debug/dwarf: don't crash on invalid range/rnglist offset

No test case because the problem can only happen for invalid data. Let
the fuzzer find cases like this.

Fixes #53529

Change-Id: I318c87795e545fe5a006d16b4d361cd4bf5d502d
Reviewed-on: https://go-review.googlesource.com/c/go/+/434936
Run-TryBot: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Run-TryBot: Ian Lance Taylor <iant@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>

diff --git a/src/debug/dwarf/entry.go b/src/debug/dwarf/entry.go
index 6f80d0750371fcda71a294bdd1b40622e455c55c..7f48ff3a04176391955ee85aba79c75b490fc223 100644 (file)
--- a/src/debug/dwarf/entry.go
+++ b/src/debug/dwarf/entry.go
@@ -13,6 +13,7 @@ package dwarf
 import (
        "encoding/binary"
        "errors"
+       "fmt"
        "strconv"
 )
 
@@ -1103,6 +1104,9 @@ func (d *Data) baseAddressForEntry(e *Entry) (*Entry, uint64, error) {
 }
 
 func (d *Data) dwarf2Ranges(u *unit, base uint64, ranges int64, ret [][2]uint64) ([][2]uint64, error) {
+       if ranges > int64(len(d.ranges)) {
+               return nil, fmt.Errorf("invalid range offset %d (max %d)", ranges, len(d.ranges))
+       }
        buf := makeBuf(d, u, "ranges", Offset(ranges), d.ranges[ranges:])
        for len(buf.data) > 0 {
                low := buf.addr()
@@ -1125,6 +1129,9 @@ func (d *Data) dwarf2Ranges(u *unit, base uint64, ranges int64, ret [][2]uint64)
 // dwarf5Ranges interprets a debug_rnglists sequence, see DWARFv5 section
 // 2.17.3 (page 53).
 func (d *Data) dwarf5Ranges(u *unit, cu *Entry, base uint64, ranges int64, ret [][2]uint64) ([][2]uint64, error) {
+       if ranges > int64(len(d.rngLists)) {
+               return nil, fmt.Errorf("invalid rnglist offset %d (max %d)", ranges, len(d.ranges))
+       }
        var addrBase int64
        if cu != nil {
                addrBase, _ = cu.Val(AttrAddrBase).(int64)