read_cie

	* dwarf.c (read_cie): Add more sanity checks to ensure data
	pointer is not bumped past end.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index 9d646ed9870d08d087e3ca85e50ea2d2567316eb..f2d363e7af21fc2616569f06c8a56aaa5968465e 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,8 @@
+2021-05-15  Alan Modra  <amodra@gmail.com>
+
+       * dwarf.c (read_cie): Add more sanity checks to ensure data
+       pointer is not bumped past end.
+
 2021-05-15  Alan Modra  <amodra@gmail.com>
 
        * dwarf.c (display_debug_ranges): Delete initial_length_size.

diff --git a/binutils/dwarf.c b/binutils/dwarf.c
index 9243c8530200949c4300519e1560d6a3ab70f785..93e6d7319fa070a5e550cc228d2f3c2e25b62260 100644 (file)
--- a/binutils/dwarf.c
+++ b/binutils/dwarf.c
@@ -8409,10 +8409,16 @@ read_cie (unsigned char *start, unsigned char *end,
     }
 
   if (strcmp (fc->augmentation, "eh") == 0)
-    start += eh_addr_size;
+    {
+      if (eh_addr_size > (size_t) (end - start))
+       goto fail;
+      start += eh_addr_size;
+    }
 
   if (version >= 4)
     {
+      if (2 > (size_t) (end - start))
+       goto fail;
       GET (fc->ptr_size, 1);
       if (fc->ptr_size < 1 || fc->ptr_size > 8)
        {
@@ -8439,6 +8445,9 @@ read_cie (unsigned char *start, unsigned char *end,
   READ_ULEB (fc->code_factor, start, end);
   READ_SLEB (fc->data_factor, start, end);
 
+  if (start >= end)
+    goto fail;
+
   if (version == 1)
     {
       GET (fc->ra, 1);
@@ -8450,6 +8459,8 @@ read_cie (unsigned char *start, unsigned char *end,
 
   if (fc->augmentation[0] == 'z')
     {
+      if (start >= end)
+       goto fail;
       READ_ULEB (augmentation_data_len, start, end);
       augmentation_data = start;
       /* PR 17512: file: 11042-2589-0.004.  */