Skip to content

fix: bound DWARF .eh_frame_hdr parsing to the section#571

Open
edznux-dd wants to merge 1 commit into
DataDog:mainfrom
edznux-dd:fix/dwarf-parser-oob
Open

fix: bound DWARF .eh_frame_hdr parsing to the section#571
edznux-dd wants to merge 1 commit into
DataDog:mainfrom
edznux-dd:fix/dwarf-parser-oob

Conversation

@edznux-dd
Copy link
Copy Markdown

What does this PR do?:

Fix bound checking on untrusted section size, avoid infinite loops, and fix small fuzz-harness only memory leak.

Motivation:

Make the dwarf parser more reliable.

Additional Notes:

How to test the change?:

For Datadog employees:

  • If this PR touches code that signs or publishes builds or packages, or handles
    credentials of any kind, I've requested a review from @DataDog/security-design-and-guidance.
  • This PR doesn't touch any of that.
  • JIRA: [JIRA-XXXX]

Unsure? Have a question? Request a review!

@edznux-dd edznux-dd requested a review from a team as a code owner June 1, 2026 16:39
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c6e3fc8393

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +179 to +180
if (fde < _section_start || fde >= _section_end) {
continue;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Stop bounding FDE addresses to .eh_frame_hdr

For normal Linux ELFs, the PT_GNU_EH_FRAME segment size passed from symbols_linux.cpp covers only .eh_frame_hdr, while the table entries resolve to FDE records in the adjacent .eh_frame section. With this check, valid FDE offsets that are outside the header are skipped, so the parser builds an empty DWARF table and loses per-PC unwind/default-frame detection for regular shared libraries and executables.

Useful? React with 👍 / 👎.

@datadog-prod-us1-5
Copy link
Copy Markdown

datadog-prod-us1-5 Bot commented Jun 1, 2026

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 8 Pipeline jobs failed

CI Run | test-matrix / test-linux-glibc-aarch64 (21, debug)   View in Datadog   GitHub Actions

🔧 Fix in code (Fix with Cursor). Test failed after 5 attempts.

CI Run | test-matrix / test-linux-glibc-amd64 (11, debug)   View in Datadog   GitHub Actions

🔧 Fix in code (Fix with Cursor). 1 failed test in NativeLibrariesTest.java:98 due to assertion failure: org.opentest4j.AssertionFailedError.

CI Run | test-matrix / test-linux-glibc-amd64 (17, debug)   View in Datadog   GitHub Actions

🔧 Fix in code (Fix with Cursor). 1 failed test. AssertionFailedError at NativeLibrariesTest.java:98.

View all 8 failed jobs.

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c6e3fc8 | Docs | Datadog PR Page | Give us feedback!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant