Fix seg-fault in the DWARF reader code when accessing an abbreviatuin table with...

  PR 31456

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 1491e8db03ab160d47f322b78b10b8efff5e20ec..92a07e00e9b22f6446e465b63dde43613fe9e0db 100644 (file)
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -10728,9 +10728,18 @@ display_debug_names (struct dwarf_section *section, void *file)
        {
          uint64_t string_offset, entry_offset;
          unsigned char *p;
+         /* We need to scan first whether there is a single or multiple
+            entries.  TAGNO is -2 for the first entry, it is -1 for the
+            initial tag read of the second entry, then it becomes 0 for the
+            first entry for real printing etc.  */
+         int tagno = -2;
+         /* Initialize it due to a false compiler warning.  */
+         uint64_t second_abbrev_tag = -1;
+         unsigned char *entryptr;
 
          p = name_table_string_offsets + namei * offset_size;
          SAFE_BYTE_GET (string_offset, p, offset_size, unit_end);
+
          p = name_table_entry_offsets + namei * offset_size;
          SAFE_BYTE_GET (entry_offset, p, offset_size, unit_end);
 
@@ -10739,17 +10748,17 @@ display_debug_names (struct dwarf_section *section, void *file)
          printf ("[%3u] ", namei + 1);
          if (bucket_count != 0)
            printf ("#%08x ", hash_table_hashes[namei]);
+
          printf ("%s:", fetch_indirect_string (string_offset));
 
-         unsigned char *entryptr = entry_pool + entry_offset;
+         entryptr = entry_pool + entry_offset;
+         /* PR 31456: Check for invalid entry offset.  */
+         if (entryptr < entry_pool || entryptr >= unit_end)
+           {
+             warn (_("Invalid entry offset value: %" PRIx64 "\n"), entry_offset);
+             break;
+           }
 
-         /* We need to scan first whether there is a single or multiple
-            entries.  TAGNO is -2 for the first entry, it is -1 for the
-            initial tag read of the second entry, then it becomes 0 for the
-            first entry for real printing etc.  */
-         int tagno = -2;
-         /* Initialize it due to a false compiler warning.  */
-         uint64_t second_abbrev_tag = -1;
          for (;;)
            {
              uint64_t abbrev_tag;