[PATCH] D41615: [DebugInfo] Don't crash when given invalid DWARFv5 line table prologue.

[David Blaikie via llvm-commits]

On Thu, Dec 28, 2017 at 8:56 AM Jonas Devlieghere via Phabricator via
llvm-commits <llvm-commits at lists.llvm.org> wrote:

> JDevlieghere created this revision.
> JDevlieghere added reviewers: probinson, aprantl.
> JDevlieghere added a project: debug-info.
>
> This patch replaces an assertion with an explicit check for the validity
> of the FORM parameters. The assertion was triggered when the DWARFv5
> line table contained a zero address size.
>
> This fixes OSS-Fuzz Issue 4644
> https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4644
>
>
> Repository:
>   rL LLVM
>
> https://reviews.llvm.org/D41615
>
> Files:
>   include/llvm/DebugInfo/DWARF/DWARFFormValue.h
>   lib/DebugInfo/DWARF/DWARFDebugLine.cpp
>   lib/DebugInfo/DWARF/DWARFFormValue.cpp
>   test/DebugInfo/Inputs/invalid.linetable
>   test/DebugInfo/dwarfdump-invalid-line-table.test
>
>
> Index: test/DebugInfo/dwarfdump-invalid-line-table.test
> ===================================================================
> --- /dev/null
> +++ test/DebugInfo/dwarfdump-invalid-line-table.test
> @@ -0,0 +1,5 @@
> +Verify that dwarfdump doesn't crash on invalid line table prologue.
> +OSS-Fuzz Issue 4644 (
> https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4644)
> +
> +RUN: llvm-dwarfdump --verbose %p/Inputs/invalid.linetable 2>&1 |
> FileCheck %s --check-prefix=INVALID-LINE-TABLE
> +INVALID-LINE-TABLE: invalid directory or file table description
> Index: lib/DebugInfo/DWARF/DWARFFormValue.cpp
> ===================================================================
> --- lib/DebugInfo/DWARF/DWARFFormValue.cpp
> +++ lib/DebugInfo/DWARF/DWARFFormValue.cpp
> @@ -64,8 +64,10 @@
>                                   const DWARFFormParams Params) {
>    switch (Form) {
>    case DW_FORM_addr:
> -    assert(Params.Version && Params.AddrSize && "Invalid Params for
> form");
> -    return Params.AddrSize;
> +    if (Params)
> +      return Params.AddrSize;
> +    else
> +      return None;
>

Don't use else after return (instead use:
  if (x)
    return y;
  return z;
)

>
>    case DW_FORM_block:          // ULEB128 length L followed by L bytes.
>    case DW_FORM_block1:         // 1 byte length L followed by L bytes.
> @@ -86,8 +88,10 @@
>      return None;
>
>    case DW_FORM_ref_addr:
> -    assert(Params.Version && Params.AddrSize && "Invalid Params for
> form");
> -    return Params.getRefAddrByteSize();
> +    if (Params)
> +      return Params.getRefAddrByteSize();
> +    else
> +      return None;
>
>    case DW_FORM_flag:
>    case DW_FORM_data1:
> @@ -118,8 +122,10 @@
>    case DW_FORM_line_strp:
>    case DW_FORM_sec_offset:
>    case DW_FORM_strp_sup:
> -    assert(Params.Version && Params.AddrSize && "Invalid Params for
> form");
> -    return Params.getDwarfOffsetByteSize();
> +    if (Params)
> +      return Params.getDwarfOffsetByteSize();
> +    else
> +      return None;
>
>    case DW_FORM_data8:
>    case DW_FORM_ref8:
> Index: lib/DebugInfo/DWARF/DWARFDebugLine.cpp
> ===================================================================
> --- lib/DebugInfo/DWARF/DWARFDebugLine.cpp
> +++ lib/DebugInfo/DWARF/DWARFDebugLine.cpp
> @@ -268,7 +268,7 @@
>
>    if (getVersion() >= 5) {
>      if (!parseV5DirFileTables(DebugLineData, OffsetPtr, EndPrologueOffset,
> -                              getFormParams(), U, HasMD5,
> IncludeDirectories,
> +                              FormParams, U, HasMD5, IncludeDirectories,
>                                FileNames)) {
>        fprintf(stderr,
>                "warning: parsing line table prologue at 0x%8.8" PRIx64
> Index: include/llvm/DebugInfo/DWARF/DWARFFormValue.h
> ===================================================================
> --- include/llvm/DebugInfo/DWARF/DWARFFormValue.h
> +++ include/llvm/DebugInfo/DWARF/DWARFFormValue.h
> @@ -50,6 +50,8 @@
>      }
>      llvm_unreachable("Invalid Format value");
>    }
> +
> +  explicit operator bool() const { return Version && AddrSize; }
>  };
>
>  class DWARFFormValue {
>
>
> _______________________________________________
> llvm-commits mailing list
> llvm-commits at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180102/0d0deee8/attachment.html>