From: Mark Wielaard <mark@klomp.org>
Date: Thu, 9 Jul 2026 19:56:56 +0000 (+0200)
Subject: libdw: Sanity check macros line_offset before reading
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=827a8916590e244720049ec1f438d3ca6763472a;p=thirdparty%2Felfutils.git

libdw: Sanity check macros line_offset before reading

We checked there were enough bytes left after reading the
line_offset. Move the check before the read.

	* libdw/dwarf_getmacros.c (get_table_for_offset): Check
	offset_bytes before calling read_addr_unaligned_inc.

https://sourceware.org/bugzilla/show_bug.cgi?id=34382

Reported-by: Karan Kurani <karankurani3k@gmail.com>
Signed-off-by: Mark Wielaard <mark@klomp.org>
---

diff --git a/libdw/dwarf_getmacros.c b/libdw/dwarf_getmacros.c
index bb2272ea..e3efd083 100644
--- a/libdw/dwarf_getmacros.c
+++ b/libdw/dwarf_getmacros.c
@@ -171,7 +171,7 @@ get_table_for_offset (Dwarf *dbg, Dwarf_Word macoff,
 {
   const unsigned char *startp = readp;
 
-  /* Request at least 3 bytes for header.  */
+  /* Request at least 3 bytes for header (version 2 bytes, flag 1 byte).  */
   if (readp + 3 > endp)
     {
     invalid_dwarf:
@@ -192,9 +192,10 @@ get_table_for_offset (Dwarf *dbg, Dwarf_Word macoff,
   Dwarf_Off line_offset = (Dwarf_Off) -1;
   if ((flags & 0x2) != 0)
     {
-      line_offset = read_addr_unaligned_inc (is_64bit ? 8 : 4, dbg, readp);
-      if (readp > endp)
+      int offset_bytes = is_64bit ? 8 : 4;
+      if (readp >= endp - offset_bytes)
 	goto invalid_dwarf;
+      line_offset = read_addr_unaligned_inc (offset_bytes, dbg, readp);
     }
   else if (cudie != NULL)
     {