[go] debug/dwarf: don't crash on negative line file index
7 views
Skip to first unread message
Tobias Klauser (Gerrit)
Sep 3, 2026, 4:50:35 AMSep 3
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Tobias Klauser has uploaded the change for review![]( "Open in Gerrit")
Commit message
debug/dwarf: don't crash on negative line file index
A malformed DWARF line table can cause a DW_LNS_set_file operand to
overflow when converted to int, producing a negative file index
resulting in a panic due to an out-of-bounds slice access in updateFile.
For #47653
Change-Id: Id1ee628add54bb9147700d7000dd5c34474694f4
Change diff
diff --git a/src/debug/dwarf/fuzz_test.go b/src/debug/dwarf/fuzz_test.go
index bc342b0..e653520 100644
--- a/src/debug/dwarf/fuzz_test.go
+++ b/src/debug/dwarf/fuzz_test.go
@@ -14,6 +14,35 @@
f.Skip("Skipping in short mode")
}
+ // A DWARF 4 compile unit with a line program containing a
+ // DW_LNS_set_file instruction with a file index of math.MaxUint64.
+ f.Add(
+ []byte{
+ 1, 0x11, 0,
+ 0x10, 0x17,
+ 0, 0,
+ 0,
+ },
+ []byte{
+ 0x0c, 0, 0, 0,
+ 4, 0,
+ 0, 0, 0, 0,
+ 8,
+ 1,
+ 0, 0, 0, 0,
+ },
+ []byte{
+ 0x25, 0, 0, 0,
+ 4, 0,
+ 0x14, 0, 0, 0,
+ 1, 1, 1, 0, 1, 13,
+ 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1,
+ 0, 0,
+ 4,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 1,
+ },
+ )
+
f.Fuzz(func(t *testing.T, abbrev, info, line []byte) {
d, err := dwarf.New(abbrev, nil, nil, info, line, nil, nil, nil)
if err != nil {
diff --git a/src/debug/dwarf/line.go b/src/debug/dwarf/line.go
index 3811416..f6fe08e 100644
--- a/src/debug/dwarf/line.go
+++ b/src/debug/dwarf/line.go
@@ -465,7 +465,7 @@
// updateFile updates r.state.File after r.fileIndex has
// changed or r.fileEntries has changed.
func (r *LineReader) updateFile() {
- if r.fileIndex < len(r.fileEntries) {
+ if r.fileIndex >= 0 && r.fileIndex < len(r.fileEntries) {
r.state.File = r.fileEntries[r.fileIndex]
} else {
r.state.File = nil
Change information
Files:
- M src/debug/dwarf/fuzz_test.go
- M src/debug/dwarf/line.go
Change size: S
Delta: 2 files changed, 30 insertions(+), 1 deletion(-)
Related details
Attention set is empty
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Ian Lance Taylor (Gerrit)
Sep 3, 2026, 3:39:27 PMSep 3
to Tobias Klauser, goph...@pubsubhelper.golang.org, Ian Lance Taylor, golang...@luci-project-accounts.iam.gserviceaccount.com, Austin Clements, Than McIntosh, Gopher Robot, golang-co...@googlegroups.com
Attention needed from Austin Clements, Than McIntosh and Tobias Klauser
Ian Lance Taylor voted and added 1 comment![]( "Open in Gerrit")
Votes added by Ian Lance Taylor
| Code-Review | +2 |
1 comment
Patchset-level comments
Related details
Attention is currently required from:
- Austin Clements
- Than McIntosh
- Tobias Klauser
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Tobias Klauser (Gerrit)
Sep 3, 2026, 5:00:09 PMSep 3
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Attention needed from Austin Clements, Than McIntosh and Tobias Klauser
Tobias Klauser uploaded new patchset![]( "Open in Gerrit")
Tobias Klauser uploaded patch set #2 to this change.
Following approvals got outdated and were removed:
- TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
Related details
Attention is currently required from:
- Austin Clements
- Than McIntosh
- Tobias Klauser
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Tobias Klauser (Gerrit)
Sep 3, 2026, 5:02:12 PMSep 3
to goph...@pubsubhelper.golang.org, Ian Lance Taylor, golang...@luci-project-accounts.iam.gserviceaccount.com, Austin Clements, Than McIntosh, Gopher Robot, golang-co...@googlegroups.com
Attention needed from Austin Clements and Than McIntosh
Tobias Klauser voted Auto-Submit+1![]( "Open in Gerrit")
| Auto-Submit | +1 |
Related details
Attention is currently required from:
- Austin Clements
- Than McIntosh
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Michael Pratt (Gerrit)
Sep 4, 2026, 6:03:09 PMSep 4
to Tobias Klauser, goph...@pubsubhelper.golang.org, Michael Pratt, golang...@luci-project-accounts.iam.gserviceaccount.com, Ian Lance Taylor, Austin Clements, Than McIntosh, Gopher Robot, golang-co...@googlegroups.com
Attention needed from Austin Clements, Than McIntosh and Tobias Klauser
Michael Pratt voted Code-Review+1![]( "Open in Gerrit")
Attention is currently required from:
- Austin Clements
- Than McIntosh
- Tobias Klauser
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Tobias Klauser (Gerrit)
Sep 5, 2026, 5:06:55 AMSep 5
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Attention needed from Austin Clements, Than McIntosh and Tobias Klauser
Tobias Klauser uploaded new patchset![]( "Open in Gerrit")
Tobias Klauser uploaded patch set #3 to this change.
Following approvals got outdated and were removed:
- TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
Related details
Attention is currently required from:
- Austin Clements
- Than McIntosh
- Tobias Klauser
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Florian Lehner (Gerrit)
Sep 6, 2026, 11:31:00 AMSep 6
to Tobias Klauser, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Michael Pratt, Ian Lance Taylor, Austin Clements, Than McIntosh, Gopher Robot, golang-co...@googlegroups.com
Attention needed from Austin Clements, Than McIntosh and Tobias Klauser
Florian Lehner voted Code-Review+1![]( "Open in Gerrit")
| Code-Review | +1 |
Related details
Attention is currently required from:
- Austin Clements
- Than McIntosh
- Tobias Klauser
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Junyang Shao (Gerrit)
Sep 11, 2026, 1:46:35 PMSep 11
to Tobias Klauser, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Michael Pratt, Ian Lance Taylor, Austin Clements, Than McIntosh, Gopher Robot, golang-co...@googlegroups.com
Attention needed from Austin Clements, Than McIntosh and Tobias Klauser
Junyang Shao voted Code-Review+1![]( "Open in Gerrit")
| Code-Review | +1 |
Related details
Attention is currently required from:
- Austin Clements
- Than McIntosh
- Tobias Klauser
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
Sep 11, 2026, 1:48:09 PMSep 11
to Tobias Klauser, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Junyang Shao, golang...@luci-project-accounts.iam.gserviceaccount.com, Michael Pratt, Ian Lance Taylor, Austin Clements, Than McIntosh, golang-co...@googlegroups.com
Gopher Robot submitted the change with unreviewed changes![]( "Open in Gerrit")
Unreviewed changes
1 is the latest approved patch-set.
The change was submitted with unreviewed changes in the following files:
```
The name of the file: src/debug/dwarf/fuzz_test.go
Insertions: 73, Deletions: 0.
@@ -6,6 +6,11 @@
import (
"debug/dwarf"
+ "debug/elf"
+ "debug/macho"
+ "os"
+ "path/filepath"
+ "strings"
"testing"
)
@@ -14,6 +19,79 @@
f.Skip("Skipping in short mode")
}
+ dwarfSuffix := func(name string) string {
+ switch {
+ // ELF prefixes, see dwarfSuffix in debug/elf.DWARF
+ case strings.HasPrefix(name, ".debug_"):
+ return name[7:]
+ case strings.HasPrefix(name, ".zdebug_"):
+ return name[8:]
+ // machO prefixes, see dwarfSuffix in debug/macho.DWARF
+ case strings.HasPrefix(name, "__debug_"):
+ return name[8:]
+ case strings.HasPrefix(name, "__zdebug_"):
+ return name[9:]
+ default:
+ return ""
+ }
+ }
+
+ testdata, err := os.ReadDir("testdata")
+ if err != nil {
+ f.Fatalf("failed to read testdata directory: %s", err)
+ }
+ for _, de := range testdata {
+ if de.IsDir() {
+ continue
+ }
+
+ var abbrev, info, line []byte
+
+ ext := filepath.Ext(de.Name())
+ name := filepath.Join("testdata", de.Name())
+
+ switch {
+ case strings.HasPrefix(ext, ".elf"):
+ e, err := elf.Open(name)
+ if err != nil {
+ f.Fatal(err)
+ }
+
+ for _, s := range e.Sections {
+ switch dwarfSuffix(s.Name) {
+ case "abbrev":
+ abbrev, _ = s.Data()
+ case "info":
+ info, _ = s.Data()
+ case "line":
+ line, _ = s.Data()
+ }
+ }
+ case strings.HasPrefix(ext, ".macho"):
+ m, err := macho.Open(name)
+ if err != nil {
+ f.Fatal(err)
+ }
+
+ for _, s := range m.Sections {
+ switch dwarfSuffix(s.Name) {
+ case "abbrev":
+ abbrev, _ = s.Data()
+ case "info":
+ info, _ = s.Data()
+ case "line":
+ line, _ = s.Data()
+ }
+ }
+ default:
+ continue
+ }
+
+ if len(abbrev) > 0 || len(info) > 0 || len(line) > 0 {
+ f.Add(abbrev, info, line)
+ }
+ }
+
// A DWARF 4 compile unit with a line program containing a
// DW_LNS_set_file instruction with a file index of math.MaxUint64.
f.Add(
```
Change information
Commit message:
debug/dwarf: don't crash on negative line file index
A malformed DWARF line table can cause a DW_LNS_set_file operand to
overflow when converted to int, producing a negative file index
resulting in a panic due to an out-of-bounds slice access in updateFile.
For #47653
Fixes #81184
Change-Id: Id1ee628add54bb9147700d7000dd5c34474694f4
Reviewed-on: https://go-review.googlesource.com/c/go/+/827105
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpr...@google.com>
Reviewed-by: Junyang Shao <shaoj...@google.com>
Auto-Submit: Tobias Klauser <tobias....@gmail.com>
Reviewed-by: Ian Lance Taylor <ia...@golang.org>
Reviewed-by: Florian Lehner <lhnr...@gmail.com>
Files:
- M src/debug/dwarf/fuzz_test.go
- M src/debug/dwarf/line.go
Change size: S
Delta: 2 files changed, 30 insertions(+), 1 deletion(-)
Branch: refs/heads/master
Submit Requirements:
Code-Review: +1 by Michael Pratt, +2 by Ian Lance Taylor, +1 by Junyang Shao, +1 by Florian Lehner
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages