CVE-2020-28163 (Other, published 2023-04-16T00:15Z)
Description: value: libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/davea42/libdwarf-code
Files changed:
libdwarf/ChangeLog
libdwarf/dwarf_print_lines.c
Commit message: modified:   libdwarf/dwarf_print_lines.c
    * dwarf_print_lines.c: In case of corrupted
      DWARF5 line header the fi_file_name field
      for a file entry can be null. Now
      we print a <no file name> string in that case
      to avoid passing a null to dwarfstring_append.
      Dwarfbug DW202010-003.
      Also some lines longer than libdwarf standard
      were shortened, but a few long lines really
      must remain.


Vulnerable code:
    /* Ugly indenting follows, it makes lines shorter to see them better.
        Best to use a wider text window to really see how it looks.*/
        dwarfstring_append_printf_u(&m1,"0x%" DW_PR_XZEROS DW_PR_DUx ,
        dwarfstring_append_printf_i(&m1,"   %1d", regs->lr_basic_block);
        dwarfstring_append_printf_i(&m1,"%1d\n",  regs->lr_end_sequence);
                "  x%02" DW_PR_DUx , regs->lr_call_context); /* EXPERIMENTAL */
                "  x%02" DW_PR_DUx , regs->lr_subprogram); /* EXPERIMENTAL */
                " type 0x%" DW_PR_XZEROS DW_PR_DUx ,valpair->up_first);
            dwarfstring_append_printf_s(&m3,
                "%-20s ",
                (char *) fe->fi_file_name);
            dwarfstring_append_printf_u(&m3,
                "(file-number: %u)\n",
                filenum);
            dwarfstring_append_printf_s(&m3,
                "%-20s ",(char *)fe->fi_file_name);
            dwarfstring_append_printf_u(&m3,
                "(file-number: %u)\n",filenum);
    /*  Pointer to a DW_AT_stmt_list attribute in case it exists in the
        die. */
    resattr = dwarf_attr(die, DW_AT_stmt_list, &stmt_list_attr, error);
        int resfis = _dwarf_get_fission_addition_die(die, DW_SECT_LINE,
    /*  If die has DW_AT_comp_dir attribute, get the string that names
        the compilation directory. */
                print_line_header(dbg, is_single_table, is_actuals_table);

Fixed code:
2020-10-28: David Anderson
    * dwarf_print_lines.c: In case of corrupted
      DWARF5 line header the fi_file_name field
      for a file entry can be null. Now
      we print a <no file name> string in that case
      to avoid passing a null to dwarfstring_append.
      Dwarfbug DW202010-003.
      Also some lines longer than libdwarf standard
      were shortened, but a few long lines really
      must remain.
    /*  Ugly indenting follows, it makes lines shorter
        to see them better.
        Best to use a wider text window to really
        see how it looks.*/
        dwarfstring_append_printf_u(&m1,"0x%" DW_PR_XZEROS DW_PR_DUx,
        dwarfstring_append_printf_i(&m1,"   %1d",
            regs->lr_basic_block);
        dwarfstring_append_printf_i(&m1,"%1d\n",
            regs->lr_end_sequence);
                "  x%02" DW_PR_DUx,
                regs->lr_call_context); /* EXPERIMENTAL */
                "  x%02" DW_PR_DUx ,
                regs->lr_subprogram); /* EXPERIMENTAL */
                " type 0x%" DW_PR_XZEROS DW_PR_DUx,
                valpair->up_first);
        /*  DWARF5 can have a null fi_file_name
            if  the format code in the
            line table header is unknown, such
            as in a corrupt object file. */
        dwarfstring_append_printf_s(&m3,
            "%-20s ",
            fe->fi_file_name?
            (char *) fe->fi_file_name:
            "<no file name>");
        dwarfstring_append_printf_u(&m3,
            "(file-number: %u)\n",
            filenum);
    /*  Pointer to a DW_AT_stmt_list attribute in case
        it exists in the die. */
    resattr = dwarf_attr(die, DW_AT_stmt_list, &stmt_list_attr,
        error);
        int resfis = _dwarf_get_fission_addition_die(die,
            DW_SECT_LINE,
    /*  If die has DW_AT_comp_dir attribute, get the string
        that names the compilation directory. */
                print_line_header(dbg, is_single_table,
                    is_actuals_table);