Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
davea42/libdwarf-code
main @ e21b5ad
15
Fixes
0
CVEs
HIGH
Peak severity
23.1%
Coverage
Highlights
Out-of-bounds Read: 6 prior fixes. Scrutinize any change in this area.
libdwarf/dwarf_util.c: most-fixed (3 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Out-of-bounds Read: Multiple fixes address missing bounds checks before dereferencing pointers into DWARF sections, especially in attribute and LEB parsing. This is the most pervasive vulnerability class, affecting core decoding paths and likely exploitable with crafted files.
Integer Overflow: Overflows in Mach-O section offset arithmetic and line file entry counts can lead to memory corruption. These require careful validation of arithmetic on attacker-controlled values before use as sizes or offsets.
Memory Corruption: Null pointer dereference in compressed section handling and incorrect allocator type for Dwarf_Chain objects cause heap corruption. These are distinct memory-safety failures in different components but both critical.