[libunwind] Fix UB in EHHeaderParser::findFDE

[jgorbe]

Summary

When the EHHeaderInfo object filled by decodeEHHdr has fde_count == 0, findFDE does the following:

• sets low = 0 and len = hdrInfo.fde_count as a preparation to start a binary search
• because len is 0, the binary search loop is skipped
• the code still tries to find a table entry at hdrInfo.table + low * tableEntrySize and decode it.

This is wrong when fde_count is 0, and trying to decode a table entry that isn't there will lead to reading garbage offsets and can cause segfaults.

[saugustine]

Nice catch. Probably should wait for an unwind owner to accept though.

[mstorsjo]

LGTM

[MaskRay]

It seems that the problem can be reproduced with a very simple program

Hex dump of section '.eh_frame':
  0x00016410 00000000                            ....

Linux Standard Base 5.0

The .eh_frame section shall contain 1 or more Call Frame Information (CFI) records.

So the linker always adds a frame. findFDE may work on such an empty FDE list and trigger an out-of-bound access.

[MaskRay]

libunwind/src/EHHeaderParser.hpp

112

LLVM's code style uses

if (hdrInfo.fde_count == 0)
  return false;

though there is probably not meaningful to change it now..

libunwind/src/EHHeaderParser.hpp

bool EHHeaderParser<A>::findFDE(A &addressSpace, pint_t pc, pint_t ehHdrStart,
                                 typename CFI_Parser<A>::CIE_Info *cieInfo) {
   pint_t ehHdrEnd = ehHdrStart + sectionLength;
 
   EHHeaderParser<A>::EHHeaderInfo hdrInfo;
   if (!EHHeaderParser<A>::decodeEHHdr(addressSpace, ehHdrStart, ehHdrEnd,
                                       hdrInfo))
     return false;
 
+  if (hdrInfo.fde_count == 0) return false;
+
   size_t tableEntrySize = getTableEntrySize(hdrInfo.table_enc);
   pint_t tableEntry;
 
   size_t low = 0;
   for (size_t len = hdrInfo.fde_count; len > 1;) {
     size_t mid = low + (len / 2);
     tableEntry = hdrInfo.table + mid * tableEntrySize;
     pint_t start = addressSpace.getEncodedP(tableEntry, ehHdrEnd,