DWARF1 AT_sibling sanity check
Patch to sanity check AT_sibling in DWARF version 1 to prevent infinite loops from fuzzed object files.
This patch introduces a sanity check for the AT_sibling attribute in DWARF version 1 debugging information. The author believes that AT_sibling usually points forward in DWARF v1, a format largely unsupported since GCC 3.3. Allowing backward AT_sibling links can lead to infinite loops when parsing fuzzed object files, impacting tools like addr2line and objdump. This change aims to prevent such issues and may break support for some older DWARF v1 files if they rely on backward links.
- proposer
Submits a patch to add a sanity check for AT_sibling in DWARF v1 to prevent potential infinite loops with fuzzed files, noting it might break support for some old files.
“If backward links are allowed then it is considerably more tedious to protect against fuzzed object files that loop forever reading DWARF1. So this patch may break addr2line and objdump -dS for some old files.”
In Details
This patch modifies bfd/dwarf1.c to add a sanity check for the AT_sibling attribute when parsing DWARF version 1 debug information. The author posits that AT_sibling pointers in DWARF v1 are generally forward-pointing and that a backward pointer could lead to infinite loops during parsing. The change updates parse_die to use a stash pointer and adds a check to ensure AT_sibling points within the current Debug Information Entry (DIE) unit. This addresses potential vulnerabilities in tools like addr2line and objdump when processing malformed DWARF v1 data, while acknowledging it…
- DWARF
- A debugging data format used by many compilers and debuggers to store information about variables, types, and code structure.
- AT_sibling
- A DWARF attribute tag that points to the next sibling Debugging Information Entry (DIE) at the same level in the DIE tree.
- DIE
- Debugging Information Entry. A unit of information within DWARF that describes a program entity like a function, variable, or type.
- addr2line
- A utility that translates addresses into file names and line numbers, using debugging information.
- objdump
- A utility that displays information from object files, including disassembled code and section contents.
- fuzzed object files
- Object files that have been intentionally corrupted or malformed (fuzzed) to test the robustness and security of the tools that process them.