commit 4581e57eb857dc3d75ed9efb56f8defaae74a65c
author Martin Storsjo <martin@martin.st> Tue Oct 24 07:16:40 2017 +0000
committer Copybara-Service <copybara-worker@google.com> Fri Aug 28 11:04:22 2020 -0700
tree dbddd1bab2fb83573fda9af4ee4293212d9c4a06
parent 83fc2d9025bf121df346cb47180bf11af6658f31

Add missing checks for register number

Most other cases that touch savedRegisters[reg] have got this check,
but these three seemed to lack it.

Differential Revision: https://reviews.llvm.org/D39206

llvm-svn: 316415
GitOrigin-RevId: d3abd15d8cd9455bc7b1eeb2e6f4b4d0047a0dd6

src/DwarfParser.hpp

diff --git a/src/DwarfParser.hpp b/src/DwarfParser.hpp
index 3c98d30..d45ad49 100644
--- a/src/DwarfParser.hpp
+++ b/src/DwarfParser.hpp
@@ -605,6 +605,13 @@
       break;
     case DW_CFA_val_offset:
       reg = addressSpace.getULEB128(p, instructionsEnd);
+      if (reg > kMaxRegisterNumber) {
+        fprintf(stderr,
+                "malformed DW_CFA_val_offset DWARF unwind, reg (%" PRIu64
+                ") out of range\n",
+                reg);
+        return false;
+      }
       offset = (int64_t)addressSpace.getULEB128(p, instructionsEnd)
                                                     * cieInfo.dataAlignFactor;
       results->savedRegisters[reg].location = kRegisterOffsetFromCFA;
@@ -668,6 +675,12 @@
       switch (opcode & 0xC0) {
       case DW_CFA_offset:
         reg = operand;
+        if (reg > kMaxRegisterNumber) {
+          fprintf(stderr, "malformed DW_CFA_offset DWARF unwind, reg (%" PRIu64
+                          ") out of range\n",
+                  reg);
+          return false;
+        }
         offset = (int64_t)addressSpace.getULEB128(p, instructionsEnd)
                                                     * cieInfo.dataAlignFactor;
         results->savedRegisters[reg].location = kRegisterInCFA;
@@ -682,6 +695,12 @@
         break;
       case DW_CFA_restore:
         reg = operand;
+        if (reg > kMaxRegisterNumber) {
+          fprintf(stderr, "malformed DW_CFA_restore DWARF unwind, reg (%" PRIu64
+                          ") out of range\n",
+                  reg);
+          return false;
+        }
         results->savedRegisters[reg] = initialState.savedRegisters[reg];
         _LIBUNWIND_TRACE_DWARF("DW_CFA_restore(reg=%" PRIu64 ")\n",
                                static_cast<uint64_t>(operand));