commit 6884142cd6c0febd8a2d6d17454718f75f10e3b0
author Jorge Gorbe Moya <jgorbe@google.com> Tue Apr 07 14:44:42 2020 -0700
committer Copybara-Service <copybara-worker@google.com> Fri Aug 28 11:16:35 2020 -0700
tree 7506b286fe92d45bd893589f19ebf2ecf0971ebd
parent ee7f21ea4a84871d0e6d085d93b49a876656d0a8

[libunwind] Fix UB in EHHeaderParser::findFDE

When the EHHeaderInfo object filled by decodeEHHdr has fde_count == 0,
findFDE does the following:

- sets low = 0 and len = hdrInfo.fde_count as a preparation to start a
  binary search
- because len is 0, the binary search loop is skipped
- the code still tries to find a table entry at
  hdrInfo.table + low * tableEntrySize, and decode it.

This is wrong when fde_count is 0, and trying to decode a table entry
that isn't there will lead to reading garbage offsets and can cause
segfaults.

Differential Revision: https://reviews.llvm.org/D77679

GitOrigin-RevId: 82576d6fecfec71725eb900111c000d772002449

src/EHHeaderParser.hpp

diff --git a/src/EHHeaderParser.hpp b/src/EHHeaderParser.hpp
index 0101835..f97cca5 100644
--- a/src/EHHeaderParser.hpp
+++ b/src/EHHeaderParser.hpp
@@ -109,6 +109,8 @@
                                       hdrInfo))
     return false;
 
+  if (hdrInfo.fde_count == 0) return false;
+
   size_t tableEntrySize = getTableEntrySize(hdrInfo.table_enc);
   pint_t tableEntry;