9:40 AM
clayborg edited edge metadata.

Looks good.

This revision is now accepted and ready to land.Aug 24 2015, 9:40 AM
This revision was automatically updated to reflect the committed changes.