This is an archive of the discontinued LLVM Phabricator instance.

Fix buffer overflow for fixed_form_sizes
ClosedPublic

Authored by tberghammer on Aug 21 2015, 7:12 AM.

Details

Summary

Fix buffer overflow for fixed_form_sizes

The array is indexed by the value in the DW_FORM filed what can be
bigger then the size of the array. This CL add bound checking to avoid
buffer overflows.

Note: This CL is part of a long series of CLs to add fission support to LLDB

Diff Detail

Repository
rL LLVM

Event Timeline

tberghammer retitled this revision from to Fix buffer overflow for fixed_form_sizes.
tberghammer updated this object.
tberghammer added reviewers: labath, clayborg.
tberghammer added a subscriber: lldb-commits.
labath added inline comments.Aug 21 2015, 7:35 AM
source/Plugins/SymbolFile/DWARF/DWARFFormValue.cpp
24 ↗(On Diff #32827)

Will these be linker-initialized? As I understand it, we are trying to avoid static constructors..

source/Plugins/SymbolFile/DWARF/DWARFFormValue.h
39 ↗(On Diff #32827)

I don't think hiding const in the type name is a good idea. It makes it quite hard to tell you are declaring constant arrays below.

clayborg requested changes to this revision.Aug 21 2015, 9:28 AM
clayborg edited edge metadata.

See inlined comments.

source/Plugins/SymbolFile/DWARF/DWARFCompileUnit.cpp
179 ↗(On Diff #32827)

Please don't use auto for simple types. For template types yes (for things like "std::vector<int>::iterator", but not for simple types.

665 ↗(On Diff #32827)

Please don't use auto for simple types. For template types yes (for things like "std::vector<int>::iterator", but not for simple types.

source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
161 ↗(On Diff #32827)

This should be a method on DWARFFormValue::FixedFormSizes.

1286 ↗(On Diff #32827)

This should be a method on DWARFFormValue::FixedFormSizes.

source/Plugins/SymbolFile/DWARF/DWARFDebugPubnames.cpp
91 ↗(On Diff #32827)

"DWARFFormValue::FixedFormSizes *" instead of "auto".

source/Plugins/SymbolFile/DWARF/DWARFFormValue.cpp
23–24 ↗(On Diff #32827)

You could probably leave these as "static uint8_t g_form_sizes_addr4[]" and then have the new DWARFFormValue::FixedFormSizes struct/class that we make get intialized with these const arrays and do the bounds checking. This would avoid static constructors and also provide bounds checking.

60–61 ↗(On Diff #32827)

You could probably leave these as "static uint8_t g_form_sizes_addr8[]" and then have the new DWARFFormValue::FixedFormSizes struct/class that we make get intialized with these const arrays and do the bounds checking. This would avoid static constructors and also provide bounds checking.

99–100 ↗(On Diff #32827)

Ditto above comment.

136–151 ↗(On Diff #32827)

Change this function to use the original static arrays and construct a DWARFFormValue::FixedFormSizes with a pointer and array size to provide bounds checking. No need to use a std::vector for const data.

source/Plugins/SymbolFile/DWARF/DWARFFormValue.h
39 ↗(On Diff #32827)

Make this a struct and add a method to access the form size by form so we don't have the following code in multiple places:

const uint8_t fixed_skip_size = form < fixed_form_sizes->size() ? fixed_form_sizes->at(form) : 0;
source/Plugins/SymbolFile/DWARF/SymbolFileDWARF.cpp
4056 ↗(On Diff #32827)

No auto

4058 ↗(On Diff #32827)

use DWARFFormValue::FixedFormSizes form accessor function.

4080 ↗(On Diff #32827)

no auto

4082 ↗(On Diff #32827)

use DWARFFormValue::FixedFormSizes form accessor function.

source/Symbol/ClangASTContext.cpp
8944 ↗(On Diff #32827)

no auto

9464 ↗(On Diff #32827)

no auto

9823 ↗(On Diff #32827)

no auto

10405 ↗(On Diff #32827)

no auto

10583 ↗(On Diff #32827)

no auto

This revision now requires changes to proceed.Aug 21 2015, 9:28 AM
tberghammer edited edge metadata.

Address review comments

tberghammer added inline comments.Aug 24 2015, 4:56 AM
source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h
165 ↗(On Diff #32946)

Note: Get attributes have to make a copy of fixed_form_sizes because it query a new fixed_form_sizes object if an empty object was passed in.

clayborg accepted this revision.Aug 24 2015, 9:40 AM
clayborg edited edge metadata.

Looks good.

This revision is now accepted and ready to land.Aug 24 2015, 9:40 AM
This revision was automatically updated to reflect the committed changes.