diff --git a/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs b/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs index cfb4b7135..d21bce3c5 100644 --- a/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs +++ b/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs @@ -151,7 +151,37 @@ public override void Analyze(BinaryAnalyzerContext context) if (binary is ElfBinary elf) { var validGccCommandLineInfos = new List(); - foreach (DwarfCompileCommandLineInfo info in binary.CommandLineInfos) + + // Some real-world ELF binaries contain DWARF producer entries that + // the DWARF parser does not yet understand (for example, newer + // DW_FORM_* values emitted by recent toolchains, or string-form + // references whose backing section the parser can't resolve). + // In those cases binary.CommandLineInfos throws, which currently + // aborts BA3003 entirely for the target via ERR998. Treat such + // failures as "no DWARF compile-unit information available" so + // the rule can fall back to the symbol-table heuristic below. + // + // The DWARF parser code paths reachable from CommandLineInfos + // can throw any of InvalidOperationException, NotImplementedException, + // ArgumentException, DwarfBufferOverreadException, and bare + // System.Exception (see DwarfCompilationUnit / DwarfMemoryReader / + // DwarfCommonInformationEntry). Because some call sites throw the + // base Exception type directly, we cannot narrow this catch any + // further without re-introducing the ERR998 abort for inputs the + // parser doesn't yet recognise. + List commandLineInfos; + try + { + commandLineInfos = binary.CommandLineInfos; + } +#pragma warning disable CA1031 // Do not catch general exception types -- intentional, see comment above. + catch (Exception) +#pragma warning restore CA1031 + { + commandLineInfos = new List(); + } + + foreach (DwarfCompileCommandLineInfo info in commandLineInfos) { if (ElfUtility.GetDwarfCommandLineType(info.CommandLine) != DwarfCommandLineType.Gcc) {