[Bug gdb/34299] New: [gdb] At least 22 DWARF expression opcodes do not validate operand bounds before reading operands

https://sourceware.org/bugzilla/show_bug.cgi?id=34299

            Bug ID: 34299
           Summary: [gdb] At least 22 DWARF expression opcodes do not
                    validate operand bounds before reading operands
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: firmiana402 at gmail dot com
  Target Milestone: ---

While auditing malformed DWARF expression handling in gdb/dwarf2/expr.c, I
noticed that several opcode handlers read fixed-width operands, or perform
length-prefixed checks using unchecked pointer arithmetic, before first
verifying that the required bytes are available within the current expression.

As a result, truncated expressions are not always rejected at the point where
they first become malformed. Instead, GDB may interpret subsequent opcode bytes
or payload bytes as part of the truncated operand and only report an error
later.

From my review, this affects at least the following opcodes:

- DW_OP_deref_size / DW_OP_deref_type / DW_OP_GNU_deref_type
- DW_OP_pick
- DW_OP_addr
- DW_OP_call2 / DW_OP_call4
- DW_OP_implicit_pointer / DW_OP_GNU_implicit_pointer
- DW_OP_GNU_variable_value / DW_OP_GNU_parameter_ref
- DW_OP_bra
- DW_OP_skip
- DW_OP_const1u / DW_OP_const2u / DW_OP_const4u / DW_OP_const8u
- DW_OP_const1s / DW_OP_const2s / DW_OP_const4s / DW_OP_const8s
- DW_OP_implicit_value

I am intentionally not including DW_OP_const_type / DW_OP_GNU_const_type, 
which is already covered by a separate issue (bug #34239) 

In general, validating that sufficient bytes remain before reading an operand
is a well-established parsing practice. GDB already performs such checks in
many DWARF expression handlers, and these cases appear to be exceptions rather
than the rule.

-- 
You are receiving this mail because:
You are on the CC list for the bug.