Fix CTF type parsing to prevent SIGSEGV on malformed input.
CTF type parsing code now validates input sizes against section lengths to prevent crashes.
This commit addresses a crash (SIGSEGV) in the CTF (Common Type Format) parsing library within binutils-gdb. It adds crucial sanity checks in init_static_types_internal and upgrade_types_v1 to ensure that calculated variable-length record sizes do not exceed the bounds of the type section, thus preventing buffer overflows and crashes with malformed CTF data.
In Details
Binutils CTF (Common Type Format) parsing logic. Fixes a SIGSEGV in libctf/ctf-open.c by adding bounds checks for variable byte lengths (vbytes) against the total type section size in both init_static_types_internal and upgrade_types_v1. Previously, invalid vbytes could lead to out-of-bounds reads or writes.
- CTF
- Common Type Format. A debugging data format used to describe type information, often an alternative to DWARF. It is stored within object files.
- binutils-gdb
- A project that combines the GNU Binutils (assembler, linker, etc.) and the GNU Debugger (GDB).
- SIGSEGV
- A signal raised by the operating system when a program attempts to access a memory address that it is not allowed to access, typically indicating a segmentation fault or crash.
- libctf
- The library within binutils-gdb responsible for reading and writing CTF debugging information.
- Variable-length record
- A data structure within CTF where the size is not fixed but determined by a length field or other dynamic means, requiring careful handling to avoid buffer overflows.