[Lldb-commits] [lldb] [lldb/DWARF] Make sure bad abbreviation codes do not crash lldb (PR #93006)
Pavel Labath via lldb-commits
lldb-commits at lists.llvm.org
Thu May 23 02:14:02 PDT 2024
https://github.com/labath updated https://github.com/llvm/llvm-project/pull/93006
>From 03ab6febc0f40d0f39f533a5b4fd7c33a6728ae1 Mon Sep 17 00:00:00 2001
From: Pavel Labath <pavel at labath.sk>
Date: Tue, 21 May 2024 15:31:23 +0000
Subject: [PATCH 1/2] [lldb/DWARF] Make sure bad abbreviation codes do not
crash lldb
We currently cannot represent abbreviation codes with more than 16 bits,
and we were lldb-asserting if we ever ran into one. While I haven't seen
any real DWARF with these kinds of abbreviations, it is possible to hit
this with handcrafted evil dwarf, due some sort of corruptions, or just
bugs (the addition of PeekDIEName makes these bugs more likely, as the
function blindly dereferences offsets within the debug info section) .
Missing abbreviations were already reporting an error. This patch turns
sure that large abbreviations into an error as well, and adds a test for
both cases.
---
.../SymbolFile/DWARF/DWARFDebugInfoEntry.cpp | 34 +++++++-------
.../DWARF/x86/invalid_abbreviation.s | 47 +++++++++++++++++++
2 files changed, 63 insertions(+), 18 deletions(-)
create mode 100644 lldb/test/Shell/SymbolFile/DWARF/x86/invalid_abbreviation.s
diff --git a/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp b/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
index 1b0fefedf9836..4357ccb2f5c9f 100644
--- a/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
+++ b/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
@@ -11,6 +11,7 @@
#include <cassert>
#include <algorithm>
+#include <limits>
#include <optional>
#include "llvm/Support/LEB128.h"
@@ -44,10 +45,20 @@ bool DWARFDebugInfoEntry::Extract(const DWARFDataExtractor &data,
const DWARFUnit *cu,
lldb::offset_t *offset_ptr) {
m_offset = *offset_ptr;
+ auto report_error = [&](const char *fmt, const auto &...vals) {
+ cu->GetSymbolFileDWARF().GetObjectFile()->GetModule()->ReportError(
+ "[{0:x16}]: {1}, please file a bug and "
+ "attach the file at the start of this error message",
+ static_cast<uint64_t>(m_offset), llvm::formatv(fmt, vals...));
+ *offset_ptr = std::numeric_limits<lldb::offset_t>::max();
+ return false;
+ };
+
m_parent_idx = 0;
m_sibling_idx = 0;
const uint64_t abbr_idx = data.GetULEB128(offset_ptr);
- lldbassert(abbr_idx <= UINT16_MAX);
+ if (abbr_idx > std::numeric_limits<uint16_t>::max())
+ return report_error("abbreviation code {0} too big", abbr_idx);
m_abbr_idx = abbr_idx;
if (m_abbr_idx == 0) {
@@ -57,16 +68,9 @@ bool DWARFDebugInfoEntry::Extract(const DWARFDataExtractor &data,
}
const auto *abbrevDecl = GetAbbreviationDeclarationPtr(cu);
- if (abbrevDecl == nullptr) {
- cu->GetSymbolFileDWARF().GetObjectFile()->GetModule()->ReportError(
- "[{0:x16}]: invalid abbreviation code {1}, "
- "please file a bug and "
- "attach the file at the start of this error message",
- (uint64_t)m_offset, (unsigned)abbr_idx);
- // WE can't parse anymore if the DWARF is borked...
- *offset_ptr = UINT32_MAX;
- return false;
- }
+ if (abbrevDecl == nullptr)
+ return report_error("invalid abbreviation code {0}", abbr_idx);
+
m_tag = abbrevDecl->getTag();
m_has_children = abbrevDecl->hasChildren();
// Skip all data in the .debug_info or .debug_types for the attributes
@@ -74,13 +78,7 @@ bool DWARFDebugInfoEntry::Extract(const DWARFDataExtractor &data,
if (DWARFFormValue::SkipValue(attribute.Form, data, offset_ptr, cu))
continue;
- cu->GetSymbolFileDWARF().GetObjectFile()->GetModule()->ReportError(
- "[{0:x16}]: Unsupported DW_FORM_{1:x}, please file a bug "
- "and "
- "attach the file at the start of this error message",
- (uint64_t)m_offset, (unsigned)attribute.Form);
- *offset_ptr = m_offset;
- return false;
+ return report_error("Unsupported DW_FORM_{1:x}", attribute.Form);
}
return true;
}
diff --git a/lldb/test/Shell/SymbolFile/DWARF/x86/invalid_abbreviation.s b/lldb/test/Shell/SymbolFile/DWARF/x86/invalid_abbreviation.s
new file mode 100644
index 0000000000000..3f32c037aeb20
--- /dev/null
+++ b/lldb/test/Shell/SymbolFile/DWARF/x86/invalid_abbreviation.s
@@ -0,0 +1,47 @@
+# REQUIRES: x86
+
+# RUN: llvm-mc -triple=x86_64-pc-linux -filetype=obj %s > %t
+# RUN: %lldb %t \
+# RUN: -o exit 2>&1 | FileCheck %s
+
+# CHECK-DAG: error: {{.*}} [0x0000000000000022]: abbreviation code 65536 too big, please file a bug and attach the file at the start of this error message
+# CHECK-DAG: error: {{.*}} [0x0000000000000048]: invalid abbreviation code 47, please file a bug and attach the file at the start of this error message
+
+
+ .section .debug_abbrev,"", at progbits
+ .uleb128 65535 # Largest representable Abbreviation Code
+ .byte 17 # DW_TAG_compile_unit
+ .byte 1 # DW_CHILDREN_yes
+ .byte 37 # DW_AT_producer
+ .byte 8 # DW_FORM_string
+ .byte 0 # EOM(1)
+ .byte 0 # EOM(2)
+ .byte 0 # EOM(3)
+
+ .section .debug_info,"", at progbits
+.Lcu_begin0:
+ .long .Ldebug_info_end0-.Ldebug_info_start0 # Length of Unit
+.Ldebug_info_start0:
+ .short 5 # DWARF version number
+ .byte 1 # DWARF Unit Type
+ .byte 8 # Address Size (in bytes)
+ .long .debug_abbrev # Offset Into Abbrev. Section
+ .uleb128 65535 # DW_TAG_compile_unit
+ .asciz "Hand-written DWARF" # DW_AT_producer
+ .uleb128 65536 # Unrepresentable abbreviation
+ .byte 0 # End Of Children Mark
+.Ldebug_info_end0:
+
+ .section .debug_info,"", at progbits
+.Lcu_begin1:
+ .long .Ldebug_info_end1-.Ldebug_info_start1 # Length of Unit
+.Ldebug_info_start1:
+ .short 5 # DWARF version number
+ .byte 1 # DWARF Unit Type
+ .byte 8 # Address Size (in bytes)
+ .long .debug_abbrev # Offset Into Abbrev. Section
+ .uleb128 65535 # DW_TAG_compile_unit
+ .asciz "Hand-written DWARF" # DW_AT_producer
+ .byte 47 # Missing abbreviation
+ .byte 0 # End Of Children Mark
+.Ldebug_info_end1:
>From 834f830760c7909d53b4d5b5c0795f1edb626af0 Mon Sep 17 00:00:00 2001
From: Pavel Labath <pavel at labath.sk>
Date: Thu, 23 May 2024 09:11:32 +0000
Subject: [PATCH 2/2] pointer -> reference
---
.../Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp | 8 ++++----
.../source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h | 2 +-
lldb/source/Plugins/SymbolFile/DWARF/DWARFUnit.cpp | 6 +++---
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp b/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
index 4357ccb2f5c9f..688a287a06500 100644
--- a/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
+++ b/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.cpp
@@ -42,11 +42,11 @@ extern int g_verbose;
// Extract a debug info entry for a given DWARFUnit from the data
// starting at the offset in offset_ptr
bool DWARFDebugInfoEntry::Extract(const DWARFDataExtractor &data,
- const DWARFUnit *cu,
+ const DWARFUnit &unit,
lldb::offset_t *offset_ptr) {
m_offset = *offset_ptr;
auto report_error = [&](const char *fmt, const auto &...vals) {
- cu->GetSymbolFileDWARF().GetObjectFile()->GetModule()->ReportError(
+ unit.GetSymbolFileDWARF().GetObjectFile()->GetModule()->ReportError(
"[{0:x16}]: {1}, please file a bug and "
"attach the file at the start of this error message",
static_cast<uint64_t>(m_offset), llvm::formatv(fmt, vals...));
@@ -67,7 +67,7 @@ bool DWARFDebugInfoEntry::Extract(const DWARFDataExtractor &data,
return true; // NULL debug tag entry
}
- const auto *abbrevDecl = GetAbbreviationDeclarationPtr(cu);
+ const auto *abbrevDecl = GetAbbreviationDeclarationPtr(&unit);
if (abbrevDecl == nullptr)
return report_error("invalid abbreviation code {0}", abbr_idx);
@@ -75,7 +75,7 @@ bool DWARFDebugInfoEntry::Extract(const DWARFDataExtractor &data,
m_has_children = abbrevDecl->hasChildren();
// Skip all data in the .debug_info or .debug_types for the attributes
for (const auto &attribute : abbrevDecl->attributes()) {
- if (DWARFFormValue::SkipValue(attribute.Form, data, offset_ptr, cu))
+ if (DWARFFormValue::SkipValue(attribute.Form, data, offset_ptr, &unit))
continue;
return report_error("Unsupported DW_FORM_{1:x}", attribute.Form);
diff --git a/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h b/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h
index c19fa74285490..6773b00e82069 100644
--- a/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h
+++ b/lldb/source/Plugins/SymbolFile/DWARF/DWARFDebugInfoEntry.h
@@ -49,7 +49,7 @@ class DWARFDebugInfoEntry {
void BuildFunctionAddressRangeTable(DWARFUnit *cu,
DWARFDebugAranges *debug_aranges) const;
- bool Extract(const DWARFDataExtractor &data, const DWARFUnit *cu,
+ bool Extract(const DWARFDataExtractor &data, const DWARFUnit &cu,
lldb::offset_t *offset_ptr);
using Recurse = DWARFBaseDIE::Recurse;
diff --git a/lldb/source/Plugins/SymbolFile/DWARF/DWARFUnit.cpp b/lldb/source/Plugins/SymbolFile/DWARF/DWARFUnit.cpp
index 3a57ec970b071..66a762bf9b685 100644
--- a/lldb/source/Plugins/SymbolFile/DWARF/DWARFUnit.cpp
+++ b/lldb/source/Plugins/SymbolFile/DWARF/DWARFUnit.cpp
@@ -63,7 +63,7 @@ void DWARFUnit::ExtractUnitDIENoDwoIfNeeded() {
// parse
const DWARFDataExtractor &data = GetData();
if (offset < GetNextUnitOffset() &&
- m_first_die.Extract(data, this, &offset)) {
+ m_first_die.Extract(data, *this, &offset)) {
AddUnitDIE(m_first_die);
return;
}
@@ -242,7 +242,7 @@ void DWARFUnit::ExtractDIEsRWLocked() {
die_index_stack.reserve(32);
die_index_stack.push_back(0);
bool prev_die_had_children = false;
- while (offset < next_cu_offset && die.Extract(data, this, &offset)) {
+ while (offset < next_cu_offset && die.Extract(data, *this, &offset)) {
const bool null_die = die.IsNULL();
if (depth == 0) {
assert(m_die_array.empty() && "Compile unit DIE already added");
@@ -670,7 +670,7 @@ DWARFUnit::GetDIE(dw_offset_t die_offset) {
llvm::StringRef DWARFUnit::PeekDIEName(dw_offset_t die_offset) {
DWARFDebugInfoEntry die;
- if (!die.Extract(GetData(), this, &die_offset))
+ if (!die.Extract(GetData(), *this, &die_offset))
return llvm::StringRef();
// Does die contain a DW_AT_Name?
More information about the lldb-commits
mailing list