From: Mark Wielaard Date: Sat, 11 Jul 2026 15:30:15 +0000 (+0200) Subject: libdw: Check there are any header bytes in loclists X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=304f2a62981badd1d1c8f2507dc8d156856e065b;p=thirdparty%2Felfutils.git libdw: Check there are any header bytes in loclists We tried to read the loclists header length and only then checked if there were any bytes left. Make sure to check there are at least 4 bytes for the initial unit length. * libdw/libdwP.h (__libdw_cu_locs_base): Check before initial unit_length read. https://sourceware.org/bugzilla/show_bug.cgi?id=34386 Reported-by: Karan Kurani Signed-off-by: Mark Wielaard --- diff --git a/libdw/libdwP.h b/libdw/libdwP.h index 25391396..1a3aea2d 100644 --- a/libdw/libdwP.h +++ b/libdw/libdwP.h @@ -1458,6 +1458,8 @@ __libdw_cu_locs_base (Dwarf_CU *cu) const unsigned char *const dataend = (unsigned char *) data->d_buf + data->d_size; + if (unlikely (readp > dataend - 4)) + goto no_header; uint64_t unit_length = read_4ubyte_unaligned_inc (dbg, readp); unsigned int offset_size = 4; if (unlikely (unit_length == 0xffffffff))