Commit 58756ef
committed
Validate async debug offsets read from remote process
The _remote_debugging module reads async_debug_offsets from the target
process's memory but did not validate them, unlike debug_offsets which
go through validate_debug_offsets(). The asyncio_task_object.size field
is used as the read length into fixed-size 4096-byte stack buffers
(SIZEOF_TASK_OBJ); a malicious or compromised target process could
supply a larger size and overflow the debugger's stack.
Add validate_async_debug_offsets() and call it from read_async_debug()
(the single chokepoint for loading these offsets) to bound the task
object size and the member offsets that index into the local buffer.1 parent a0c57a8 commit 58756ef
1 file changed
+47
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
58 | 58 | | |
59 | 59 | | |
60 | 60 | | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
61 | 102 | | |
62 | 103 | | |
63 | 104 | | |
| |||
71 | 112 | | |
72 | 113 | | |
73 | 114 | | |
| 115 | + | |
74 | 116 | | |
75 | | - | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
76 | 122 | | |
77 | 123 | | |
78 | 124 | | |
| |||
0 commit comments