xref: /OK3568_Linux_fs/yocto/poky/meta/recipes-devtools/binutils/binutils/0018-CVE-2022-38128-2.patch (revision 4882a59341e53eb6f0b4789bf948001014eff981)
1From 175b91507b83ad42607d2f6dadaf55b7b511bdbe Mon Sep 17 00:00:00 2001
2From: Alan Modra <amodra@gmail.com>
3Date: Wed, 20 Jul 2022 18:28:50 +0930
4Subject: [PATCH] miscellaneous dwarf.c tidies
5
6	* dwarf.c: Leading and trailing whitespace fixes.
7	(free_abbrev_list): New function.
8	(free_all_abbrevs): Use the above.  Free cu_abbrev_map here too.
9	(process_abbrev_set): Print actual section name on error.
10	(get_type_abbrev_from_form): Add overflow check.
11	(free_debug_memory): Don't free cu_abbrev_map here..
12	(process_debug_info): ..or here.  Warn on another case of not
13	finding a neeeded abbrev.
14
15Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=175b91507b83ad42607d2f6dadaf55b7b511bdbe]
16
17Signed-off-by: Pgowda <pgowda.cve@gmail.com>
18---
19 binutils/dwarf.c | 216 +++++++++++++++++++++++------------------------
20 1 file changed, 106 insertions(+), 110 deletions(-)
21
22diff --git a/binutils/dwarf.c b/binutils/dwarf.c
23index 2b1eec49422..267ed3bb382 100644
24--- a/binutils/dwarf.c
25+++ b/binutils/dwarf.c
26@@ -954,38 +954,41 @@ record_abbrev_list_for_cu (dwarf_vma sta
27   next_free_abbrev_map_entry ++;
28 }
29
30-static void
31-free_all_abbrevs (void)
32+static abbrev_list *
33+free_abbrev_list (abbrev_list *list)
34 {
35-  abbrev_list *  list;
36+  abbrev_entry *abbrv = list->first_abbrev;
37
38-  for (list = abbrev_lists; list != NULL;)
39+  while (abbrv)
40     {
41-      abbrev_list *   next = list->next;
42-      abbrev_entry *  abbrv;
43+      abbrev_attr *attr = abbrv->first_attr;
44
45-      for (abbrv = list->first_abbrev; abbrv != NULL;)
46+      while (attr)
47 	{
48-	  abbrev_entry *  next_abbrev = abbrv->next;
49-	  abbrev_attr *   attr;
50-
51-	  for (attr = abbrv->first_attr; attr;)
52-	    {
53-	      abbrev_attr *next_attr = attr->next;
54-
55-	      free (attr);
56-	      attr = next_attr;
57-	    }
58-
59-	  free (abbrv);
60-	  abbrv = next_abbrev;
61+	  abbrev_attr *next_attr = attr->next;
62+	  free (attr);
63+	  attr = next_attr;
64 	}
65
66-      free (list);
67-      list = next;
68+      abbrev_entry *next_abbrev = abbrv->next;
69+      free (abbrv);
70+      abbrv = next_abbrev;
71     }
72
73-  abbrev_lists = NULL;
74+  abbrev_list *next = list->next;
75+  free (list);
76+  return next;
77+}
78+
79+static void
80+free_all_abbrevs (void)
81+{
82+  while (abbrev_lists)
83+    abbrev_lists = free_abbrev_list (abbrev_lists);
84+
85+  free (cu_abbrev_map);
86+  cu_abbrev_map = NULL;
87+  next_free_abbrev_map_entry = 0;
88 }
89
90 static abbrev_list *
91@@ -1017,7 +1020,7 @@ find_abbrev_map_by_offset (dwarf_vma off
92 	&& cu_abbrev_map[i].end > offset)
93       return cu_abbrev_map + i;
94
95-  return NULL;
96+  return NULL;
97 }
98
99 static void
100@@ -1140,7 +1143,7 @@ process_abbrev_set (struct dwarf_section
101     }
102
103   /* Report the missing single zero which ends the section.  */
104-  error (_(".debug_abbrev section not zero terminated\n"));
105+  error (_("%s section not zero terminated\n"), section->name);
106
107   free (list);
108   return NULL;
109@@ -1917,7 +1920,7 @@ fetch_alt_indirect_string (dwarf_vma off
110 	dwarf_vmatoa ("x", offset));
111   return _("<offset is too big>");
112 }
113-
114+
115 static const char *
116 get_AT_name (unsigned long attribute)
117 {
118@@ -2199,7 +2202,8 @@ get_type_abbrev_from_form (unsigned long
119     case DW_FORM_ref4:
120     case DW_FORM_ref8:
121     case DW_FORM_ref_udata:
122-      if (uvalue + cu_offset > (size_t) (cu_end - section->start))
123+      if (uvalue + cu_offset < uvalue
124+	  || uvalue + cu_offset > (size_t) (cu_end - section->start))
125 	{
126 	  warn (_("Unable to resolve ref form: uvalue %lx + cu_offset %lx > CU size %lx\n"),
127 		uvalue, (long) cu_offset, (long) (cu_end - section->start));
128@@ -2236,7 +2240,7 @@ get_type_abbrev_from_form (unsigned long
129       else
130 	*map_return = NULL;
131     }
132-
133+
134   READ_ULEB (abbrev_number, data, section->start + section->size);
135
136   for (entry = map->list->first_abbrev; entry != NULL; entry = entry->next)
137@@ -2837,7 +2841,7 @@ read_and_display_attr_value (unsigned lo
138       if (!do_loc)
139 	printf ("%c<0x%s>", delimiter, dwarf_vmatoa ("x", uvalue + cu_offset));
140       break;
141-
142+
143     default:
144       warn (_("Unrecognized form: 0x%lx\n"), form);
145       /* What to do?  Consume a byte maybe?  */
146@@ -3009,7 +3013,7 @@ read_and_display_attr_value (unsigned lo
147 	      case DW_FORM_strx3:
148 	      case DW_FORM_strx4:
149 		add_dwo_name (fetch_indexed_string (uvalue, this_set, offset_size, false,
150-		                                    debug_info_p->str_offsets_base),
151+						    debug_info_p->str_offsets_base),
152 			      cu_offset);
153 		break;
154 	      case DW_FORM_string:
155@@ -3043,7 +3047,7 @@ read_and_display_attr_value (unsigned lo
156 	      case DW_FORM_strx3:
157 	      case DW_FORM_strx4:
158 		add_dwo_dir (fetch_indexed_string (uvalue, this_set, offset_size, false,
159-		                                   debug_info_p->str_offsets_base),
160+						   debug_info_p->str_offsets_base),
161 			     cu_offset);
162 		break;
163 	      case DW_FORM_string:
164@@ -3671,11 +3675,8 @@ process_debug_info (struct dwarf_section
165     introduce (section, false);
166
167   free_all_abbrevs ();
168-  free (cu_abbrev_map);
169-  cu_abbrev_map = NULL;
170-  next_free_abbrev_map_entry = 0;
171
172-  /* In order to be able to resolve DW_FORM_ref_attr forms we need
173+  /* In order to be able to resolve DW_FORM_ref_addr forms we need
174      to load *all* of the abbrevs for all CUs in this .debug_info
175      section.  This does effectively mean that we (partially) read
176      every CU header twice.  */
177@@ -4029,12 +4030,11 @@ process_debug_info (struct dwarf_section
178
179 	  /* Scan through the abbreviation list until we reach the
180 	     correct entry.  */
181-	  if (list == NULL)
182-	    continue;
183-
184-	  for (entry = list->first_abbrev; entry != NULL; entry = entry->next)
185-	    if (entry->number == abbrev_number)
186-	      break;
187+	  entry = NULL;
188+	  if (list != NULL)
189+	    for (entry = list->first_abbrev; entry != NULL; entry = entry->next)
190+	      if (entry->number == abbrev_number)
191+		break;
192
193 	  if (entry == NULL)
194 	    {
195@@ -4442,7 +4442,7 @@ display_debug_sup (struct dwarf_section
196
197   SAFE_BYTE_GET_AND_INC (is_supplementary, start, 1, end);
198   if (is_supplementary != 0 && is_supplementary != 1)
199-    warn (_("corrupt .debug_sup section: is_supplementary not 0 or 1\n"));
200+    warn (_("corrupt .debug_sup section: is_supplementary not 0 or 1\n"));
201
202   sup_filename = start;
203   if (is_supplementary && sup_filename[0] != 0)
204@@ -5621,7 +5621,7 @@ display_debug_lines_decoded (struct dwar
205 			printf ("%s  %11d  %#18" DWARF_VMA_FMT "x",
206 				newFileName, state_machine_regs.line,
207 				state_machine_regs.address);
208-		    }
209+		    }
210 		  else
211 		    {
212 		      if (xop == -DW_LNE_end_sequence)
213@@ -6075,7 +6075,7 @@ display_debug_macro (struct dwarf_sectio
214   load_debug_section_with_follow (str, file);
215   load_debug_section_with_follow (line, file);
216   load_debug_section_with_follow (str_index, file);
217-
218+
219   introduce (section, false);
220
221   while (curr < end)
222@@ -6519,7 +6519,7 @@ display_loc_list (struct dwarf_section *
223
224       /* Check base address specifiers.  */
225       if (is_max_address (begin, pointer_size)
226-          && !is_max_address (end, pointer_size))
227+	  && !is_max_address (end, pointer_size))
228 	{
229 	  base_address = end;
230 	  print_dwarf_vma (begin, pointer_size);
231@@ -6697,7 +6697,7 @@ display_loclists_list (struct dwarf_sect
232 	case DW_LLE_default_location:
233 	  begin = end = 0;
234 	  break;
235-
236+
237 	case DW_LLE_offset_pair:
238 	  READ_ULEB (begin, start, section_end);
239 	  begin += base_address;
240@@ -6993,7 +6993,7 @@ display_offset_entry_loclists (struct dw
241   unsigned char *  start = section->start;
242   unsigned char * const end = start + section->size;
243
244-  introduce (section, false);
245+  introduce (section, false);
246
247   do
248     {
249@@ -7042,14 +7042,14 @@ display_offset_entry_loclists (struct dw
250 		section->name, segment_selector_size);
251 	  return 0;
252 	}
253-
254+
255       if (offset_entry_count == 0)
256 	{
257 	  warn (_("The %s section contains a table without offset\n"),
258 		section->name);
259 	  return 0;
260 	}
261-
262+
263       printf (_("\n   Offset Entries starting at 0x%lx:\n"),
264 	      (long)(start - section->start));
265
266@@ -8295,12 +8295,12 @@ display_debug_ranges (struct dwarf_secti
267       next = section_begin + offset + debug_info_p->rnglists_base;
268
269       /* If multiple DWARF entities reference the same range then we will
270-         have multiple entries in the `range_entries' list for the same
271-         offset.  Thanks to the sort above these will all be consecutive in
272-         the `range_entries' list, so we can easily ignore duplicates
273-         here.  */
274+	 have multiple entries in the `range_entries' list for the same
275+	 offset.  Thanks to the sort above these will all be consecutive in
276+	 the `range_entries' list, so we can easily ignore duplicates
277+	 here.  */
278       if (i > 0 && last_offset == offset)
279-        continue;
280+	continue;
281       last_offset = offset;
282
283       if (dwarf_check != 0 && i > 0)
284@@ -10336,7 +10336,7 @@ display_debug_names (struct dwarf_sectio
285 		break;
286 	      if (tagno >= 0)
287 		printf ("%s<%lu>",
288-		        (tagno == 0 && second_abbrev_tag == 0 ? " " : "\n\t"),
289+			(tagno == 0 && second_abbrev_tag == 0 ? " " : "\n\t"),
290 			(unsigned long) abbrev_tag);
291
292 	      for (entry = abbrev_lookup;
293@@ -10901,7 +10901,7 @@ process_cu_tu_index (struct dwarf_sectio
294 	 Check for integer overflow (can occur when size_t is 32-bit)
295 	 with overlarge ncols or nused values.  */
296       if (nused == -1u
297-	  || _mul_overflow ((size_t) ncols, 4, &temp)
298+	  || _mul_overflow ((size_t) ncols, 4, &temp)
299 	  || _mul_overflow ((size_t) nused + 1, temp, &total)
300 	  || total > (size_t) (limit - ppool))
301 	{
302@@ -10909,7 +10909,7 @@ process_cu_tu_index (struct dwarf_sectio
303 		section->name);
304 	  return 0;
305 	}
306-
307+
308       if (do_display)
309 	{
310 	  printf (_("  Offset table\n"));
311@@ -11413,8 +11413,8 @@ add_separate_debug_file (const char * fi
312
313 static bool
314 debuginfod_fetch_separate_debug_info (struct dwarf_section * section,
315-                                      char ** filename,
316-                                      void * file)
317+				      char ** filename,
318+				      void * file)
319 {
320   size_t build_id_len;
321   unsigned char * build_id;
322@@ -11432,14 +11432,14 @@ debuginfod_fetch_separate_debug_info (st
323
324       filelen = strnlen ((const char *)section->start, section->size);
325       if (filelen == section->size)
326-        /* Corrupt debugaltlink.  */
327-        return false;
328+	/* Corrupt debugaltlink.  */
329+	return false;
330
331       build_id = section->start + filelen + 1;
332       build_id_len = section->size - (filelen + 1);
333
334       if (build_id_len == 0)
335-        return false;
336+	return false;
337     }
338   else
339     return false;
340@@ -11451,25 +11451,25 @@ debuginfod_fetch_separate_debug_info (st
341
342       client = debuginfod_begin ();
343       if (client == NULL)
344-        return false;
345+	return false;
346
347       /* Query debuginfod servers for the target file. If found its path
348-         will be stored in filename.  */
349+	 will be stored in filename.  */
350       fd = debuginfod_find_debuginfo (client, build_id, build_id_len, filename);
351       debuginfod_end (client);
352
353       /* Only free build_id if we allocated space for a hex string
354-         in get_build_id ().  */
355+	 in get_build_id ().  */
356       if (build_id_len == 0)
357-        free (build_id);
358+	free (build_id);
359
360       if (fd >= 0)
361-        {
362-          /* File successfully retrieved. Close fd since we want to
363-             use open_debug_file () on filename instead.  */
364-          close (fd);
365-          return true;
366-        }
367+	{
368+	  /* File successfully retrieved. Close fd since we want to
369+	     use open_debug_file () on filename instead.  */
370+	  close (fd);
371+	  return true;
372+	}
373     }
374
375   return false;
376@@ -11482,7 +11482,7 @@ load_separate_debug_info (const char *
377 			  parse_func_type         parse_func,
378 			  check_func_type         check_func,
379 			  void *                  func_data,
380-                          void *                  file ATTRIBUTE_UNUSED)
381+			  void *                  file ATTRIBUTE_UNUSED)
382 {
383   const char *   separate_filename;
384   char *         debug_filename;
385@@ -11597,11 +11597,11 @@ load_separate_debug_info (const char *
386                                               & tmp_filename,
387                                               file))
388       {
389-        /* File successfully downloaded from server, replace
390-           debug_filename with the file's path.  */
391-        free (debug_filename);
392-        debug_filename = tmp_filename;
393-        goto found;
394+	/* File successfully downloaded from server, replace
395+	   debug_filename with the file's path.  */
396+	free (debug_filename);
397+	debug_filename = tmp_filename;
398+	goto found;
399       }
400   }
401 #endif
402@@ -11766,12 +11766,12 @@ load_build_id_debug_file (const char * m
403   /* In theory we should extract the contents of the section into
404      a note structure and then check the fields.  For now though
405      just use hard coded offsets instead:
406-
407+
408        Field  Bytes    Contents
409 	NSize  0...3   4
410 	DSize  4...7   8+
411 	Type   8..11   3  (NT_GNU_BUILD_ID)
412-        Name   12.15   GNU\0
413+	Name   12.15   GNU\0
414 	Data   16....   */
415
416   /* FIXME: Check the name size, name and type fields.  */
417@@ -11783,7 +11783,7 @@ load_build_id_debug_file (const char * m
418       warn (_(".note.gnu.build-id data size is too small\n"));
419       return;
420     }
421-
422+
423   if (build_id_size > (section->size - 16))
424     {
425       warn (_(".note.gnu.build-id data size is too bug\n"));
426@@ -12075,10 +12075,6 @@ free_debug_memory (void)
427
428   free_all_abbrevs ();
429
430-  free (cu_abbrev_map);
431-  cu_abbrev_map = NULL;
432-  next_free_abbrev_map_entry = 0;
433-
434   free (shndx_pool);
435   shndx_pool = NULL;
436   shndx_pool_size = 0;
437