From: Mark Wielaard Date: Sat, 11 Jul 2026 15:23:36 +0000 (+0200) Subject: libdw: Check there are any header bytes in rnglists X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7eda694689546ef0d5f501ce049f84f5283659a2;p=thirdparty%2Felfutils.git libdw: Check there are any header bytes in rnglists We tried to read the rnglists header length and only then checked if there were any bytes left. Make sure to check there are at least 4 bytes for the initial unit length. * libdw/libdwP.h (__libdw_cu_ranges_base): Check before initial unit_length read. https://sourceware.org/bugzilla/show_bug.cgi?id=34385 Reported-by: Karan Kurani Signed-off-by: Mark Wielaard --- diff --git a/libdw/libdwP.h b/libdw/libdwP.h index 5e1029bd..25391396 100644 --- a/libdw/libdwP.h +++ b/libdw/libdwP.h @@ -1373,6 +1373,8 @@ __libdw_cu_ranges_base (Dwarf_CU *cu) const unsigned char *const dataend = (unsigned char *) data->d_buf + data->d_size; + if (unlikely (readp > dataend - 4)) + goto no_header; uint64_t unit_length = read_4ubyte_unaligned_inc (dbg, readp); unsigned int offset_size = 4; if (unlikely (unit_length == 0xffffffff))