From: Alan Modra <amodra@gmail.com>
Date: Sat, 15 May 2021 05:52:39 +0000 (+0930)
Subject: read_cie
X-Git-Tag: binutils-2_37~642
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c93c4a85406ebd811ec0b29f1dec882cbba56659;p=thirdparty%2Fbinutils-gdb.git

read_cie

	* dwarf.c (read_cie): Add more sanity checks to ensure data
	pointer is not bumped past end.
---

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 9d646ed9870..f2d363e7af2 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2021-05-15  Alan Modra  <amodra@gmail.com>
+
+	* dwarf.c (read_cie): Add more sanity checks to ensure data
+	pointer is not bumped past end.
+
 2021-05-15  Alan Modra  <amodra@gmail.com>
 
 	* dwarf.c (display_debug_ranges): Delete initial_length_size.
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 9243c853020..93e6d7319fa 100644
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -8409,10 +8409,16 @@ read_cie (unsigned char *start, unsigned char *end,
     }
 
   if (strcmp (fc->augmentation, "eh") == 0)
-    start += eh_addr_size;
+    {
+      if (eh_addr_size > (size_t) (end - start))
+	goto fail;
+      start += eh_addr_size;
+    }
 
   if (version >= 4)
     {
+      if (2 > (size_t) (end - start))
+	goto fail;
       GET (fc->ptr_size, 1);
       if (fc->ptr_size < 1 || fc->ptr_size > 8)
 	{
@@ -8439,6 +8445,9 @@ read_cie (unsigned char *start, unsigned char *end,
   READ_ULEB (fc->code_factor, start, end);
   READ_SLEB (fc->data_factor, start, end);
 
+  if (start >= end)
+    goto fail;
+
   if (version == 1)
     {
       GET (fc->ra, 1);
@@ -8450,6 +8459,8 @@ read_cie (unsigned char *start, unsigned char *end,
 
   if (fc->augmentation[0] == 'z')
     {
+      if (start >= end)
+	goto fail;
       READ_ULEB (augmentation_data_len, start, end);
       augmentation_data = start;
       /* PR 17512: file: 11042-2589-0.004.  */