Re: [Libunwind-devel] [PATCH] Check that the CIE is within the segment

[Arun Sharma]

The logic looks good to me. Could you resend the patch replacing tabs
with spaces?

On Wed, Nov 26, 2014 at 2:40 AM, Peter Wu <address@hidden> wrote:
> Due to a bug in the gold linker[1], the .eh_frame and .eh_frame_hdr
> sections contains garbage. When dwarf_extract_proc_info_from_fde tried
> to look up the begin of the CIE subsection, it would underflow the
> .eh_frame segment, resulting in a crash[2].
>
> This patch avoids that crash by checking whether the CIE pointer is
> located after the begin of the .eh_frame section. The variable "base"
> was misused in various places as a boolean (decode as .debug_frame or
> decode as .eh_frame). These instances have been renamed to
> is_debug_frame where applicable.
>
> Tested on Linux x86_64.
>
>  [1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17639
>  [2]: 
> http://lists.nongnu.org/archive/html/libunwind-devel/2014-11/msg00009.html
>
> Signed-off-by: Peter Wu <address@hidden>
[...]
>
> diff --git a/src/dwarf/Gfind_proc_info-lsb.c b/src/dwarf/Gfind_proc_info-lsb.c
> index e1bfbe7..32f165a 100644
> --- a/src/dwarf/Gfind_proc_info-lsb.c
> +++ b/src/dwarf/Gfind_proc_info-lsb.c
[..]
> @@ -902,6 +904,8 @@ dwarf_search_unwind_table (unw_addr_space_t as, 
> unw_word_t ip,
>              "fde_addr = %lx\n", (long) e->fde_offset, (long) segbase,
>              (long) debug_frame_base, (long) fde_addr);
>    if ((ret = dwarf_extract_proc_info_from_fde (as, a, &fde_addr, pi,
> +                                               debug_frame_base ?
> +                                               debug_frame_base : segbase,
>                                                 need_unwind_info,
>                                                 debug_frame_base, arg)) < 0)
>      return ret;

May be cleaner to use debug_frame_base != 0 to indicate that it's a boolean.

 -Arun