ubsan: shift exponent is too large

	* libbfd.c (_bfd_read_unsigned_leb128): Avoid excessive shift.
	(_bfd_safe_read_leb128, _bfd_read_signed_leb128): Likewise.

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index e3f87787062acd1577ad21effe4d993b76b58650..e2e9256086a9dd98952275ea60039fdd2517c827 100644 (file)
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,8 @@
+2021-02-16  Alan Modra  <amodra@gmail.com>
+
+       * libbfd.c (_bfd_read_unsigned_leb128): Avoid excessive shift.
+       (_bfd_safe_read_leb128, _bfd_read_signed_leb128): Likewise.
+
 2021-02-15  Jan Beulich  <jbeulich@suse.com>
 
        * doc/Makefile.am: Replace "cp -p" by "$(LN_S)".

diff --git a/bfd/libbfd.c b/bfd/libbfd.c
index cd94b81bc4347425ed0f2ec0ded0b85696479217..4f3dd5ad53cafdff64f94e596369c5151f3c1969 100644 (file)
--- a/bfd/libbfd.c
+++ b/bfd/libbfd.c
@@ -1074,8 +1074,11 @@ _bfd_read_unsigned_leb128 (bfd *abfd ATTRIBUTE_UNUSED,
       byte = bfd_get_8 (abfd, buf);
       buf++;
       num_read++;
-      result |= (((bfd_vma) byte & 0x7f) << shift);
-      shift += 7;
+      if (shift < 8 * sizeof (result))
+       {
+         result |= (((bfd_vma) byte & 0x7f) << shift);
+         shift += 7;
+       }
     }
   while (byte & 0x80);
   *bytes_read_ptr = num_read;
@@ -1104,10 +1107,11 @@ _bfd_safe_read_leb128 (bfd *abfd ATTRIBUTE_UNUSED,
       byte = bfd_get_8 (abfd, data);
       data++;
       num_read++;
-
-      result |= ((bfd_vma) (byte & 0x7f)) << shift;
-
-      shift += 7;
+      if (shift < 8 * sizeof (result))
+       {
+         result |= ((bfd_vma) (byte & 0x7f)) << shift;
+         shift += 7;
+       }
       if ((byte & 0x80) == 0)
        break;
     }
@@ -1141,8 +1145,11 @@ _bfd_read_signed_leb128 (bfd *abfd ATTRIBUTE_UNUSED,
       byte = bfd_get_8 (abfd, buf);
       buf ++;
       num_read ++;
-      result |= (((bfd_vma) byte & 0x7f) << shift);
-      shift += 7;
+      if (shift < 8 * sizeof (result))
+       {
+         result |= (((bfd_vma) byte & 0x7f) << shift);
+         shift += 7;
+       }
     }
   while (byte & 0x80);
   if (shift < 8 * sizeof (result) && (byte & 0x40))