Pool section entries for DWP version 1
authorAlan Modra <amodra@gmail.com>
Sun, 30 Oct 2022 08:38:51 +0000 (19:08 +1030)
committerAlan Modra <amodra@gmail.com>
Sun, 30 Oct 2022 09:00:42 +0000 (19:30 +1030)
commit28750e3b967da2207d51cbce9fc8be262817ee59
treef54605d10a3631b1a2117c2e14737ce1d35a0dc6
parent60095ba3b8f8ba26a6389dded732fa446422c98f
Pool section entries for DWP version 1

Ref: https://gcc.gnu.org/wiki/DebugFissionDWP?action=recall&rev=3

Fuzzers have found a weakness in the code stashing pool section
entries.  With random nonsensical values in the index entries (rather
than each index pointing to its own set distinct from other sets),
it's possible to overflow the space allocated, losing the NULL
terminator.  Without a terminator, find_section_in_set can run off the
end of the shndx_pool buffer.  Fix this by scanning the pool directly.

binutils/
* dwarf.c (add_shndx_to_cu_tu_entry): Delete range check.
(end_cu_tu_entry): Likewise.
(process_cu_tu_index): Fill shndx_pool by directly scanning
pool, rather than indirectly from index entries.
binutils/dwarf.c